Commit graph

50 commits

Author SHA1 Message Date
Stéphane Lesimple
f609565fe8 enh: batch: detect when asked to start a plugin requiring MFA 2021-12-29 11:20:55 +01:00
Stéphane Lesimple
aaaa173764 feat: add the accountUnlock restricted plugin 2021-12-21 09:42:54 +01:00
Stéphane Lesimple
c48af00ff8 feat: add info_syslog() and code-info syslog type 2021-12-16 11:02:26 +01:00
Stéphane Lesimple
3507586de6 release v3.07.00 2021-12-13 14:02:41 +01:00
Stéphane Lesimple
cb28b44382 chore/fix: move HEXIT() to helper module, use HEXIT only in helpers 2021-12-13 09:51:00 +01:00
Christophe Crochet
e4b132ed9a new access option: --force-password <HASH>, to only try one specific password 2021-12-09 16:51:40 +01:00
Stéphane Lesimple
89ecb2c0d7 feat: add support for Duo PAM auth as MFA (#249) 2021-11-03 15:50:10 +01:00
Stéphane Lesimple
11b2bc60b2 release v3.06.00 2021-10-20 13:42:13 +02:00
Christophe Crochet
d85298f229 new account option: --pubkey-auth-optional, to allow ingress login with or without pubkey when pam is required 2021-10-15 11:22:00 +02:00
madx
ea8ed97a34 new account option: mfa-any, to allow ingress login with pubkey alone or pam alone instead of requiring both 2021-10-15 11:22:00 +02:00
Stéphane Lesimple
b5c5d9d5ee release v3.05.01 2021-09-22 10:43:40 +02:00
Stéphane Lesimple
d3f443a532 release v3.05.00 2021-09-14 10:21:04 +02:00
Stéphane Lesimple
ef10d509fd enh: add max_inactive_days to account configuration (#230) 2021-09-06 14:52:46 +02:00
Stéphane Lesimple
a447662cfd release v3.04.00 2021-07-02 17:31:47 +02:00
Stéphane Lesimple
01690e8111 bump to v3.03.99-rc2 2021-06-30 17:20:48 +02:00
Stéphane Lesimple
ecee68c8bc chore: fix spurious empty lines at end of generated rst files 2021-06-30 15:52:47 +02:00
Stéphane Lesimple
2193ee487d enh: replace 'allowUTF8' (introduced in rc1) by 'fanciness' 2021-06-30 09:53:04 +02:00
Stéphane Lesimple
710b55d845 bump to v3.03.99-rc1 2021-06-03 17:01:10 +02:00
Stéphane Lesimple
d6291f3ad4 feat: httpproxy: add and use execute_simple() for more performance
Also handle errors better in hand_http_request()
2021-06-03 16:16:29 +02:00
Stéphane Lesimple
adb9d8c374 feat: add UTF-8 chars to output when supported and allowed
To enhance the readability and visibility of important messages
(such as critical ones). This can be disabled with the `allowUTF8`
global option set to `false`. It's never enabled if the user locale
or their terminal don't seem to support it.
2021-05-24 16:44:35 +02:00
Stéphane Lesimple
2a905aca96 release v3.03.01 2021-03-25 11:55:04 +01:00
Stéphane Lesimple
89e49ac8b7 fix: add a case to the ignored perl panic race condition 2021-03-01 09:30:30 +01:00
Stéphane Lesimple
b6c7503a73 release v3.03.00 2021-02-22 17:09:12 +01:00
Stéphane Lesimple
b480316386 fix: groupDelGuestAccess: deleting a guest access returned an error on TTL-forced groups 2021-02-22 11:56:19 +01:00
Stéphane Lesimple
ed77c1ef3e feat: transmit PIV enforcement status to remote realms
Closes #33
2021-02-18 16:05:02 +01:00
Stéphane Lesimple
d430c602bf release v3.02.00 2021-02-02 15:02:51 +01:00
Stéphane Lesimple
a913c5aa8a bump to v3.01.99-rc4 2021-01-25 12:18:27 +01:00
Stéphane Lesimple
3bb1db3a4d bump to v3.01.99-rc3 2021-01-21 15:57:11 +01:00
Stéphane Lesimple
fd97845c1c chore: update autoload list accordingly 2021-01-21 15:56:59 +01:00
Stéphane Lesimple
80ade2ba4c fix: debian9: create_file_if_not_exists couldn't chgrp by filehanddle 2021-01-20 14:01:55 +01:00
Stéphane Lesimple
36d0c709db bump to v3.01.99-rc2 2021-01-13 09:38:02 +01:00
Stéphane Lesimple
27d09e8cbe bump to v3.01.99-rc1 2021-01-12 12:05:41 +01:00
Stéphane Lesimple
1129850771 fix: global-log: directly set proper perms on file creation 2021-01-12 12:05:20 +01:00
Stéphane Lesimple
1676979913 feat: add PIV keys support and policy enforcement
A new global option 'ingressRequirePIV' was added, to enable or disable a
bastion-wide policy forcing everybody to use only PIV keys.
2021-01-12 12:05:06 +01:00
Stéphane Lesimple
a479810d83
feat: revamp logs
All connections and plugin executions emit two logs, an 'open' and
a 'close' log. We now add all the details of the connection to
the 'close' logs, those that were previously only available in the
corresponding 'open' log. This way, it is no longer required to
correlate both logs with their uniqid to have all the data:
the 'close' log should suffice. The 'open' log is still there if
for some reason the 'close' log can't be emitted (kill -9, system
crash, etc.), or if the 'open' and the 'close' log are several
hours, days or months appart.

An additional field "duration" has been added to the 'close' logs,
this represents the number of seconds (with millisecond precision)
the connection lasted.

Two new fields "globalsql" and "accountsql" have been added to the
'open'-type logs. These will contain either "ok" if we successfully
logged to the corresponding log database, "no" if it is disabled,
or "error $aDetailedMessage" if we got an error trying to insert
the row. The 'close'-type log also has the new "accountsql_close"
field, but misses the "globalsql_close" field as we never update
the global database on this event. On the 'close' log, we can also
have the value "missing", indicating that we couldn't update the
access log row in the database, as the corresponding 'open' log
couldn't insert it.

The "ttyrecsize" log field for the 'close'-type logs has been removed,
as it was never completely implemented, and contains bogus data if
ttyrec log rotation occurs. It has also been removed from the sqlite
log databases.

The 'open' and 'close' events are now pushed to our own log files,
in addition to syslog, if logging to those files is enabled (see
``enableGlobalAccesssLog`` and ``enableAccountAccessLog``), previously
the 'close' events were only pushed to syslog.

The /home/osh.log is no longer used for ``enableGlobalAccessLog``, the
global log is instead written to /home/logkeeper/global-log-YYYYMM.log.

The global sql file, enabled with ``enableGlobalSqlLog``, is now
split by year-month instead of by year, to
/home/logkeeper/global-log-YYYYMM.sqlite.
2020-12-29 16:14:50 +00:00
Stéphane Lesimple
a204313af9
feat: accountModify: add --osh-only (closes #97) 2020-12-18 11:04:33 +00:00
Stéphane Lesimple
1c33903203
release v3.01.03 2020-12-15 11:35:33 +00:00
Stéphane Lesimple
a3b2b7d8e4
bump to v3.01.02 2020-12-08 15:41:56 +00:00
Stéphane Lesimple
18d8195027
fix: is_valid_remote_user: extend allowed size from 32 to 128 2020-12-08 10:20:25 +00:00
Stéphane Lesimple
534ce45812
release v3.01.01 2020-12-04 16:36:08 +00:00
Stéphane Lesimple
4cb09a9570
nh: remove hardcoded .ssh/authorized_keys2 everywhere 2020-11-26 18:08:03 +00:00
Thomas SOËTE
2a51a78b54 fix: Enable perl-tidy.sh test
* Move to ubuntu-20.04 runner
* Remove check in dockers tests
2020-11-22 21:37:34 +00:00
Stéphane Lesimple
5ecab9888b
bump to v3.01.00 2020-11-20 10:53:00 +00:00
Stéphane Lesimple
15cad00c27
fix: osh.pl: validate user and host format 2020-11-20 07:20:51 +00:00
Stéphane Lesimple
cb02fd2a33 fixes after review 2020-11-17 17:41:32 +01:00
Stéphane Lesimple
b87107dd23
bump to v3.00.02 2020-11-16 10:39:06 +00:00
Stéphane Lesimple
ae1bcbf223
release v3.00.01 2020-11-06 15:22:12 +00:00
Stéphane Lesimple
5c72c92bdd
chore: fix typos everywhere 2020-11-05 17:36:17 +00:00
Stéphane Lesimple
4da7a39f27
release v3.00.00 2020-10-30 10:26:01 +00:00
Stéphane Lesimple
fde20136ef
Initial commit 2020-10-20 14:30:27 +00:00