Commit graph

103 commits

Author SHA1 Message Date
Stéphane Lesimple db8f621abf doc: add help about the interactive builtin commands (#227) 2021-09-20 17:00:46 +02:00
Stéphane Lesimple d3f443a532 release v3.05.00 2021-09-14 10:21:04 +02:00
Stéphane Lesimple ef10d509fd enh: add max_inactive_days to account configuration (#230) 2021-09-06 14:52:46 +02:00
Stéphane Lesimple 873804dbbe enh: config reading: add rootonly option 2021-09-02 10:06:47 +02:00
Stéphane Lesimple 9b2aa996b3 enh: better use of account creation metadata
Store account creation information in a JSON.
Display this information in `accountInfo` for auditors.
2021-07-23 09:50:18 +02:00
Stéphane Lesimple c0bebf23d4 fix: accountCreate --uid-auto: rare case where a free UID couldn't be found
This happened when a free UID was found, along with a corresponding GID,
but the corresponding GID for the ttyrec group of the account was not
available. Now this is checked directly in get_next_available_uid()
2021-07-19 11:53:18 +02:00
Stéphane Lesimple 858598d80b chore: add debug info in get_acls() 2021-07-15 18:27:42 +02:00
Stéphane Lesimple f483b1540a enh: max account length is now 28 chars up from 18 2021-07-02 17:41:12 +02:00
Stéphane Lesimple a447662cfd release v3.04.00 2021-07-02 17:31:47 +02:00
Stéphane Lesimple 01690e8111 bump to v3.03.99-rc2 2021-06-30 17:20:48 +02:00
Stéphane Lesimple ecee68c8bc chore: fix spurious empty lines at end of generated rst files 2021-06-30 15:52:47 +02:00
Stéphane Lesimple b942131092 fix: use local $_ before while(<>) loops
This closes a range of bugs that can happen if a function using $_ implicitly
in a while is called in a grep {} or map {} which also uses $_
2021-06-30 09:53:04 +02:00
Stéphane Lesimple 2193ee487d enh: replace 'allowUTF8' (introduced in rc1) by 'fanciness' 2021-06-30 09:53:04 +02:00
Stéphane Lesimple c201f44d83 enh: tests: refactor the framework for more maintainability
The chain of executions is as is:
- `docker_build_and_run_tests_all.sh`
  - launches several instances of `docker_build_and_run_tests.sh`
    - builds docker images with the `target_role.sh` and `tester_role.sh` entrypoints
      - inside the tester docker, `tester_role.sh` launches `launch_tests_on_instance.sh`
      - the target docker gets tested after setting up accounts, SSH etc.

Previously, these scripts passed options to each other either by a mix of environment
variables and command-line arguments, with some inconsistencies here and there.

Now, `launch_tests_on_instance.sh` supports a lot of command-line options, which can
be specified directly if testing a remote server, or can be passed-through by the calling
script in case of docker tests. `docker_build_and_run_tests.sh` and
`docker_build_and_run_tests_all.sh` also support to passthrough these options down.
2021-06-25 16:02:38 +02:00
Stéphane Lesimple d400ceeb9f doc: clush: document --user and --port
Partly fixes #201
2021-06-23 12:24:32 +02:00
Stéphane Lesimple 710b55d845 bump to v3.03.99-rc1 2021-06-03 17:01:10 +02:00
Stéphane Lesimple 2e9fe9288b enh: httpproxy: add options to fine-tune logging
Added the `log_request_response` and `log_request_response_max_size`
options to osh-http-proxy.conf.

By default, requests are logged, including their body, up to a size
of 64K per request response. Before, there was no size limit to the
logged body response.
2021-06-03 16:39:56 +02:00
Stéphane Lesimple 850c8cabd4 fix: freebsd: install script: prefer fetch over curl 2021-06-03 16:16:29 +02:00
Stéphane Lesimple 45cfb78b0b fix: httpproxy: allow more passthrough headers
The following additional header is now allowed to come back from the remote server to the client:
* Content-Length

The following additional headers are now passed through to the remote server:
* Content-Length
* Content-Encoding
2021-06-03 16:16:29 +02:00
Stéphane Lesimple b364706f37 feat: httpproxy: add functional tests 2021-06-03 16:16:29 +02:00
Stéphane Lesimple d6291f3ad4 feat: httpproxy: add and use execute_simple() for more performance
Also handle errors better in hand_http_request()
2021-06-03 16:16:29 +02:00
Stéphane Lesimple 4ad41712fd fix: interactive: use load_configuration_file() to handle comments in JSON files 2021-05-27 09:34:37 +02:00
Stéphane Lesimple 17a38ff960 fix: json_load(): remove dead code 2021-05-27 09:34:37 +02:00
Stéphane Lesimple 8cc990ad57 feat: add filtering options to several cmds,nicify print_acls()
The commands selfListAccesses, accountListAccesses,
groupList, groupListServers, groupListGuestAccesses and
accountList now have options to filter their output through
pattern matching, with --include and --exclude.

The output from the commands using print_acls() is also more
human-friendly, with auto-adjusting column length, and empty
columns omitted.

Closes #60.
2021-05-25 09:42:28 +02:00
Stéphane Lesimple adb9d8c374 feat: add UTF-8 chars to output when supported and allowed
To enhance the readability and visibility of important messages
(such as critical ones). This can be disabled with the `allowUTF8`
global option set to `false`. It's never enabled if the user locale
or their terminal don't seem to support it.
2021-05-24 16:44:35 +02:00
Stéphane Lesimple f3ce9dfb06 enh: clearer error message on non-existing group 2021-04-08 12:57:47 +02:00
Stéphane Lesimple 2a905aca96 release v3.03.01 2021-03-25 11:55:04 +01:00
Stéphane Lesimple 003052530e feat: preparatory work to support Debian 11 "Bullseye"
We still need to replacee pam_tally2 by pam_faillock
Debian 11 is NOT yet supported, and won't be before it's released as stable.
2021-03-24 17:41:29 +01:00
Stéphane Lesimple e37e235bf5 enh: install.inc: try harder to hit GitHub API in CI 2021-03-24 10:47:11 +01:00
Stéphane Lesimple 7b7c395c55 enh: osh-orphaned-homedir.sh: add more security checks to ensure we don't archive still-used home dirs 2021-03-19 14:39:31 +01:00
Stéphane Lesimple 7dabfc7135 fix: install-yubico-piv-checker: ppc64le installation was broken 2021-03-17 15:14:13 +01:00
Stéphane Lesimple 89e49ac8b7 fix: add a case to the ignored perl panic race condition 2021-03-01 09:30:30 +01:00
Stéphane Lesimple b6c7503a73 release v3.03.00 2021-02-22 17:09:12 +01:00
Stéphane Lesimple 3764d652da enh: interactive: avoid a warn() when TERM is undef 2021-02-22 11:56:33 +01:00
Stéphane Lesimple 383f2a011c enh: guests: groupAddGuestAccess now supports setting a comment
If no comment is set, the comment is inherited from the group ACL,
as seen in groupListServers.

selfAddPersonalAccess now also return details
about the added server in the returned JSON.

Closes #18
Closes #17
2021-02-22 11:56:19 +01:00
Stéphane Lesimple b480316386 fix: groupDelGuestAccess: deleting a guest access returned an error on TTL-forced groups 2021-02-22 11:56:19 +01:00
Stéphane Lesimple ed77c1ef3e feat: transmit PIV enforcement status to remote realms
Closes #33
2021-02-18 16:05:02 +01:00
Stéphane Lesimple 2327c4dfa1 chore: remove useless '## no critic', perltidy 2021-02-17 10:03:40 +01:00
Stéphane Lesimple 5eb5135d26 doc: update 2021-02-17 10:03:40 +01:00
Stéphane Lesimple 488ec6382e enh: move unexpected-sudo messages from security to code-warning type 2021-02-17 10:03:40 +01:00
Stéphane Lesimple e760cf6142 feat: add groupGenerateEgressKey and groupDelEgressKey 2021-02-17 10:03:40 +01:00
Stéphane Lesimple fe58cf1d14 enh: egress ssh key: compute an ID so that keys can be pointed to and deleted 2021-02-17 10:03:40 +01:00
Stéphane Lesimple c88be2def1 enh: get_group_keys: return the keyhome to avoid hardcoding it on several places 2021-02-17 10:03:40 +01:00
Stéphane Lesimple 02b76d301a fix: groupSetRole: pass sudo param to subfuncs to avoid a security warning 2021-02-17 10:03:40 +01:00
Stéphane Lesimple 4624f71ea2 fix: execute: remove osh_warn on tainted params to avoid exposing arguments on coding error 2021-02-17 10:03:40 +01:00
Stéphane Lesimple 3b37242317 chore: more readable version of sql statements
Signed-off-by: Stéphane Lesimple <stephane.lesimple+bastion@ovhcloud.com>
2021-02-15 11:25:45 +01:00
Stéphane Lesimple 70feff2c2d enh: install: use in-place overwrite for sudoers files
This fixes a race condition in sudo where it would log a log of
error messages to syslog if used while we're running the install
script: files around sudoers.d/ are then moved around, and it'll
yell for each file it previously listed if the file no longer
exists when it tries to stat() it. It also deprecates the --no-wait
flag of the install script, as now the sudoers.d/ directory will
always have integrity at all times.

Signed-off-by: Stéphane Lesimple <stephane.lesimple+bastion@ovhcloud.com>
2021-02-14 22:25:50 +01:00
Stéphane Lesimple 59187fcf4c fix: interactive: omit inactivity msg warning when set to 0 seconds
Signed-off-by: Stéphane Lesimple <stephane.lesimple+bastion@ovhcloud.com>
2021-02-13 16:09:36 +01:00
Stéphane Lesimple d430c602bf release v3.02.00 2021-02-02 15:02:51 +01:00
Stéphane Lesimple a913c5aa8a bump to v3.01.99-rc4 2021-01-25 12:18:27 +01:00