balena-io/sshproxy

sshproxy is a simple ssh server library exposing an even simpler API

sshproxy

Configuration is possible via commandline flags, environment variables and config files.

Config files should be named sshproxy.<ext> and exist in the sshproxy work dir. The following config file formats are supported:

• YAML (sshproxy.yml)
• JSON (sshproxy.json)
• TOML (sshproxy.toml)
• HCL (sshproxy.hcl)
• Java .properties (sshproxy.properties)

There are a total of 15 configuration options and with the exception of dir they can all be set via commandline, environment or config file.

Name	Commandline	Environment	Config
Allow Env	--allow-env -E	SSHPROXY_ALLOW_ENV	allow-env
API Host	--apihost, -H	BALENA_API_HOST	apihost
API Key	--apikey, -K	SSHPROXY_API_KEY	apikey
API Port	--apiport, -P	BALENA_API_PORT	apiport
Auth Failed Banner	--auth-failed-banner -b	SSHPROXY_AUTH_FAILED_BANNER	auth-failed-banner
Bind	--bind, -b	SSHPROXY_BIND	bind
Dir	--dir, -d	SSHPROXY_DIR
Idle Timeout	--idle-timeout, -i	SSHPROXY_IDLE_TIMEOUT	idle-timeout
Max Auth Tries	--max-auth-tries -m	SSHPROXY_MAX_AUTH_TRIES	max-auth-tries
Metrics Bind	--metrics-bind, -M	SSHPROXY_METRICS_BIND	metrics-bind
Sentry DSN	--sentry-dsn -S	SSHPROXY_SENTRY_DSN	sentry-dsn
Shell	--shell, -s	SSHPROXY_SHELL	shell
Shell GID	--shell-gid, -g	SSHPROXY_SHELL_GID	shell-gid
Shell UID	--shell-uid, -u	SSHPROXY_SHELL_UID	shell-uid
Use Proxy Protocol	--use-proxyprotocol, -p	SSHPROXY_USE_PROXYPROTOCOL	use-proxyprotocol
Verbosity	--verbosity, -v	SSHPROXY_VERBOSITY	verbosity

Usage of sshproxy:
  -E, --allow-env string            List of environment variables to pass from client to shell (default: None)
  -H, --apihost string              Balena API Host (default "api.balena-cloud.com")
  -K, --apikey string               Balena API Key (required)
  -P, --apiport string              Balena API Port (default "443")
  -B, --auth-failed-banner string   Path to template displayed after failed authentication
  -b, --bind string                 Address the ssh service will bind to (default ":22")
  -d, --dir string                  Work dir, holds ssh keys and sshproxy config (default "/etc/sshproxy")
  -i, --idle-timeout int            Idle timeout (seconds, 0 = none)
  -m, --max-auth-tries int          Maximum number of authentication attempts per connection (default 0; unlimited)
  -M, --metrics-bind string         Address the prometheus metrics server should bind to (default: disabled)
  -S, --sentry-dsn string           Sentry DSN for error reporting
  -s, --shell string                Path to shell to execute post-authentication (default "shell.sh")
  -g, --shell-gid int               Group to run shell as (default: current gid) (default -1)
  -u, --shell-uid int               User to run shell as (default: current uid) (default -1)
  -p, --use-proxyprotocol           Enable Proxy Protocol support
  -v, --verbosity int               Set verbosity level (0 = quiet, 1 = normal, 2 = verbose, 3 = debug, default: 1) (default 1)
      --version                     Display version and exit

Auth Failed Banner/Template

The 'auth failed banner' is a template rendered and displayed to the user after failed authentication. It should be a Go template has two available properties; .user and .fingerprints.

Example Usage

% go get github.com/balena-io/sshproxy/balena
% export SSHPROXY_DIR=$(mktemp -d /tmp/sshproxy.XXXXXXXX)
% echo -e '#!/usr/bin/env bash\nenv' > ${SSHPROXY_DIR}/shell.sh && chmod +x ${SSHPROXY_DIR}/shell.sh
  SSHPROXY_PORT=2222 \
  SSHPROXY_API_KEY=... \
  go run ${GOPATH}/src/github.com/balena-io/sshproxy/main.go
...
% ssh -o 'StrictHostKeyChecking=no' \
      -o 'UserKnownHostsFile=/dev/null' \
    balena@localhost -p2222 -- some command
Warning: Permanently added '[localhost]:2222' (RSA) to the list of known hosts.
SSH_USER=balena
PWD=...
LANG=en_GB.UTF-8
SHLVL=1
SSH_ORIGINAL_COMMAND=some command
LC_CTYPE=en_GB.UTF-8
_=/usr/bin/env

Building

The Makefile in the project root contains all necessary rules for linting, testing and building sshproxy packages. Building via a Docker image can be achieved with, for example: docker run --rm -v $PWD:/go/src/github.com/balena-io/sshproxy golang make -C /go/src/github.com/balena-io/sshproxy lint test release.

sshproxy's Issues

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• Update module golang.org/x/crypto to v0.23.0

Detected dependencies

docker-compose

docker-compose.test.yml

• golang 1.22.3

dockerfile

Dockerfile

• golang 1.22.3

github-actions

.github/actions/publish/action.yml

• actions/upload-artifact v4@65462800fd760344b1a7b4382951275a0abb4808

.github/workflows/flowzone.yml

• product-os/flowzone master

gomod

go.mod

• go 1.17
• github.com/balena-io-modules/gexpect v0.0.0-20170619124017-ca1f0041f820@ca1f0041f820
• github.com/balena-io/pinejs-client-go v0.0.0-20170412165724-ac4f79c5f7e7@ac4f79c5f7e7
• github.com/getsentry/raven-go v0.2.0
• github.com/gliderlabs/ssh v0.3.7
• github.com/pires/go-proxyproto v0.7.0
• github.com/prometheus/client_golang v1.19.0
• github.com/spf13/pflag v1.0.5
• github.com/spf13/viper v1.18.2
• golang.org/x/crypto v0.22.0

Use (ec)dsa keys in addition to the current ed25519 and rsa

exit-status request does not reflect actual exit status

request payload lengths are not parsed correctly

Currently only the final byte is being parsed.

Add configuration option to dictate MaxAuthTries

crash during auth flow

panic: interface conversion: interface {} is nil, not string
goroutine 3043014 [running]:
github.com/gliderlabs/ssh.(*sshContext).User(0xc0013e4880, 0x9afc00, 0xfcf990)
#011/go/src/github.com/gliderlabs/ssh/context.go:127 +0x9a
main.(*authHandler).publicKeyHandler(0xc00041e400, 0xbd7d20, 0xc0013e4880, 0x7f9ccc511380, 0xc001382910, 0x7f9ccc511380)
#011/go/src/github.com/balena-io/sshproxy/auth.go:84 +0x49
github.com/gliderlabs/ssh.(*Server).config.func2(0xbd3880, 0xc00009e200, 0xbce800, 0xc001382910, 0x217, 0x217, 0x0)
#011/go/src/github.com/gliderlabs/ssh/server.go:131 +0xca
golang.org/x/crypto/ssh.(*connection).serverAuthenticate(0xc00009e200, 0xc0004b5110, 0x11, 0x40, 0x0)
#011/go/src/golang.org/x/crypto/ssh/server.go:523 +0x1bb2
golang.org/x/crypto/ssh.(*connection).serverHandshake(0xc00009e200, 0xc0004b5110, 0xaaf128, 0x1b, 0x100e780)

create shared ssh server component

Spec: resin-io/hq#623

channel 0: request window-change confirm 0

sshproxy should probably set the tty options of the process that is currently been exec()'ed accordingly when it receives a window-change event from the client. One thing I've also noticed is that a PTY session seemingly freezes if a window size is modified, I still can't tell if this is a sshproxy issue or not.

I'm not opening a separate issue, but tty size (rows/cols) should be set from the beginning - I'd expect pty-req event/request type to have this accompanying info.

Consider relative sshproxy import

In https://github.com/resin-io/sshproxy/blob/master/resin/main.go#L37:

import (
   [...]
   "github.com/resin-io/sshproxy"
   [...]
)

I'm new to Golang, but I got a bit confused with this ^ because trying to make changes to sshproxy.go and then rebuilding the project (make release) doesn't pick up new changes.

[edit] For more context, my working dir was /go/src/sshproxy , which was probably wrong in the first place - I've now been using /go/src/resin-io/sshproxy and rebuilding the artifacts seems to work fine.

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

This repository currently has no open or pending branches.

Detected dependencies

docker-compose

docker-compose.test.yml

• golang 1.20.4

dockerfile

Dockerfile

• golang 1.20.4

github-actions

.github/actions/publish/action.yml

• actions/upload-artifact v3@0b7f8abb1508181956e8e162db84b466c27e18ce

.github/workflows/flowzone.yml

gomod

go.mod

• go 1.17
• github.com/balena-io-modules/gexpect v0.0.0-20170619124017-ca1f0041f820@ca1f0041f820
• github.com/balena-io/pinejs-client-go v0.0.0-20170412165724-ac4f79c5f7e7@ac4f79c5f7e7
• github.com/getsentry/raven-go v0.2.0
• github.com/gliderlabs/ssh v0.3.5
• github.com/pires/go-proxyproto v0.7.0
• github.com/prometheus/client_golang v1.15.1
• github.com/spf13/pflag v1.0.5
• github.com/spf13/viper v1.15.0
• golang.org/x/crypto v0.9.0

regex

Dockerfile

• golang 1.20.4

docker-compose.test.yml

• golang 1.20.4

resin-git needs to spawn shell command under alternative uid/gid

Needs CI integration / Dockerfile-based build workflow

logs are too noisy

It is not necessary to log every incoming request

`ssh-keygen` default key output format has changed in later Debian distros

On moving from Debian Stretch to Buster as the base image, several changes have occurred. One of these appears to be the format in which keys are generated via ssh-keygen.

In Stretch, keys have the default PEM format:

-----BEGIN RSA PRIVATE KEY-----

In Buster, they've moved to the OpenSSH format:

-----BEGIN OPENSSH PRIVATE KEY-----

sshproxy uses ssh-keygen to create its keys on startup, so under Buster, it now generates keys it can't handle and fails to start the server.

We can quickfix this by adding -m PEM to the CLI use.

A longterm fix could be ensuring the correct keytypes are generated by sshproxy itself (or supporting the OpenSSH key format).

Add support for Sentry error reporting

Disable automatic setting of 'env' requests from the user side

In https://github.com/resin-io/sshproxy/blob/master/sshproxy.go#L168

We should definitely not be accepting/setting arbitrary, client-side env variables, as it poses a security risk. Is this the case here?

[edit: ] it apparently is the case that user-sent env vars are always set, also renamed the issue title accordingly

sshproxy does not always stop `exec()`'ed commands after the client ssh connection has been dropped

The description might be a bit vague, I'm opening this ticket to make sure it doesn't slip through.

The steps to reproduce are

• Connect with resin ssh as usual
• kill -9 the ssh client process

While the sshproxy <-> client socket will be closed properly, the script that has been started by sshproxy will continue running and the proxy <-> device ssh connection will remain active.

Race condition in handling of `cmd`

==================
WARNING: DATA RACE
Write at 0x00c4201ba208 by goroutine 32:
  os/exec.(*Cmd).Wait()
      /usr/local/Cellar/go/1.9.2/libexec/src/os/exec/exec.go:450 +0x163
  github.com/resin-io/sshproxy.(*Server).handleRequests.func1.1()
      /Users/wrboyce/Dev/resin/.go/src/github.com/resin-io/sshproxy/sshproxy.go:249 +0x4c

Previous read at 0x00c4201ba208 by goroutine 30:
  github.com/resin-io/sshproxy.(*Server).handleRequests.func1()
      /Users/wrboyce/Dev/resin/.go/src/github.com/resin-io/sshproxy/sshproxy.go:269 +0x29b

Goroutine 32 (running) created at:
  github.com/resin-io/sshproxy.(*Server).handleRequests.func1()
      /Users/wrboyce/Dev/resin/.go/src/github.com/resin-io/sshproxy/sshproxy.go:248 +0x8a

Goroutine 30 (finished) created at:
  github.com/resin-io/sshproxy.(*Server).handleRequests()
      /Users/wrboyce/Dev/resin/.go/src/github.com/resin-io/sshproxy/sshproxy.go:246 +0xb0d
  github.com/resin-io/sshproxy.(*Server).handleChannels.func1()
      /Users/wrboyce/Dev/resin/.go/src/github.com/resin-io/sshproxy/sshproxy.go:176 +0x8a
==================

Reproducible using:

package sshproxy_test

import (
	"net"
	"time"
	"testing"

	"golang.org/x/crypto/ssh"
	"github.com/resin-io/sshproxy"
)

func TestRace(t *testing.T) {
	server, err := sshproxy.New("/tmp", "/bin/bash", false, nil, nil, nil)
	if err != nil {
		t.Errorf("error calling sshproxy.New :( %q", err)
	}
	port := "12345"
	go server.Listen(port)

	config := &ssh.ClientConfig{
		User: "user",
		Auth: []ssh.AuthMethod{
			ssh.Password("password"),
		},
		HostKeyCallback: func(hostname string, remote net.Addr, key ssh.PublicKey) error {
			return nil
		},
	}
	for i := 0; i < 10; i++ {
		client, err := ssh.Dial("tcp", "localhost:12345", config)
		if err != nil {
			t.Errorf("Cannot connect to server :( %q", err)
		}
		session, err := client.NewSession()
		if err != nil {
			t.Errorf("Cannot create session :( %q", err)
		}
		time.Sleep(time.Second)
		_, err = session.SendRequest("exec", false, []byte{0, 0, 0, 4, 't', 'e', 's', 't'})
		if err != nil {
			t.Errorf("Cannot send exec request :( %q", err)
		}
		time.Sleep(time.Duration(i * 100) * time.Millisecond)
		client.Close()
	}
}

Suggestion: move README in main page

This README is pretty sweet (https://github.com/resin-io/sshproxy/blob/master/resin/README.md), it'd be great if we had it under the main folder (for a moment I thought documentation slipped through when transferring the repo, but it simply is one level deeper)

`resin-git` needs to display a banner to user when auth fails

Ref.

Connection closed too early

https://app.frontapp.com/open/cnv_6s4t5l
https://www.flowdock.com/app/rulemotion/resin-tech/threads/fMzdZ0HIyA8TZYXTTZNGU9fs7w2
https://www.flowdock.com/app/rulemotion/resin-tech/threads/FCOgP-6bYRwFn_tRzs3wWgHHD7M

Front conversations

prepare repo for VersionBot

All generated keys are of type RSA

Switch to v5 of the balena api instead of v1