3c3b843d72
In order to do this, I had to remove the very old and unmaintainted `otplib` and replace it with the well-maintained [otpauth](https://www.npmjs.com/package/otpauth). I kept the parameters the same, but if there is something only slightly off between the two libraries, this could cause a major headache. I am unsure on how to test this though, or if we can provide some sort of migration for this. The reason for the upgrade is two-fold: 1. As I said, the original library was unmaintained 2. It's verification mechanism relied on a Buffer class that, as far as I can tell, can't work without some `require` statements that are missing from the library's source files. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Eugene <inbox@null.page> |
||
|---|---|---|
| .cargo | ||
| .github | ||
| docker | ||
| docs | ||
| oidc-test | ||
| tests | ||
| warpgate | ||
| warpgate-admin | ||
| warpgate-common | ||
| warpgate-core | ||
| warpgate-database-protocols | ||
| warpgate-db-entities | ||
| warpgate-db-migrations | ||
| warpgate-protocol-http | ||
| warpgate-protocol-mysql | ||
| warpgate-protocol-ssh | ||
| warpgate-sso | ||
| warpgate-web | ||
| .all-contributorsrc | ||
| .bumpversion.cfg | ||
| .dockerignore | ||
| .env | ||
| .flake8 | ||
| .gitignore | ||
| Cargo.lock | ||
| Cargo.toml | ||
| clippy.toml | ||
| Cranky.toml | ||
| Cross.toml | ||
| deny.toml | ||
| justfile | ||
| LICENSE | ||
| README.md | ||
| rust-toolchain | ||
| rustfmt.toml | ||
| sonar-project.properties | ||
Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps.
- Set it up in your DMZ, add user accounts and easily assign them to specific hosts and URLs within the network.
- Warpgate will record every session for you to view (live) and replay later through a built-in admin web UI.
- Not a jump host - forwards your connections straight to the target instead.
- Native 2FA and SSO support (TOTP & OpenID Connect)
- Single binary with no dependencies.
- Written in 100% safe Rust.
Getting started & downloads
- See the Getting started wiki page (or Getting started on Docker).
- Release / beta binaries
- Nightly builds
|
|
Project Status
The project is currently in alpha stage and is gathering community feedback. See the official roadmap for the upcoming features.
In particular, we're working on:
- Requesting admin approvals for sessions
- Support for tunneling PostgreSQL connections,
- and much more.
How it works
Warpgate is a service that you deploy on the bastion/DMZ host, which will accept SSH, HTTPS and MySQL connections and provide an (optional) web admin UI.
Run warpgate setup to interactively generate a config file, including port bindings. See Getting started for details.
It receives connections with specifically formatted credentials, authenticates the user locally, connects to the target itself, and then connects both parties together while (optionally) recording the session.
When connecting through HTTPS, Warpgate presents a selection of available targets, and will then proxy all traffic in a session to the selected target. You can switch between targets at any time.
You manage the target and user lists and assign them to each other through the admin UI, and the session history is stored in an SQLite database (default: in /var/lib/warpgate).
You can also use the admin web interface to view the live session list, review session recordings, logs and more.
Contributing / building from source
- You'll need Rust, NodeJS and Yarn
- Clone the repo
- Just is used to run tasks - install it:
cargo install just - Install the admin UI deps:
just yarn - Build the frontend:
just yarn build - Build Warpgate:
cargo build(optionally--release)
The binary is in target/{debug|release}.
Tech stack
- Rust 🦀
- HTTP:
poem-web - Database: SQLite via
sea-orm+sqlx - SSH:
russh
- HTTP:
- Typescript
- Svelte
- Bootstrap
Backend API
- Warpgate admin and user facing APIs use autogenerated OpenAPI schemas and SDKs. To update the SDKs after changing the query/response structures, run
just openapi-all.
Contributors ✨
Thanks goes to these wonderful people (emoji key):
 Eugeny 💻 |
 Spencer Heywood 💻 |
 Andreas Piening 💻 |
 Niklas 💻 |
 Nooblord 💻 |
 Shea Smith 💻 |
This project follows the all-contributors specification. Contributions of any kind welcome!