43 Commits (groupcreate_fix_uid)

Author	SHA1	Message	Date
Jonah	bdc360b421	fix: debian 13 uses lastlog2 (#590) ... * fix: debian 13 uses lastlog2 * fix: also make sure libpam-lastlog2 is installed * fix: handle lastlog for ubuntu correctly Co-authored-by: Stéphane Lesimple <speed47_github@speed47.net>	6 months ago
jon4hz	9daf0007e1	feat: switch banner if node is sealed	7 months ago
Stéphane Lesimple	c4112994f4	chg: drop Debian 10, preliminary support for Debian 13	8 months ago
Stéphane Lesimple	914d8b30b4	chg: remove support for EOL CentOS 7	2 years ago
Stéphane Lesimple	e2a45596d0	fix: generation of MFA secret under FreeBSD	2 years ago
Stéphane Lesimple	ad9e14d568	chore: silence tr on secret generation	2 years ago
Stéphane Lesimple	b48463076f	feat: osh.pl: jit mfa for plugins	2 years ago
Stéphane Lesimple	5dc50b3e57	feat: add stealth_stderr/stdout ttyrec support, enable it for scp (#413)	3 years ago
Stéphane Lesimple	708efd90ca	chore: add RockyLinux 9 support	3 years ago
Stéphane Lesimple	49dc104dd7	chore: push sandbox and tester images from Deb10 to Deb11 ... Also remove old config files from previsously dropped OS versions	3 years ago
Stéphane Lesimple	ebebed7be0	fix: remove spurious set +e/-e after commit bdea34c	4 years ago
Stéphane Lesimple	72cefa6417	fix: performance issues introduced by effab4a ... Commit that introduced the performance degradation is effab4a (fix: workaround for undocumented caching in getpw/getgr funcs) Rewrote caching at the getpwent/getpwnam/getgrent/getgrnam level, which restores performance pre-effab4a and even enhances it in somes cases, for example on a 2000-accounts and 2000-groups bastion, we are: - 11% faster on --osh help - 35% faster on --osh selfListAccesses (reduces syscalls by 87%)	4 years ago
Stéphane Lesimple	bdea34ccad	enh: install: better error detection	4 years ago
Stéphane Lesimple	73b6a625f5	feat: add support and tests for Ubuntu 22.04 LTS	4 years ago
Stéphane Lesimple	884b4bbaf0	fix: install: ensure that the healthcheck user can always connect from 127.0.0.1 ... Regardless of the bastion config about the ingressKeysFrom configuration	4 years ago
Stéphane Lesimple	86c7bf39e6	remove compress-old-logs script, as osh-encrypt-rsync will do the job instead	4 years ago
Stéphane Lesimple	e5cfa26853	fix: install: avoid cases of sigpipe on `tr`	4 years ago
Stéphane Lesimple	7bb0843de1	feat: add osh-remove-empty-folders.sh	4 years ago
Stéphane Lesimple	7f28cce490	chore: install: remove obsolete upgrading sections ... These portions of code were only useful to upgrade bastions from versions older than v3.00.00, which was the first public release. There has been no remaining pre-v3.x version in production internally since some time now, so there is no use keeping that code.	4 years ago
Stéphane Lesimple	a68ccb3f8c	feat: add new OSes and deprecate old ones ... add: - Debian 11 - RockyLinux 8 remove: - OpenSUSE Leap 15.2 - Old minor versions of CentOS 7.x - Old minor versions of CentOS 8.x	4 years ago
Stéphane Lesimple	d51c4c8be0	fix: tests: full tests on FreeBSD	4 years ago
Christophe Crochet	d85298f229	new account option: --pubkey-auth-optional, to allow ingress login with or without pubkey when pam is required	5 years ago
madx	ea8ed97a34	new account option: mfa-any, to allow ingress login with pubkey alone or pam alone instead of requiring both	5 years ago
Stéphane Lesimple	9b2aa996b3	enh: better use of account creation metadata ... Store account creation information in a JSON. Display this information in `accountInfo` for auditors.	5 years ago
Stéphane Lesimple	60ad30ce5b	fix: install: adjust a sed to be FreeBSD 13 compliant	5 years ago
Stéphane Lesimple	90d6dc2e3c	fix: superowners need to have +x on group homes	5 years ago
Stéphane Lesimple	003052530e	feat: preparatory work to support Debian 11 "Bullseye" ... We still need to replacee pam_tally2 by pam_faillock Debian 11 is NOT yet supported, and won't be before it's released as stable.	5 years ago
Stéphane Lesimple	70feff2c2d	enh: install: use in-place overwrite for sudoers files ... This fixes a race condition in sudo where it would log a log of error messages to syslog if used while we're running the install script: files around sudoers.d/ are then moved around, and it'll yell for each file it previously listed if the file no longer exists when it tries to stat() it. It also deprecates the --no-wait flag of the install script, as now the sudoers.d/ directory will always have integrity at all times. Signed-off-by: Stéphane Lesimple <stephane.lesimple+bastion@ovhcloud.com>	5 years ago
Stéphane Lesimple	1129850771	fix: global-log: directly set proper perms on file creation	5 years ago
Stéphane Lesimple	a479810d83	feat: revamp logs ... All connections and plugin executions emit two logs, an 'open' and a 'close' log. We now add all the details of the connection to the 'close' logs, those that were previously only available in the corresponding 'open' log. This way, it is no longer required to correlate both logs with their uniqid to have all the data: the 'close' log should suffice. The 'open' log is still there if for some reason the 'close' log can't be emitted (kill -9, system crash, etc.), or if the 'open' and the 'close' log are several hours, days or months appart. An additional field "duration" has been added to the 'close' logs, this represents the number of seconds (with millisecond precision) the connection lasted. Two new fields "globalsql" and "accountsql" have been added to the 'open'-type logs. These will contain either "ok" if we successfully logged to the corresponding log database, "no" if it is disabled, or "error $aDetailedMessage" if we got an error trying to insert the row. The 'close'-type log also has the new "accountsql_close" field, but misses the "globalsql_close" field as we never update the global database on this event. On the 'close' log, we can also have the value "missing", indicating that we couldn't update the access log row in the database, as the corresponding 'open' log couldn't insert it. The "ttyrecsize" log field for the 'close'-type logs has been removed, as it was never completely implemented, and contains bogus data if ttyrec log rotation occurs. It has also been removed from the sqlite log databases. The 'open' and 'close' events are now pushed to our own log files, in addition to syslog, if logging to those files is enabled (see ``enableGlobalAccesssLog`` and ``enableAccountAccessLog``), previously the 'close' events were only pushed to syslog. The /home/osh.log is no longer used for ``enableGlobalAccessLog``, the global log is instead written to /home/logkeeper/global-log-YYYYMM.log. The global sql file, enabled with ``enableGlobalSqlLog``, is now split by year-month instead of by year, to /home/logkeeper/global-log-YYYYMM.sqlite.	5 years ago
Stéphane Lesimple	50c016be10	fix: sudogen: properly handle accounts & groups containing '.'	5 years ago
Stéphane Lesimple	4cb09a9570	nh: remove hardcoded .ssh/authorized_keys2 everywhere	5 years ago
Stéphane Lesimple	15cad00c27	fix: osh.pl: validate user and host format	5 years ago
Stéphane Lesimple	d6be60e4a2	Merge branch 'master' into centos	6 years ago
Stéphane Lesimple	4fd24a3dbc	enh: install: freebsd: check whether acls are enabled	6 years ago
Stéphane Lesimple	231c62b581	feat: install: add SELinux module for TOTP MFA ... Fixes #26	6 years ago
Stéphane Lesimple	cb02fd2a33	fixes after review	6 years ago
Stéphane Lesimple	9f1a8b925e	enh: install: better handling of non-Linux standard paths	6 years ago
Stéphane Lesimple	234dd0768a	feat: freebsd: add specific FreeBSD ssh config templates	6 years ago
Stéphane Lesimple	09bd6dffd9	fix: freebsd: add md5sum_compat() ... to account for systems where md5sum's binary name is gmd5sum	6 years ago
Stéphane Lesimple	5c72c92bdd	chore: fix typos everywhere	6 years ago
Stéphane Lesimple	619000fa84	enh: install-ttyrec.sh replaces build-and-install-ttyrec.sh ... No longer build ttyrec inplace, either download and install the Debian/RPM package, or install the prebuild static binaries. Modify the Dockerfiles accordingly.	6 years ago
Stéphane Lesimple	fde20136ef	Initial commit	6 years ago