#! /usr/bin/env perl # vim: set filetype=perl ts=4 sw=4 sts=4 et: use 5.010; use common::sense; use File::Basename; use lib dirname(__FILE__) . '/../../lib/perl'; use OVH::Result; use OVH::Bastion; use Getopt::Long qw(GetOptionsFromString :config pass_through no_ignore_case no_auto_abbrev); use Sys::Hostname; use POSIX qw(strftime); use Term::ANSIColor; use JSON; $| = 1; my $fnret; # # Signals # $SIG{$_} = \&exit_sig for qw{ INT TERM SEGV HUP PIPE }; # # Do just what is needed before the first call to main_exit in the code flow # # safe umask umask(0027); # sanitize user for taint mode my $self = OVH::Bastion::get_user_from_env()->value; my $home = OVH::Bastion::get_home_from_env()->value; my ($sysself, $realm, $remoteself); # to handle realm cases, will be filled later, look for # REALM below # both needs to be there because in case of SIG, we need them in the handler my $log_db_name = undef; my $log_insert_id = undef; # set a uniqid that will be used in syslog, both sqls, and ttyrec name, so we can search for the same event my $log_uniq_id = OVH::Bastion::generate_uniq_id()->value; $ENV{'UNIQID'} = $log_uniq_id; # some modules need it, also used in warn/die handler # fetch basic connection info my ($ipfrom, $portfrom, $bastionip, $bastionport) = split(/\s/, $ENV{'SSH_CONNECTION'}); my $hostfrom = OVH::Bastion::ip2host($ipfrom)->value || $ipfrom; my $bastionhost = OVH::Bastion::ip2host($bastionip)->value || $bastionip; # sub used to exit from this shell, also handles logs for early exits sub main_exit { my ($retcode, $comment, $msg) = @_; # if, this is an early exit, we didn't log anything yet in the sql, do it now OVH::Bastion::log_access_insert( account => $self, cmdtype => 'abort', allowed => undef, ipfrom => $ipfrom, hostfrom => $hostfrom, portfrom => $portfrom, bastionhost => $bastionhost, bastionip => $bastionip, bastionport => $bastionport, ipto => undef, hostto => undef, portto => undef, user => undef, plugin => undef, params => join('^', @ARGV), comment => $comment, uniqid => $log_uniq_id ) if (not defined $log_db_name or not defined $log_insert_id); my $R = R($retcode eq OVH::Bastion::EXIT_OK ? 'OK' : 'KO_' . uc($comment), msg => $msg); OVH::Bastion::osh_crit($R->msg) if not $R; OVH::Bastion::json_output($R) if $ENV{'PLUGIN_JSON'}; exit $retcode; } # Safeness check if (not defined $self) { # wow, that's weird, stop here $self = ''; main_exit(OVH::Bastion::EXIT_EXEC_FAILED, "security_violation", "USER is not defined"); } # # Now, load config # $fnret = OVH::Bastion::load_configuration(); $fnret or main_exit(OVH::Bastion::EXIT_CONFIGURATION_FAILURE, "configuration_failure", $fnret->msg); my $config = $fnret->value; my $bastionName = $config->{'bastionName'}; my $osh_debug = $config->{'debug'}; # REALM case: somebody from another realm (named xyz) connects with the realm_xyz account here, # and the real remote account name (which doesn't have an account here because it's from another realm) # is passed through LC_BASTION if ($self =~ /^realm_([a-zA-Z0-9_.-]+)/) { if ($ENV{'LC_BASTION'}) { # don't overwrite $self just yet because it might end up being invalid, and when we'll call main_exit 2 lines down, # we won't log to the proper place if sql logs or access logs are enabled per account. my $potentialSelf = sprintf("%s/%s", $1, $ENV{'LC_BASTION'}); $fnret = OVH::Bastion::is_bastion_account_valid_and_existing(account => $potentialSelf, realmOnly => 1); $fnret or main_exit(OVH::Bastion::EXIT_ACCOUNT_INVALID, "account_invalid", "The realm-scoped account '$self' is invalid (" . $fnret->msg . ")"); # $potentialSelf is valid, we can use it $self = $potentialSelf; } else { main_exit(OVH::Bastion::EXIT_ACCOUNT_INVALID, "account_invalid", "Attempted to use a realm account but not from another bastion"); } } else { # non-realm case $fnret = OVH::Bastion::is_bastion_account_valid_and_existing(account => $self); $fnret or main_exit(OVH::Bastion::EXIT_ACCOUNT_INVALID, "account_invalid", "The account is invalid (" . $fnret->msg . ")"); } { my %values = %{$fnret->value}; ($sysself, $self, $realm, $remoteself) = @values{qw{ sysaccount account realm remoteaccount }}; } # # First Check : is USER valid ? # my $activenessDenyOnFailure = OVH::Bastion::config("accountExternalValidationDenyOnFailure")->value; my $msg_to_print_delayed; # if set, will be osh_warn()'ed if we're connecting through ssh (i.e. not scp, it breaks it) $fnret = OVH::Bastion::is_account_active(account => $self); if ($fnret) { ; # OK } elsif ($fnret->is_ko || ($activenessDenyOnFailure && $fnret->is_err)) { main_exit OVH::Bastion::EXIT_ACCOUNT_INACTIVE, "account_inactive", "Your account is inactive, $self, sorry"; } else { $msg_to_print_delayed = $fnret->msg; } # # Now : are we in maintenance mode ? # if (-e '/home/allowkeeper/maintenance') { osh_crit "This bastion is currently in maintenance mode, new connections are not allowed."; my $maintenance_message = '(unknown)'; if (open(my $fh, '<', '/home/allowkeeper/maintenance')) { local $/ = undef; $maintenance_message = <$fh>; close($fh); } osh_warn "The maintenance reason is as follows: $maintenance_message"; if (OVH::Bastion::is_admin()) { osh_warn "You are a bastion admin, allowing anyway, but it's really because it's you."; } else { main_exit(OVH::Bastion::EXIT_MAINTENANCE_MODE, "maintenance_mode", $maintenance_message); } } # # Does the user have a TTL, and if yes, has it expired? # $fnret = OVH::Bastion::account_config(account => $self, key => "account_ttl"); if ($fnret) { if ($fnret->value !~ /^\d+$/) { main_exit(OVH::Bastion::EXIT_TTL_EXPIRED, "ttl_expired", "Your TTL has an invalid value, access denied. Check with an administrator."); } my $ttl = $fnret->value; $fnret = OVH::Bastion::account_config(account => $self, key => "creation_timestamp"); if ($fnret->value !~ /^\d+$/) { main_exit(OVH::Bastion::EXIT_TTL_EXPIRED, "ttl_expired", "Your account creation date has an invalid value, and you have a TTL set, access denied. Check with an administrator."); } my $created = $fnret->value; if ($created + $ttl < time()) { main_exit(OVH::Bastion::EXIT_TTL_EXPIRED, "ttl_expired", "Sorry $self, your account has expired."); } } # # Second check : has account logged-in recently enough to be allowed ? # $fnret = OVH::Bastion::is_account_nonexpired(sysaccount => $sysself, remoteaccount => $remoteself); if ($fnret->is_err) { # internal error, warn and pass osh_warn($fnret); } elsif ($fnret->is_ko) { # expired main_exit OVH::Bastion::EXIT_ACCOUNT_EXPIRED, 'account_expired', $fnret->msg; } my $lastlog_filepath = $fnret->value->{'filepath'}; my $lastlogmsg = sprintf("Welcome to $bastionName, $self, this is your first connection"); if ($fnret && $fnret->value && $fnret->value->{'seconds'}) { my $lastloginfo = $fnret->value->{'info'} ? " from " . $fnret->value->{'info'} : ""; $fnret = OVH::Bastion::duration2human(seconds => $fnret->value->{'seconds'}, tense => "past"); $lastlogmsg = sprintf("Welcome to $bastionName, $self, your last login was %s ago (%s)%s", $fnret->value->{'duration'}, $fnret->value->{'date'}, $lastloginfo); } # ok not expired, so we update lastlog if ($lastlog_filepath && open(my $lastlogfh, '>', $lastlog_filepath)) { print $lastlogfh sprintf("%s(%s)", $ipfrom, $hostfrom); close($lastlogfh); } else { osh_warn "Couldn't update your lastlog ($lastlog_filepath: $!), contact a bastion admin"; } # # Fetch command options # my @saved_argv = @ARGV; # these options are the ones on shell definition of user calling osh.pl, # the user-passed commands are stringified after "-c" (as in sh -c) # it's possible to define the shell as osh.pl --debug, to force debug my $realOptions; my $opt_debug; my $result = GetOptions( "c=s" => \$realOptions, # user command under -c '...' "debug" => \$opt_debug, ); if (not $result) { help(); main_exit OVH::Bastion::EXIT_UNKNOWN_COMMAND, "unknown_command", "Bad command"; } $osh_debug = 1 if $opt_debug; # osh_debug was already 1 if specified in config file # per-user debug ? $fnret = OVH::Bastion::account_config(account => $self, key => "debug"); if ($fnret and $fnret->value() =~ /yes/) { $osh_debug = 1; } $ENV{'OSH_DEBUG'} = 1 if $osh_debug; osh_debug("self=$self home=$home realm=$realm remoteself=$remoteself sysself=$sysself"); osh_debug("user-passed options : $realOptions"); # # Command params # my $port = 22; # can be override by special port my @toExecute; # special case: mosh, in that case we have something like this in $realOptions # mosh-server 'new' '-s' '-c' '256' '-l' 'LANG=en_US.UTF-8' '-l' 'LANGUAGE=en_US' '--' '--osh' 'info' if (defined $realOptions && $realOptions =~ /^mosh-server (.+?) '--' (.*)/) { osh_debug("MOSH DETECTED (with params)"); # remove mosh stuff and save it for later my $mosh = $1; $realOptions = $2; $ENV{'MOSH_SERVER_NETWORK_TMOUT'} = OVH::Bastion::config('moshTimeoutNetwork')->value(); $ENV{'MOSH_SERVER_SIGNAL_TMOUT'} = OVH::Bastion::config('moshTimeoutSignal')->value(); # get @toExecute params from the stuff we got from mosh-client (stored in $mosh) ? # or maybe not... I don't trust users, and we need to override some things anyway (such as ports) @toExecute = qw{ mosh-server new -s -l LANG=en_US.UTF-8 -l LANGUAGE=en_US }; # add what has been specified in the config my @moshCommandLine = split(/\s+/, OVH::Bastion::config('moshCommandLine')->value()); push @toExecute, @moshCommandLine if @moshCommandLine; # okay, just extract the -c 256 / -c 8 from the command because it depends on the user terminal spec my $colors = 8; # by default if ($mosh =~ m/'-c' '(\d+)'/) { $colors = $1; } push @toExecute, ('-c', $colors, '--'); # mosh has the bad habit of surrounding every param with simple quotes ('), and escaping ' by '\'', # because it thinks we are a POSIX shell, but we're not. So get around that osh_debug("mosh params: $2"); # now unescape mosh params... yay regexes! $realOptions =~ s/(?"); if (not $config->{'moshAllowed'}) { main_exit OVH::Bastion::EXIT_MOSH_DISABLED, "mosh_disabled", "Mosh support has been disabled on this bastion"; } } elsif (defined $realOptions && $realOptions =~ /^mosh-server /) { osh_debug("MOSH DETECTED (without any param)"); # we won't really use mosh, as we'll exit later with the bastion help anyway $realOptions = ''; } # If there is a '--' in command line, protect all the end of the command line # in order to let it in one block after command line parsing my $beforeOptions; my $afterOptions; if (defined $realOptions && $realOptions =~ /^(.*?) -- (.*)$/) { $beforeOptions = $1; $afterOptions = $2; osh_debug("before <$beforeOptions> after <$afterOptions>"); if (($config->{'remoteCommandEscapeByDefault'} and not $beforeOptions =~ /(^| )--never-escape( |$)/) or $beforeOptions =~ /(^| )--always-escape( |$)/) { # ugly / legacy mode: escape ' with \' $afterOptions =~ s/'/\\'/g; osh_debug("afterOptions after legacy voodoo is <$afterOptions>"); } else { osh_debug("afterOptions without legacy voodoo is <$afterOptions>"); } } else { # we have no -- delimiter, either there was no remote command (that's fine), # or it's indistinguishable from the bastion options, in that case GetOptionsFromString # will leave what it doesn't recognize, will also fuck up "" and '', but users are warned # to always use -- anyway, and we'll use that as a remote command $beforeOptions = $realOptions; $afterOptions = undef; # will contain the GetOptionsFromString leftovers } my $remainingOptions; ($result, $remainingOptions) = GetOptionsFromString( $beforeOptions, "port|p=i" => \my $optPort, "verbose+" => \my $verbose, "tty|t" => \my $tty, "no-tty|T" => \my $notty, "user|u=s" => \my $user, "osh=s" => \my $osh_command, "telnet|e" => \my $telnet, "password=s" => \my $passwordFile, "self-password|P" => \my $selfPassword, "host|h=s" => \my $host, "help" => \my $help, "long-help" => \my $longHelp, "quiet|q" => \my $quiet, "timeout=i" => \my $timeout, "bind=s" => \my $bind, "debug" => \my $debug, "json" => \my $json, "json-greppable" => \my $json_greppable, "json-pretty" => \my $json_pretty, "always-escape" => \my $_dummy1, # not used as corresponding option has already been ninja-used above "never-escape" => \my $_dummy2, # not used as corresponding option has already been ninja-used above "interactive|i" => \my $interactive, "netconf" => \my $netconf, "wait" => \my $wait, "ssh-as=s" => \my $sshAs, "use-key=s" => \my $useKey, "kbd-interactive" => \my $userKbdInteractive, "proactive-mfa" => \my $proactiveMfa, "fallback-password-delay=i" => \my $fallbackPasswordDelay, ); if (not defined $realOptions) { help(); if (OVH::Bastion::config('interactiveModeByDefault')->value) { # nothing specified by the user, let's drop them to the interactive mode osh_warn("No command specified, entering interactive mode by default"); $interactive = 1; } else { main_exit OVH::Bastion::EXIT_UNKNOWN_COMMAND, "unknown_command", "Missing command"; } } if (!$quiet && $realm && !$ENV{'OSH_IN_INTERACTIVE_SESSION'}) { my $welcome = "You are now connected to " . colored($bastionName, "yellow") . ". Welcome, " . colored($remoteself, "yellow") . ", citizen of the " . colored($realm, "yellow") . " realm!"; print colored("-" x (length($welcome) - 3 * 9) . "\n", "bold yellow"); print $welcome. "\n"; print colored("-" x (length($welcome) - 3 * 9) . "\n", "bold yellow"); print "\n"; } osh_debug("remainingOptions <" . join('/', @$remainingOptions) . ">"); if (defined $afterOptions and @$remainingOptions > 1) { # user specified -- but there are more than 1 unrecognized param (the 1 should be the user@host) # so we warn that we didn't understood osh_warn "WARN : I couldn't parse some of your options before the '--' delimiter, things are probably about to go very wrong\n"; } if (not defined $afterOptions and @$remainingOptions > 1 and not $osh_command) { osh_warn "WARN : You did not use the '--' delimiter to pass your remote command, maybe something crazy will happen !\n"; } if ($afterOptions) { push @$remainingOptions, split(/ /, $afterOptions); osh_debug("remainingOptionsAfterAdd <" . join('/', @$remainingOptions) . ">"); } if ($json_pretty) { $ENV{'PLUGIN_JSON'} = 'PRETTY'; } elsif ($json_greppable) { $ENV{'PLUGIN_JSON'} = 'GREP'; } elsif ($json) { $ENV{'PLUGIN_JSON'} = 'DEFAULT'; } if ($quiet || $json || $json_pretty || $json_greppable) { # remove colors $ENV{'ANSI_COLORS_DISABLED'} = 1; # cf Term::ANSIColor; } if (!$result) { help(); main_exit OVH::Bastion::EXIT_GETOPTS_FAILED, 'getopts_failed', "Error parsing command line options"; } if ($help and not $osh_command) { help(); main_exit OVH::Bastion::EXIT_OK, 'help', ''; } if ($longHelp) { long_help(); main_exit OVH::Bastion::EXIT_OK, 'long_help', ''; } if ($bind) { $fnret = OVH::Bastion::get_bastion_ips(); if ($fnret) { if (not grep { $bind eq $_ } @{$fnret->value}) { main_exit OVH::Bastion::EXIT_CONFLICTING_OPTIONS, "invalid_bind", "Invalid binding IP specified ($bind)"; } } } # if proactive MFA has been requested, do it here, before the code diverts to either # handling interactive session, plugins/osh commands, or a connection request if ($proactiveMfa) { print "As proactive MFA has been requested, entering MFA phase.\n"; $fnret = OVH::Bastion::do_pamtester(self => $self, sysself => $sysself); $fnret or main_exit(OVH::Bastion::EXIT_MFA_FAILED, 'mfa_failed', $fnret->msg); # if we're still here, it succeeded $ENV{'OSH_PROACTIVE_MFA'} = 1; } if ($interactive and not $ENV{'OSH_IN_INTERACTIVE_SESSION'}) { if (not $config->{'interactiveModeAllowed'}) { main_exit OVH::Bastion::EXIT_INTERACTIVE_DISABLED, "interactive_disabled", "Interactive mode has been disabled on this bastion"; } if ($osh_command) { main_exit OVH::Bastion::EXIT_CONFLICTING_OPTIONS, "conflicting_options", "Incompatible options specified: --interactive and --osh"; } if (@toExecute) { # hmm, we are under mosh, mosh needs something to exec, so let's # re-exec ourselves in interactive mode exec(@toExecute, $0, '-c', $realOptions); } my $logret = OVH::Bastion::log_access_insert( account => $self, cmdtype => 'interactive', allowed => 1, ipfrom => $ipfrom, hostfrom => $hostfrom, portfrom => $portfrom, bastionhost => $bastionhost, bastionip => $bastionip, bastionport => $bastionport, ipto => undef, hostto => undef, portto => undef, user => undef, plugin => undef, params => undef, comment => undef, uniqid => $log_uniq_id ); if ($logret) { # needed for the log_access_update func after we're done with the command $log_insert_id = $logret->value->{'insert_id'}; $log_db_name = $logret->value->{'db_name'}; } else { osh_warn($logret->msg); } OVH::Bastion::interactive(realOptions => $realOptions, timeoutHandler => \&exit_sig, self => $self); # this functions may never return, especially in case of idle timeout exit if (defined $log_insert_id and defined $log_db_name) { $logret = OVH::Bastion::log_access_update( account => $self, insert_id => $log_insert_id, db_name => $log_db_name, uniq_id => $log_uniq_id, returnvalue => undef, plugin_stdout => undef, plugin_stderr => undef ); $logret or osh_warn($logret->msg); } main_exit OVH::Bastion::EXIT_OK, 'interactive', ''; } # If it's an osh command # we'll pass the remaining options to the plugin my $remainingOptionsCounter = scalar(@$remainingOptions); my $command; if ($osh_command) { ($help) and $ENV{'PLUGIN_HELP'} = 1; ($quiet) and $ENV{'PLUGIN_QUIET'} = 1; ($osh_debug) and $ENV{'PLUGIN_DEBUG'} = 1; ($debug) and $ENV{'PLUGIN_DEBUG'} = 1; osh_debug('Going got pass the following supplement args to plugin: ' . join('^', @$remainingOptions)); } else { # it's ssh or telnet => it may remain at least 'host' or 'user@host' osh_debug("Remaining options " . join('/', @$remainingOptions)); if ($remainingOptionsCounter == 0) { if (!$host) { help(); main_exit OVH::Bastion::EXIT_NO_HOST, 'no_host', "No osh command specified and no host to connect to"; } else { ; # we have an host with option -h } } else { $host = shift(@{$remainingOptions}); if ($host eq '-osh' || $host eq '--osh') { # special case when using -osh without argument $osh_command = 'help'; $host = ''; } else { $remainingOptionsCounter--; osh_debug("host = $host"); if ($host =~ /^([\S\d\w\.\-_]+)\@([\S\d\w\.\-_]+)$/) { $user = $1; $host = $2; } osh_debug("user $user host $host"); } } if ($remainingOptionsCounter > 0) { $command .= join(' ', @$remainingOptions); osh_debug("Going to add extra command $command"); } } if ($user && !OVH::Bastion::is_valid_remote_user(user => $user)) { main_exit OVH::Bastion::EXIT_INVALID_REMOTE_USER, 'invalid_remote_user', "Remote user name '$user' seems invalid"; } if ($host && $host !~ m{^[a-zA-Z0-9._/:-]+$}) { # can be an IP (v4 or v6), hostname, or prefix (with a /) main_exit OVH::Bastion::EXIT_INVALID_REMOTE_HOST, 'invalid_remote_host', "Remote host name '$host' seems invalid"; } # Get real ip from host $fnret = R('ERR_INTERNAL', silent => 1); my $ip = undef; # if: avoid loading Net::IP and BigInt if there's no host specified if ($host) { # probably this "host" is in fact an option, but we didn't parse it because it's an unknown one, # so we call the long_help() for the user, before exiting if ($host =~ m{^--}) { long_help(); main_exit OVH::Bastion::EXIT_GETOPTS_FAILED, 'getopts_failed', "Couldn't parse option '$host'"; } # otherwise, resolve the host $fnret = OVH::Bastion::get_ip(host => $host); } if (!$fnret) { # exit error when not osh ... if (!$osh_command) { main_exit OVH::Bastion::EXIT_HOST_NOT_FOUND, 'host_not_found', "Unable to resolve host '$host' ($fnret)"; } elsif ($host && $host !~ m{^[0-9.:]+/\d+$}) # in some osh plugins, ip/mask is accepted, don't yell. { osh_warn("I was unable to resolve host '$host'. Something shitty might happen."); } } else { $ip = $fnret->value->{'ip'}; } osh_debug("will work on IP $ip"); # Check if we got a telnet or ssh password user my $userPasswordClue; my $userPasswordContext; if (defined $user and $user =~ /^(telnet|ssh)-passw(or)?d-([^-]+)(-([^-]+))?$/) { my $method = $1; # update user $user = $3; if ($4) { $userPasswordClue = $5; } else { $userPasswordClue = $user; } if ($method eq 'telnet') { # as if user specified -e aka --telnet $telnet = 1; } $userPasswordContext = 'group'; } elsif ($passwordFile) { $userPasswordClue = $passwordFile; $userPasswordContext = 'group'; } elsif ($selfPassword) { $userPasswordClue = $self; $userPasswordContext = 'self'; } osh_debug("Will use password file $userPasswordClue with user $user under context $userPasswordContext") if $userPasswordClue; if ($optPort) { $port = $optPort; } elsif ($telnet) { $port = 23; } else { $port = 22; } if ($telnet && !$config->{'telnetAllowed'}) { main_exit OVH::Bastion::EXIT_ACCESS_DENIED, 'telnet_denied', "Sorry, the telnet protocol has been disabled by policy"; } if ($userKbdInteractive && !$config->{'keyboardInteractiveAllowed'}) { main_exit OVH::Bastion::EXIT_CONFLICTING_OPTIONS, 'kbd_interactive_denied', "Sorry, the keyboard-interactive egress authentication scheme has been disabled by policy"; } $ENV{'OSH_KBD_INTERACTIVE'} = 1 if $userKbdInteractive; # useful for plugins that need to call ssh by themselves (for example to test a connection, i.e. groupAddServer) # MFA enforcing for ingress connection, either on global bastion config, or on specific account config my $mfaPolicy = OVH::Bastion::config('accountMFAPolicy')->value; my $isMfaPasswordConfigured = OVH::Bastion::is_user_in_group(account => $sysself, group => OVH::Bastion::MFA_PASSWORD_CONFIGURED_GROUP); my $isMfaTOTPConfigured = OVH::Bastion::is_user_in_group(account => $sysself, group => OVH::Bastion::MFA_TOTP_CONFIGURED_GROUP); my $isMfaPasswordRequired = OVH::Bastion::is_user_in_group(account => $sysself, group => OVH::Bastion::MFA_PASSWORD_REQUIRED_GROUP); my $hasMfaPasswordBypass = OVH::Bastion::is_user_in_group(account => $sysself, group => OVH::Bastion::MFA_PASSWORD_BYPASS_GROUP); my $isMfaTOTPRequired = OVH::Bastion::is_user_in_group(account => $sysself, group => OVH::Bastion::MFA_TOTP_REQUIRED_GROUP); my $hasMfaTOTPBypass = OVH::Bastion::is_user_in_group(account => $sysself, group => OVH::Bastion::MFA_TOTP_BYPASS_GROUP); # MFA information from a potential ingress realm: my $remoteMfaValidated = 0; my $remoteMfaPassword = 0; my $remoteMfaTOTP = 0; my $remoteHasPIV = 0; my $pivEffectivePolicyEnabled = OVH::Bastion::is_effective_piv_account_policy_enabled(account => $self); # if we're coming from a realm, we're receiving a connection from another bastion, keep all the traces: my @previous_bastion_details; if ($realm && $ENV{'LC_BASTION_DETAILS'}) { my $decoded_details; eval { $decoded_details = decode_json($ENV{'LC_BASTION_DETAILS'}); }; if (!$@) { @previous_bastion_details = @$decoded_details; # if the remote bastion did validate MFA, trust it $remoteMfaValidated = $decoded_details->[0]{'mfa'}{'validated'} ? 1 : 0; $remoteMfaPassword = $decoded_details->[0]{'mfa'}{'type'}{'password'} ? 1 : 0; $remoteMfaTOTP = $decoded_details->[0]{'mfa'}{'type'}{'totp'} ? 1 : 0; # also get the PIV status if (ref $decoded_details->[0]{'piv'} eq 'HASH') { $remoteHasPIV = $decoded_details->[0]{'piv'}{'enforced'} ? 1 : 0; # if remote PIV is not enforced AND we enforce PIV locally (either by global policy or account-scoped policy), # we must refuse the connection. if ($pivEffectivePolicyEnabled && !$remoteHasPIV) { my $otherSideName = $decoded_details->[0]{'via'}{'name'} || $decoded_details->[0]{'via'}{'host'}; main_exit(OVH::Bastion::EXIT_PIV_REQUIRED, 'piv_required', "Sorry $self, but the $bastionName bastion policy requires that you use a PIV key to connect, please set a PIV key up on your local bastion ($otherSideName)."); } } } } if ($mfaPolicy ne 'disabled' && !grep { $osh_command eq $_ } qw{ selfMFASetupPassword selfMFASetupTOTP help info }) { if (($mfaPolicy eq 'password-required' && !$hasMfaPasswordBypass) || $isMfaPasswordRequired) { main_exit(OVH::Bastion::EXIT_MFA_PASSWORD_SETUP_REQUIRED, 'mfa_password_setup_required', "Sorry, but you need to setup the Multi-Factor Authentication before using this bastion, please use the `--osh selfMFASetupPassword' option to do so") if (!$isMfaPasswordConfigured && !$remoteMfaPassword); } if (($mfaPolicy eq 'totp-required' && !$hasMfaTOTPBypass) || $isMfaTOTPRequired) { main_exit(OVH::Bastion::EXIT_MFA_TOTP_SETUP_REQUIRED, 'mfa_totp_setup_required', "Sorry, but you need to setup the Multi-Factor Authentication before using this bastion, please use the `--osh selfMFASetupTOTP' option to do so") if !($isMfaTOTPConfigured && !$remoteMfaTOTP); } if ($mfaPolicy eq 'any-required' && (!$isMfaPasswordConfigured && !$hasMfaPasswordBypass) && (!$isMfaTOTPConfigured && !$hasMfaTOTPBypass) && !$remoteMfaValidated) { main_exit(OVH::Bastion::EXIT_MFA_ANY_SETUP_REQUIRED, 'mfa_any_setup_required', "Sorry, but you need to setup the Multi-Factor Authentication before using this bastion, please use either the `--osh selfMFASetupPassword' or the `--osh selfMFASetupTOTP' option, at your discretion, to do so" ); } } # /MFA enforcing osh_debug("self : " . (defined $self ? $self : '') . "\n" . "user : " . (defined $user ? $user : '') . "\n" . "host : " . (defined $host ? $host : '') . "\n" . "port : " . (defined $port ? $port : '') . "\n" . "verbose : " . (defined $verbose ? $verbose : '') . "\n" . "tty : " . (defined $tty ? $tty : '') . "\n" . "osh : " . (defined $osh_command ? $osh_command : '') . "\n" . "command : " . (defined $command ? $command : '') . "\n"); my $hostto = OVH::Bastion::ip2host($host)->value || $host; # Special case: adminSudo for ssh connection as another user if ($sshAs) { $fnret = OVH::Bastion::is_admin(account => $self); my $logret = OVH::Bastion::log_access_insert( account => $self, cmdtype => 'sshas', allowed => $fnret ? 1 : 0, ipfrom => $ipfrom, hostfrom => $hostfrom, portfrom => $portfrom, bastionhost => $bastionhost, bastionip => $bastionip, bastionport => $bastionport, ipto => $ip, hostto => $hostto, portto => $optPort, user => $user, plugin => undef, params => join(' ', @$remainingOptions), comment => undef, uniqid => $log_uniq_id ); if (!$fnret) { main_exit OVH::Bastion::EXIT_RESTRICTED_COMMAND, "sshas_denied", "Sorry, this feature is reserved to bastion administrators. Your attempt has been logged."; } if ($osh_command) { main_exit OVH::Bastion::EXIT_CONFLICTING_OPTIONS, "conflicting_options", "Can't use --ssh-as and --osh together. If you want to run a plugin as another user, use --osh adminSudo"; } $fnret = OVH::Bastion::is_bastion_account_valid_and_existing(account => $sshAs); $fnret or main_exit OVH::Bastion::EXIT_ACCESS_DENIED, 'invalid_account', "Sorry, the specified account is invalid"; my @cmd = qw( sudo -n -u ); push @cmd, $sshAs; push @cmd, qw( -- /usr/bin/env perl ); push @cmd, $OVH::Bastion::BASEPATH . '/bin/shell/osh.pl'; push @cmd, '-c'; my @forwardOptions; push @forwardOptions, "--user", $user if $user; push @forwardOptions, "--host", $host if $host; push @forwardOptions, "--port", $port if $port; push @forwardOptions, @$remainingOptions if ($remainingOptions and @$remainingOptions); if (not @forwardOptions) { main_exit OVH::Bastion::EXIT_NO_HOST, 'no_host', "No osh command specified and no host to connect to"; } push @cmd, join(" ", @forwardOptions); OVH::Bastion::syslogFormatted( criticity => 'info', type => 'security', fields => [['type', 'admin-ssh-as'], ['account' => $self], ['sudo-as', $sshAs], ['plugin', 'ssh'], ['params', join(" ", @forwardOptions)]] ); osh_warn("ADMIN SUDO: $self, you'll now impersonate $sshAs, this has been logged."); exec(@cmd) or main_exit(OVH::Bastion::EXIT_EXEC_FAILED, "ssh_as_failed", "Couldn't start a session under the account $sshAs ($!)"); } # This will be filled with details we might want to pass on to the remote machine as a json-encoded envvar my %bastion_details = ( piv => { enforced => $pivEffectivePolicyEnabled ? \1 : \0, reason => $pivEffectivePolicyEnabled->msg, }, ); # # First case. We have an OSH command # if ($osh_command) { # For backward compatibility, accept old names of plugins my %legacy2new = qw( accountAddFullGroupAccess groupAddMember accountDelFullGroupAccess groupDelMember accountAddPartialGroupAccess groupAddGuestAccess accountDelPartialGroupAccess groupDelGuestAccess accountListPartialGroupAccess groupListGuestAccesses selfListKeys selfListIngressKeys selfAddKey selfAddIngressKey selfDelKey selfDelIngressKey selfListBastionKeys selfListEgressKeys selfGenerateBastionKey selfGenerateEgressKey selfAddPrivateAccess selfAddPersonalAccess selfDelPrivateAccess selfDelPersonalAccess accountAddPrivateAccess accountAddPersonalAccess accountDelPrivateAccess accountDelPersonalAccess accountListBastionKeys accountListEgressKeys accountListKeys accountListIngressKeys accountResetKeys accountResetIngressKeys helloWorld info groupGenerateEgressPassword groupGeneratePassword groupListEgressPasswords groupListPasswords selfListEgressPasswords selfListPasswords ); $osh_command = $legacy2new{$osh_command} if $legacy2new{$osh_command}; # Then test for rights $fnret = OVH::Bastion::can_account_execute_plugin(account => $self, plugin => $osh_command); my $logret = OVH::Bastion::log_access_insert( account => $self, cmdtype => 'osh', allowed => ($fnret ? 1 : 0), ipfrom => $ipfrom, hostfrom => $hostfrom, portfrom => $portfrom, bastionhost => $bastionhost, bastionip => $bastionip, bastionport => $bastionport, ipto => $ip, hostto => $hostto, portto => $optPort, user => $user, plugin => $osh_command, params => join(' ', @$remainingOptions), comment => 'plugin-' . ($fnret->value ? $fnret->value->{'type'} : 'UNDEF'), uniqid => $log_uniq_id ); if ($logret) { # needed for the log_access_update func after we're done with the command $log_insert_id = $logret->value->{'insert_id'}; $log_db_name = $logret->value->{'db_name'}; } else { warn_syslog("Failed to insert access log: " . $logret->msg); if ($ip eq '127.0.0.1') { osh_warn("Would deny access on out of space condition but you're root\@127.0.0.1, I hope you're here to fix me!"); } else { main_exit OVH::Bastion::EXIT_OUT_OF_SPACE, 'out_of_space', "Bastion is out of space, admin intervention is needed! (" . $logret->msg . ")"; } } if ($fnret) { my @cmd = ($fnret->value->{'fullpath'}, $user, $ip, $host, $optPort, @$remainingOptions); # is plugin explicitly disabled? my $isDisabled = OVH::Bastion::plugin_config(plugin => $osh_command, key => "disabled"); # plugin is enabled by default if not explicitly disabled if ($isDisabled and $isDisabled->value()) { main_exit OVH::Bastion::EXIT_RESTRICTED_COMMAND, "plugin_disabled", "Sorry, this plugin has been disabled by policy."; } if ($isDisabled->is_err && $isDisabled->err ne 'KO_NO_SUCH_FILE') { warn_syslog("Failed to tell whether the '$osh_command' plugin is enabled or not (" . $isDisabled->msg . ")"); main_exit OVH::Bastion::EXIT_RESTRICTED_COMMAND, "plugin_disabled", "Sorry, a configuration error prevents us to check whether this plugin is enabled, warn your sysadmin!"; } # check if we need JIT MFA to call this plugin, this can be configured per-plugin # TODO: autodetect if the MFA check is done outside of the code by sshd+PAM, to avoid re-asking for it here my $MFArequiredForPlugin = OVH::Bastion::plugin_config(plugin => $osh_command, key => "mfa_required")->value; $MFArequiredForPlugin ||= 'none'; # no config means none # some plugins need an explicit MFA check before being called (mainly plugins manipulating authentication factors) # if the user wants to reset one of its MFA tokens, force require MFA if ((grep { $osh_command eq $_ } qw{ selfMFAResetPassword selfMFAResetTOTP }) && ($MFArequiredForPlugin eq 'none')) { # enforce MFA in those cases, even if it's not configured $MFArequiredForPlugin = 'any'; } # if the user wants to setup TOTP, if it happens to be already set (or any other factor), require it too # note: this is not needed for selfMFASetupPassword, because `passwd` does the job of asking the previous password elsif ($osh_command eq 'selfMFASetupTOTP' && ($isMfaTOTPConfigured || $isMfaPasswordConfigured) && ($MFArequiredForPlugin eq 'none')) { $MFArequiredForPlugin = 'any'; } if (!grep { $MFArequiredForPlugin eq $_ } qw{ password totp any none }) { main_exit(OVH::Bastion::EXIT_MFA_FAILED, 'mfa_plugin_configuration_failed', "MFA configuration is incorrect for this plugin, report to your sysadmin!"); } my $skipMFA = 0; if ($MFArequiredForPlugin eq 'password' && !$isMfaPasswordConfigured) { if ($hasMfaPasswordBypass) { $skipMFA = 1; } else { main_exit(OVH::Bastion::EXIT_MFA_PASSWORD_SETUP_REQUIRED, 'mfa_password_setup_required', "Sorry, but you need to setup the Multi-Factor Authentication before using this command,\n" . "please use the `--osh selfMFASetupPassword' option to do so"); } } elsif ($MFArequiredForPlugin eq 'totp' && !$isMfaTOTPConfigured) { if ($hasMfaTOTPBypass) { $skipMFA = 1; } else { main_exit(OVH::Bastion::EXIT_MFA_TOTP_SETUP_REQUIRED, 'mfa_totp_setup_required', "Sorry, but you need to setup the Multi-Factor Authentication before using this command,\n" . "please use the `--osh selfMFASetupTOTP' option to do so"); } } elsif ($MFArequiredForPlugin eq 'any' && !$isMfaTOTPConfigured && !$isMfaPasswordConfigured) { if ($hasMfaPasswordBypass && $hasMfaTOTPBypass) { $skipMFA = 1; } else { main_exit(OVH::Bastion::EXIT_MFA_ANY_SETUP_REQUIRED, 'mfa_any_setup_required', "Sorry, but you need to setup the Multi-Factor Authentication before using this command,\n" . "please use either the `--osh selfMFASetupPassword' or the `--osh selfMFASetupTOTP' option, at your discretion, to do so"); } } # and start the MFA phase if needed if ($MFArequiredForPlugin ne 'none' && !$skipMFA) { print "As this is required to run this plugin, entering MFA phase.\n"; if ($ENV{'OSH_PROACTIVE_MFA'}) { print "... you already validated MFA proactively.\n"; } else { $fnret = OVH::Bastion::do_pamtester(self => $self, sysself => $sysself); $fnret or main_exit(OVH::Bastion::EXIT_MFA_FAILED, 'mfa_failed', $fnret->msg); } # so that the remote server, which can be a bastion in case we're chaining, can enforce its own policy: $bastion_details{'mfa'} = { validated => \1, reason => 'mfa_required_for_plugin', type => { password => $isMfaPasswordConfigured ? \1 : \0, totp => $isMfaTOTPConfigured ? \1 : \0, } }; } OVH::Bastion::set_terminal_mode_for_plugin(plugin => $osh_command, action => 'set'); # get the execution mode required by the plugin my $is_binary; my $system; $fnret = OVH::Bastion::plugin_config(plugin => $osh_command, key => "execution_mode_on_$^O"); if (!$fnret || !$fnret->value) { $fnret = OVH::Bastion::plugin_config(plugin => $osh_command, key => "execution_mode"); } if ($fnret && $fnret->value) { $system = 1 if $fnret->value eq 'system'; $is_binary = 1 if $fnret->value eq 'binary'; } $ENV{'OSH_IP_FROM'} = $ipfrom; # used in some plugins for is_access_granted() $fnret = OVH::Bastion::execute( cmd => \@cmd, noisy_stdout => 1, noisy_stderr => 1, expects_stdin => 1, system => $system, is_binary => $is_binary, ); OVH::Bastion::set_terminal_mode_for_plugin(plugin => $osh_command, action => 'restore'); if (defined $log_insert_id and defined $log_db_name) { $logret = OVH::Bastion::log_access_update( account => $self, insert_id => $log_insert_id, db_name => $log_db_name, uniq_id => $log_uniq_id, returnvalue => $fnret->value ? $fnret->value->{'sysret_raw'} : undef, plugin_stdout => $fnret->value ? $fnret->value->{'stdout'} : undef, plugin_stderr => $fnret->value ? $fnret->value->{'stderr'} : undef ); $logret or osh_warn($logret->msg); } exit($fnret->value ? $fnret->value->{'status'} : OVH::Bastion::EXIT_EXEC_FAILED); } else { if ($fnret->err eq 'KO_UNKNOWN_PLUGIN') { help(); main_exit OVH::Bastion::EXIT_UNKNOWN_COMMAND, "unknown_command", $fnret->msg; } main_exit OVH::Bastion::EXIT_RESTRICTED_COMMAND, "restricted_command", $fnret->msg; } } # # Else, it's a ttyrec ssh or telnet connection # if (!$quiet) { if ($config->{'displayLastLogin'}) { osh_info($lastlogmsg); print "\n"; } osh_warn($msg_to_print_delayed) if defined $msg_to_print_delayed; # set if we had an error to print previously } # if no user yet, fix it to remote user # do that here, cause sometimes we do not want to pass user to osh $user = $user || $config->{'defaultLogin'} || $remoteself || $sysself; # log request osh_debug("final request : " . "$user\@$ip -p $port -- $command'\n"); my $displayLine = "$hostfrom:$portfrom => $self\@$bastionhost:$bastionport => $user\@$hostto:$port"; if (!$quiet) { print "$displayLine ...\n"; } # before doing stuff, check if we have the right to connect somewhere (some users are locked only to osh commands) $fnret = OVH::Bastion::account_config(account => $self, key => OVH::Bastion::OPT_ACCOUNT_OSH_ONLY); if ($fnret and $fnret->value() =~ /yes/) { $fnret = R('KO_ACCESS_DENIED', msg => "You don't have the right to connect anywhere"); } else { $fnret = OVH::Bastion::is_access_granted(account => $self, user => $user, ipfrom => $ipfrom, ip => $ip, port => $port, wantKeys => 1); } # so in the end, can we access the requested user@host machine ? my $JITMFARequired; if (!$fnret) { # User is not allowed, exit my $message = $fnret->msg; if ($user eq $self) { $message .= " (tried with remote user '$user')"; # "root is not the default login anymore" } my $logret = OVH::Bastion::log_access_insert( account => $self, cmdtype => $telnet ? 'telnet' : 'ssh', allowed => 0, ipfrom => $ipfrom, hostfrom => $hostfrom, portfrom => $portfrom, bastionhost => $bastionhost, bastionip => $bastionip, bastionport => $bastionport, ipto => $ip, hostto => $hostto, portto => $port, user => $user, params => $command, uniqid => $log_uniq_id ); if (!$logret) { osh_warn($logret); } main_exit OVH::Bastion::EXIT_ACCESS_DENIED, 'access_denied', $message; } # else, keep calm and carry on # build ttyrec command that'll prefix the real command my $ttyrec_fnret = OVH::Bastion::build_ttyrec_cmdline( ip => $ip, port => $port, user => $user, account => $self, uniqid => $log_uniq_id, home => $home, realm => $realm, remoteaccount => $remoteself, debug => $osh_debug, tty => $tty, notty => $notty ); main_exit(OVH::Bastion::EXIT_TTYREC_CMDLINE_FAILED, "ttyrec_failed", $ttyrec_fnret->msg) if !$ttyrec_fnret; my @ttyrec = @{$ttyrec_fnret->value->{'cmd'}}; my $saveFile = $ttyrec_fnret->value->{'saveFile'}; print " allowed ... log on($saveFile)\n\n" if !$quiet; # now build the real command my @command; # if we are doing a password login, find the password(s) # for autologin, "-1" means "try the main password, then try the fallbacks", 0 means "try only the main password", and N means "try only the Nth fallback password" my $forcePasswordId = -1; if ($userPasswordClue) { # locate main password file my $fnretpass = OVH::Bastion::get_passfile(hint => $userPasswordClue, context => $userPasswordContext, self => ($remoteself || $sysself), tryLegacy => 1); if (!$fnretpass) { main_exit OVH::Bastion::EXIT_PASSFILE_NOT_FOUND, "passfile-not-found", $fnretpass->msg; } $passwordFile = $fnretpass->value; # check if a specific password is forced foreach my $grant (@{$fnret->value}) { # only keep the grant matching the password clue and context AND with a forced password if ( $grant->{'forcePassword'} && ( ($userPasswordContext eq 'self' && $grant->{'type'} eq 'personal') || ($userPasswordContext eq 'group' && $grant->{'type'} =~ /^group-(member|guest)$/ && $grant->{'group'} eq $userPasswordClue)) ) { # FIXME: force-password and force-key don't work yet for guest accesses, see #256 # fetch the hashes of the main password and all its fallbacks my $fnrethashes; if ($userPasswordContext eq 'self') { $fnrethashes = OVH::Bastion::get_hashes_list(context => 'account', account => $userPasswordClue); } else { $fnrethashes = OVH::Bastion::get_hashes_list(context => 'group', group => $userPasswordClue); } if (!$fnrethashes) { main_exit(OVH::Bastion::EXIT_GET_HASH_FAILED, "get_hashes_list", $fnrethashes->msg); } # is our forced password's hash one of them ? for my $id (0 .. $#{$fnrethashes->value}) { foreach my $hash (values(%{$fnrethashes->value->[$id]->{'hashes'}})) { if ($grant->{'forcePassword'} eq $hash) { $forcePasswordId = $id; print " forcing password with hash: " . $grant->{'forcePassword'} . "\n\n" unless $quiet; } } } # if the password was not found, abort if ($forcePasswordId == -1) { main_exit(OVH::Bastion::EXIT_PASSFILE_NOT_FOUND, "forced-password-not-found", "The forced password could not be found"); } } } } # if we want telnet (not ssh) if ($telnet) { # TELNET PASSWORD AUTOLOGIN if ($userPasswordClue) { osh_debug("going to use telnet with this password file : $passwordFile"); print " will use TELNET with password autologin\n\n" unless $quiet; push @command, $OVH::Bastion::BASEPATH . '/bin/shell/autologin', 'telnet', $user, $ip, $port, $passwordFile, $forcePasswordId, ($timeout ? $timeout : 45), ($fallbackPasswordDelay // 3); } # TELNET PASSWORD INTERACTIVE else { print " will use TELNET with interactive password login\n\n" unless $quiet; push @command, '/usr/bin/telnet', '-l', $user, $host, $port; } } # if we want ssh (not telnet) else { my @preferredAuths; # SSH PASSWORD AUTOLOGIN if ($userPasswordClue) { push @preferredAuths, 'keyboard-interactive'; push @preferredAuths, 'password'; osh_debug("going to use ssh with this password file : $passwordFile"); print " will use SSH with password autologin\n\n" unless $quiet; push @command, $OVH::Bastion::BASEPATH . '/bin/shell/autologin', 'ssh', $user, $ip, $port, $passwordFile, $forcePasswordId, ($timeout ? $timeout : 45), ($fallbackPasswordDelay // 3); } # SSH EGRESS KEYS (and maybe password interactive as a fallback if passwordAllowed) else { # ssh by key push @preferredAuths, 'publickey'; # also set kbdinteractive if allowed in bastion config (needed for e.g. TOTP) push @preferredAuths, 'keyboard-interactive' if ($config->{'keyboardInteractiveAllowed'} && $userKbdInteractive); # also set password if allowed in bastion config (to allow users to enter a remote password interactively) push @preferredAuths, 'password' if $config->{'passwordAllowed'}; push @command, '/usr/bin/ssh', $ip, '-l', $user, '-p', $port; my @keysToTry; print " will try the following accesses you have: \n" unless $quiet; foreach my $access (@{$fnret->value || []}) { foreach my $key (@{$access->{'sortedKeys'} || []}) { my $keyinfo = $access->{'keys'}{$key}; my $type = $access->{'type'} . " of " . $access->{'group'}; if ($access->{'type'} =~ /^group/) { $type = colored($access->{'type'}, $access->{'type'} eq 'group-member' ? 'green' : 'yellow'); $type .= " of " . colored($access->{'group'}, 'blue bold'); } elsif ($access->{'type'} =~ /^personal/) { $type = colored($access->{'type'}, 'red') . ' access'; } my $generated = strftime("[%Y/%m/%d]", localtime($keyinfo->{'mtime'})); if ((not $useKey) || ($useKey eq $keyinfo->{'fingerprint'})) { my $forced = ' '; if ($useKey) { $forced = colored(' (KEY FORCED ON CMDLINE)', 'bold red'); } elsif ($access->{'forceKey'}) { $forced = colored(' (KEY FORCED IN ACL)', 'bold red'); } if ($access->{'mfaRequired'} && $access->{'mfaRequired'} ne 'none') { $forced .= colored(' (MFA REQUIRED: ' . uc($access->{'mfaRequired'}) . ')', 'bold red'); $JITMFARequired = $access->{'mfaRequired'}; } printf(" - %s with %s-%s key %s %s%s\n", $type, $keyinfo->{'family'}, $keyinfo->{'size'}, $keyinfo->{'fingerprint'}, $generated, $forced) unless $quiet; push @keysToTry, $keyinfo->{'fullpath'} if not(grep { $_ eq $keyinfo->{'fullpath'} } @keysToTry); } } } if ($useKey and not @keysToTry) { print " >>> No key matched the fingerprint you gave me ($useKey), connection will fail!\n"; } print "\n" unless $quiet; foreach (@keysToTry) { if (-r) { osh_debug("Got a group key $_"); push @command, '-i', $_; } else { osh_warn("Weird, key file $_ is not accessible"); } } } if ($verbose) { foreach (1 .. $verbose) { push @command, '-v'; } } push @command, '-q' if $quiet; push @command, '-t' if $tty; push @command, '-T' if $notty; push @command, '-o', "ConnectTimeout=$timeout" if $timeout; if (not $quiet) { $fnret = OVH::Bastion::account_config(account => $self, key => OVH::Bastion::OPT_ACCOUNT_IDLE_IGNORE, public => 1); if ($fnret && $fnret->value =~ /yes/) { osh_debug("Account is immune to idle"); } else { if ($config->{'idleLockTimeout'}) { print(" /!\\ Your session will be locked after " . $config->{'idleLockTimeout'} . " seconds of inactivity, use `--osh unlock' to unlock it\n"); } if ($config->{'idleKillTimeout'}) { print(" /!\\ Your session will be killed after " . $config->{'idleKillTimeout'} . " seconds of inactivity.\n"); } print "\n" if ($config->{'idleLockTimeout'} || $config->{'idleKillTimeout'}); } } push @command, '-o', 'PreferredAuthentications=' . (join(',', @preferredAuths)); if ($config->{'sshClientHasOptionE'}) { push @command, '-E', $saveFile . '.sshdebug'; } if ($config->{'sshClientDebugLevel'}) { foreach (1 .. $config->{'sshClientDebugLevel'}) { push @command, '-v'; } } if ($netconf) { # in netconf mode, we must ask our ssh to request remote netconf subsystem push @command, '-s', 'netconf'; } elsif ($command) { # the '--' is to force ssh (started by ttyrec (started by us)) to stop processing its options and pass the rest to remote shell push @command, '--', $command; } } # add current account name as LC_BASTION to be passed via ssh $ENV{'LC_BASTION'} = $self; $bastion_details{'mfa'}{'validated'} //= \0; $bastion_details{'mfa'}{'type'}{'password'} //= \0; $bastion_details{'mfa'}{'type'}{'totp'} //= \0; $bastion_details{'piv'}{'enforced'} //= \0; $bastion_details{'from'} = {addr => $ipfrom, host => $hostfrom, port => $portfrom + 0}; $bastion_details{'via'} = {addr => $bastionip, host => $bastionhost, port => $bastionport + 0, name => $bastionName}; $bastion_details{'to'} = {addr => $ip, host => $hostto, port => $port + 0, user => $user}; $bastion_details{'account'} = $self; $bastion_details{'uniqid'} = $log_uniq_id; $bastion_details{'version'} = $OVH::Bastion::VERSION; if (!@command) { main_exit OVH::Bastion::EXIT_UNKNOWN_COMMAND, "empty_command", "Found no command to execute!"; } else { # the '--' is to force ttyrec (started by us) to stop processing its options and execute the rest as is push @ttyrec, '--', @command; } # add binding IP if specified # works for ssh *and* telnet if ($bind) { push @command, '-b', $bind; } osh_debug("about to exec: " . join(' ', @ttyrec)); # if --wait is specified, we wait for the host to be alive before connecting if ($wait) { my $startedat = time(); osh_info "Pinging $host, will connect as soon as it's alive..."; while (1) { my @pingcmd = qw{ fping -- }; push @pingcmd, $host; my $fnretexec = OVH::Bastion::execute(cmd => \@pingcmd, noisy_stdout => 1, noisy_stderr => 1); $fnretexec or exit(OVH::Bastion::EXIT_EXEC_FAILED); if ($fnretexec->value->{'sysret'} == 0) { osh_info "Alive after waiting for " . (time() - $startedat) . " seconds, connecting..."; sleep 2 if (time() > $startedat + 1); # so that ssh has the time to startup... hopefully last; } sleep 1; } } my $logret = OVH::Bastion::log_access_insert( account => $self, cmdtype => $telnet ? 'telnet' : 'ssh', allowed => 1, ipfrom => $ipfrom, hostfrom => $hostfrom, portfrom => $portfrom, bastionhost => $bastionhost, bastionip => $bastionip, bastionport => $bastionport, ipto => $ip, hostto => $hostto, portto => $port, user => $user, params => join(' ', @ttyrec), ttyrecfile => $saveFile, uniqid => $log_uniq_id ); if (!$logret) { osh_warn($logret); if ($ip eq '127.0.0.1') { osh_warn("Would deny access on out of space condition but you're root\@127.0.0.1, I hope you're here to fix me!"); } else { main_exit OVH::Bastion::EXIT_OUT_OF_SPACE, 'out_of_space', "Bastion is out of space, admin intervention is needed! (" . $logret->msg . ")"; } $logret->{'value'} = {}; } # if we have JIT MFA, do it now if ($JITMFARequired) { my $skipMFA = 0; my $realmMFA = 0; if ($proactiveMfa) { print "As proactive MFA has been requested, entering MFA phase.\n"; } else { print "As this is required for this host, entering MFA phase.\n"; } if ($JITMFARequired eq 'totp' && !$isMfaTOTPConfigured) { if ($hasMfaTOTPBypass) { $skipMFA = 1; } elsif ($remoteMfaTOTP && $remoteMfaValidated) { $realmMFA = 1; } else { main_exit(OVH::Bastion::EXIT_MFA_TOTP_SETUP_REQUIRED, 'mfa_totp_setup_required', "Sorry, but you need to setup the Multi-Factor Authentication before connecting to this host,\nplease use the `--osh selfMFASetupTOTP' option to do so"); } } elsif ($JITMFARequired eq 'password' && !$isMfaPasswordConfigured) { if ($hasMfaPasswordBypass) { $skipMFA = 1; } elsif ($remoteMfaPassword && $remoteMfaValidated) { $realmMFA = 1; } else { main_exit(OVH::Bastion::EXIT_MFA_PASSWORD_SETUP_REQUIRED, 'mfa_password_setup_required', "Sorry, but you need to setup the Multi-Factor Authentication before connecting to this host,\nplease use the `--osh selfMFASetupPassword' option to do so"); } } elsif ($JITMFARequired eq 'any' && !$isMfaTOTPConfigured && !$isMfaPasswordConfigured) { if ($hasMfaPasswordBypass || $hasMfaTOTPBypass) { # FIXME: should actually be $hasMFABypassAll (not yet implemented) $skipMFA = 1; } elsif ($remoteMfaValidated) { $realmMFA = 1; } else { main_exit(OVH::Bastion::EXIT_MFA_ANY_SETUP_REQUIRED, 'mfa_any_setup_required', "Sorry, but you need to setup the Multi-Factor Authentication before connecting to this host,\nplease use either the `--osh selfMFASetupPassword' or the `--osh selfMFASetupTOTP' option, at your discretion, to do so" ); } } if ($skipMFA) { print "... skipping as your account is exempt from MFA.\n"; } elsif ($realmMFA) { print "... you already validated MFA on the bastion you're coming from.\n"; } elsif ($ENV{'OSH_PROACTIVE_MFA'}) { print "... you already validated MFA proactively.\n"; } else { $fnret = OVH::Bastion::do_pamtester(self => $self, sysself => $sysself); $fnret or main_exit(OVH::Bastion::EXIT_MFA_FAILED, 'mfa_failed', $fnret->msg); # so that the remote server, which can be a bastion in case we're chaining, can enforce its own policy $bastion_details{'mfa'} = { validated => \1, reason => ($proactiveMfa ? 'proactive_mfa' : 'mfa_required_for_host'), type => { password => $isMfaPasswordConfigured ? \1 : \0, totp => $isMfaTOTPConfigured ? \1 : \0, } }; } } # now that we're about to connect, convert the bastion_details to a json envvar: my @details_json = (\%bastion_details); # if we have data from a previous bastion (due to a realm connection), include it on top: push @details_json, @previous_bastion_details if @previous_bastion_details; # then convert to json: $ENV{'LC_BASTION_DETAILS'} = encode_json(\@details_json); # here is a nice hack to drastically improve the memory footprint of an # heavily used bastion. we exec() another script that is way lighter, see # comments in the connect.pl file for more information. if (!$quiet) { print "Connecting...\n"; } push @toExecute, $OVH::Bastion::BASEPATH . '/bin/shell/connect.pl'; exec( @toExecute, $ip, $port, $config->{'sshClientHasOptionE'}, $userPasswordClue, $saveFile, $logret->value->{'insert_id'}, $logret->value->{'db_name'}, $logret->value->{'uniq_id'}, $self, @ttyrec ) or exit(OVH::Bastion::EXIT_EXEC_FAILED); exit OVH::Bastion::EXIT_OK; # # FUNCTIONS follow # # # On SIG, still try to log in db # sub exit_sig { my ($sig) = @_; if (defined $log_insert_id and defined $log_db_name) { OVH::Bastion::log_access_update( account => $self, insert_id => $log_insert_id, db_name => $log_db_name, uniq_id => $log_uniq_id, signal => $sig, ); } exit OVH::Bastion::EXIT_OK; } # # Display help message # sub help { =cut just to debug memory fingerprint use Devel::Size qw[total_size]; # pragma optional module my %siz; foreach (keys %::main::main::) { push @{ $siz{ total_size( $::main::main::{ $_ } ) } }, $_; } foreach (sort { $a <=> $b } keys %siz) { printf "%9d: %s\n", $_, join(' ', @{$siz{$_}}); } exit OVH::Bastion::EXIT_OK; =cut print STDERR <<"EOF" ; The Bastion v$OVH::Bastion::VERSION quick usage examples: Connect to a server: $bastionName admin\@srv1.example.org Run a command on a server: $bastionName admin\@srv1.example.org -- uname -a List the osh commands: $bastionName --osh help Help on a specific osh command: $bastionName --osh OSH_COMMAND --help Enter interactive mode for osh: $bastionName -i Get more complete help: $bastionName --long-help EOF return; } sub long_help { print STDERR <<"EOF" ; Usage (ssh): $bastionName [OPTIONS] [user\@]host [-- REMOTE_COMMAND] Usage (telnet): $bastionName -e [OPTIONS] [user\@]host Usage (osh cmd): $bastionName --osh [OSH_COMMAND] [OSH_OPTIONS] [OPTIONS] --host, -h HOST Host to connect to --user, -u USER Remote host user to connect as --port, -p PORT Port to use --telnet, -e Use telnet instead of ssh --timeout DELAY Specify a timeout for ssh or telnet egress connection --bind IP Force binding of the egress ssh connection to a specified local IP --password GROUP Use a group egress password instead of ssh keys to login (via ssh or telnet) --self-password, -P Use your own personal account egress password instead of ssh keys to login (via ssh or telnet) --osh Use an osh command (see --osh help to get a list) --interactive, -i Enter interactive mode (useful to use multiple osh commands) --quiet, -q Disable most messages and colors, useful for scripts --always-escape Bypass config and force the bugged behavior of old bastions for REMOTE_COMMAND escaping. Don't use. --never-escape Bypass config and force the new behavior of new bastions for REMOTE_COMMAND escaping. Don't use. --wait Ping the host before connecting to it (useful to ssh just after a reboot!) --long-help Print this [REMOTE_COMMAND] You can pass a command to execute on the remote machine. For complex commands, don't forget that your shell will eat one level of quotes and backslashes. One working example: $bastionName srv1.example.org -- "perl -e 'use Data::Dumper; print Dumper(\\\@ARGV)' one 'two is 2' three" [OPTIONS (ssh)] --verbose, -v Enable verbose ssh --tty, -t Force tty allocation --no-tty, -T Prevent tty allocation --use-key FP Explicitly specify the fingerprint of the egress key you want to use --kbd-interactive Enable the keyboard-interactive authentication scheme on egress connection --netconf Request to use netconf subsystem --fallback-password-delay S Amount of seconds to wait between subsequent tries in the SSH password autologin fallback mechanism (3). [OPTIONS (osh cmd)] --json Return data in json format between JSON_START and JSON_END tags --json-pretty Prettify returned json, useful for debug / human reading --json-greppable Return data in json format squashed on one line starting with JSON_DATA= [OSH_COMMAND] These are used to interact with the bastion configuration, accesses, keys, accounts and groups. To get a list, use: $bastionName --osh help [OSH_OPTIONS] Those options are specific for each OSH_COMMAND, to get help on those, use: $bastionName --osh OSH_COMMAND --help EOF if (OVH::Bastion::is_admin(account => $self)) { print STDERR <<"EOF" ; [ADMIN_OPTIONS] --ssh-as ACCOUNT Impersonate another account to ssh connect somewhere on his or her behalf. This is logged. EOF } return; }