nbeguier/cassh

SSH CA administration via CLI and GUI

cassh's Issues

Do you support startTLS connections to LDAP?

Is it possible to use startTLS with LDAP authentication? My LDAP server has an SSF of 256 and requires secure connections.

url without / big error

[user]
name = nbeguier
realname = Nicolas Beguier
pubkey_path = /root/.ssh/id_rsa
url = http://172.17.0.2:8080
auth = None # None or ldap

Don't mention LDAP realname

Create a server config file

For instance, postgres passwd and hostname

[Bug] admin status

Return wrong key !!

Support KRL for multiple instances

Add OAuth2/OpenID Connect authentication

This is a feature request.

In addition to LDAP authentication, it would be possible to authenticate users with OpenID Connect. This would make it possible to integrate cassh into environments where Google Accounts are used to authenticate users (and, of course, other environments that employ an identity provider which supports OpenID Connect).

[bug] cassh status open for everyone

Add admin token

Use token in conf and use it to log in

Error: No realname option given.

This error occurs when LDAP is disable on both server and client.

Cassh Server - clean functions

A Server Class that has the CASSH specific methods

• list_keys
• sign_keys
  A ClusterController Class with:
• status (cluster_alived)
• get_krl (cluster_last_krl)
• update_krl (cluster_update_krl)
  Maybe Server would merge into ClusterController at some point and just be renamed as Controller with a option / param to support cluster mode.

And finally the Tools class could be removed and these methods would go back as functions :

pg_connection
get
post
sql_to_json
and tools might me renamed as cassh_utils

Documentation

How to test our ssh signed key

Add way more different HTTP code

Add new status : NEVER SIGNED

Add a "signed" filed to the "cassh status" command

Context

When you add a key, you can see explicitly that the status is Pending

$ cassh status
{
    "expiration": "1970-01-01 01:00:00 (UTC+0000)", 
    "realname": "Firstname Lastname", 
    "ssh_key_hash": "2048 e8:00:ed:f3:ae:8c:d1:65:e6:3b:48:8f:d5:84:fd:f5 ", 
    "status": "PENDING", 
    "username": "username"
}

After an admin "activate" a user, same result, we can clearly see the status:

 $ cassh status
Please type your LDAP password (user=Xavier Krantz): 
{
    "expiration": "1970-01-01 01:00:00 (UTC+0000)", 
    "realname": "Xavier Krantz", 
    "ssh_key_hash": "2048 e8:00:ed:f3:ae:8c:d1:65:e6:3b:48:8f:d5:84:fd:f5 ", 
    "status": "ACTIVE", 
    "username": "username"
}

However, currently there is no way to know if the key is signed ...
Even if we can guess it, since we have an expiration date that is defined in the future:

$ cassh status
{
    "expiration": "2017-08-26 11:29:19 (UTC+0000)", 
    "realname": "Firstname Lastname", 
    "ssh_key_hash": "2048 e8:00:ed:f3:ae:8c:d1:65:e6:3b:48:8f:d5:84:fd:f5 ", 
    "status": "ACTIVE", 
    "username": "username"
}

Feature Request:

It could be nice to have an explicit field for quick understanding, especially for users who are not very familiar with CLI and ssh practices. Maybe a new field or update the status filed to SIGNED ?

Display pubkey better hash and add rate

keys are not display properly :

    "ssh_key_hash": "2048 e8:47:77:a6:ea:aa:7d:26:67:24:ba:3a:52:b6:3f:ce ", 

    "ssh_key_hash": "2048 SHA256:R8NwvNikoqVR9DMwvNikoqVR9DdOSwvNikoqVR9D roberto@roberto-ThinkPad-T470p (RSA)\n", 

    "ssh_key_hash": "256 SHA256:hf44FmQ8YdbeEdO+u7geOKv", 

It could be better to split this into category :

• DSA (weakest)
• RSA (standard)
• ECDSA (better)
• Ed25519 (strongest but not suported on old OS)

and show the length.

Why not add a rate to help the admin to validate a key

Increase test code coverage

Web interface

Support multiple keys for one user

Implement admin and cluster functionalities for the WebUI

Improve README

Quick start incomplete and pretty messy

Put disable warning in optionnal

CASSh WebUI - Add headers UA & HTTP_CLIENT_VERSION

Implement KRL

Split server.py

Extract tools functions into a separate library

[Bug] If revoked, no message during signing

How to deploy CA files to ssh servers.

So, I have set up the cassh server, and created a key, but I have no idea how to deploy the files necessary to be able to use my newly created and signed key on an SSH server.

Could somebody write up some quick instructions on the following:

1. What files are necessary to copy from either the CASSH server or the CASSH client to the remote SSH server?
2. what sshd_config configuration options need to be set for the remote SSH server to be able to authenticate the CASSH-signed key.

Disable debug mode in server

Getting all settings / configurations / paths through env variables and mounted secrets

It would be really great to be able to specify all configuration attributes via environment variables. For example to the path to settings.txt for cassh-web.
Further more it would be also super handy to be able to define keys as paths to files. This would allow keys to be mounted in kubernetes as secrets and the rest of the configuration could reside in a ConfigMap.
Both changes would allow a fast and consistent configuration and deployment of all the components in a Kubernetes cluster.

Thanks,
Thomas

Add versioning

Configurable Debug mode for CASSH-SERVER

config.debug = False

Add LDAP auth

CASSH Server - Display client version last used

Client already give version in header : HTTP_CLIENT_VERSION

Add duration in client configuration

realname facultatif

Compatible python3

Sanitize every inputs

tmp file not readable

127.0.0.1:41578 - - [09/Jul/2017 12:04:07] "HTTP/1.1 GET /admin/user" - 200 OK
do_ca_sign: unable to open "/tmp/tmpDAkVaX": No such file or directory

Admin ldap auth server

Handle readname with special character "-"

Web UI in http only

It should be possible to enable http only for the WebUI

help message lbcssh

TODO are in every help messagein lbcssh script

expiration status issue

$ cassh admin abricot status
Please type your LDAP password (user=[email protected]):
{
"expiration": "2017-09-22 10:02:56",
"realname": "[email protected]",
"ssh_key_hash": "2048 9c:22:1xxxxxb:d2:3b ",
"status": "ACTIVE",
"username": "abricot"
}

Increase log verbosity

Add ip, user agent, version, account and wrong inputs

Also, disable logs for /ping and /health

Issue UTC during status

Generated KRL

Rename cluster_updatekrl to cluster_update_krl

Add health check on the WebUI

There is no way to check the web interface of the web ui.
HEAD / is the only way, but that's log too much.

Separate settings.txt in a non-versioned file

Implement cluster functionalities on cassh client

/cluster/status only for now