85 Commits (jsonvalidator)

Author	SHA1	Message	Date
Stéphane Lesimple	2c2f723bbb	fix: add helpers handling of SIGPIPE/SIGHUP ... To avoid having e.g. a group creation interrupted in the middle just because the caller killed their ssh connection while we're still working	4 years ago
Stéphane Lesimple	1725130a15	fix: avoid double-close log messages on HUP	4 years ago
Christophe Crochet	98c1c79382	update of --force-password: code style cleanup	4 years ago
Christophe Crochet	e9841b89bc	update of --force-password: removed guest support	4 years ago
Christophe Crochet	ff40617624	update of --force-password: guest support, autocompletion, new tests, code cleanups	4 years ago
Christophe Crochet	e4b132ed9a	new access option: --force-password <HASH>, to only try one specific password	4 years ago
Stéphane Lesimple	7dcbfeebc6	fix: --self-password was missing as a -P synonym (#257)	5 years ago
Stéphane Lesimple	8d84fce34f	fix: proactive-mfa: make it work for --osh batch and --osh clush	5 years ago
Stéphane Lesimple	b58388a3d9	feat: add --proactive-mfa and mfa/nofa interactive commands ... For bastions using JIT MFA, where MFA can be requested when attempting to connect through specific groups, or when using some commands, with respect to MFA being enforced at connection time directly through the sshd authentication process, one can now request MFA validation in advance, to workaround problems in commands such as ``clush`` or ``batch``, and interactive mode.	5 years ago
Stéphane Lesimple	f64cf79260	chore: rename an envvar for clarity	5 years ago
Stéphane Lesimple	f1e875ca4b	fix: erroneous message in connect.pl	5 years ago
Stéphane Lesimple	56d4078605	feat: add --fallback-password-delay (3) for ssh password autologin	5 years ago
Stéphane Lesimple	5930775626	enh: better error message when unknown option is used	5 years ago
Stéphane Lesimple	7da3ef3e25	fix: connect.pl: decode 2K bytes of the ttyrec instead of 1K to not miss messages	5 years ago
Stéphane Lesimple	adb9d8c374	feat: add UTF-8 chars to output when supported and allowed ... To enhance the readability and visibility of important messages (such as critical ones). This can be disabled with the `allowUTF8` global option set to `false`. It's never enabled if the user locale or their terminal don't seem to support it.	5 years ago
Stéphane Lesimple	1d9018ef7f	fix: strict check failure was no longer detected to print a help message ... Fixes #155	5 years ago
Stéphane Lesimple	ed77c1ef3e	feat: transmit PIV enforcement status to remote realms ... Closes #33	5 years ago
Stéphane Lesimple	41121f7723	fix: proper sqlite log location for invalid realm accounts	5 years ago
Stéphane Lesimple	e8d60810f1	Merge pull request #111 from ovh/perluseall ... chore: perl-use-all: dynamically find required modules	5 years ago
Stéphane Lesimple	16323667e2	Merge pull request #106 from ovh/logs ... feat: revamp logs	5 years ago
Stéphane Lesimple	8e7fc9b949	chore: perl-use-all: dynamically find required modules	5 years ago
Stéphane Lesimple	a479810d83	feat: revamp logs ... All connections and plugin executions emit two logs, an 'open' and a 'close' log. We now add all the details of the connection to the 'close' logs, those that were previously only available in the corresponding 'open' log. This way, it is no longer required to correlate both logs with their uniqid to have all the data: the 'close' log should suffice. The 'open' log is still there if for some reason the 'close' log can't be emitted (kill -9, system crash, etc.), or if the 'open' and the 'close' log are several hours, days or months appart. An additional field "duration" has been added to the 'close' logs, this represents the number of seconds (with millisecond precision) the connection lasted. Two new fields "globalsql" and "accountsql" have been added to the 'open'-type logs. These will contain either "ok" if we successfully logged to the corresponding log database, "no" if it is disabled, or "error $aDetailedMessage" if we got an error trying to insert the row. The 'close'-type log also has the new "accountsql_close" field, but misses the "globalsql_close" field as we never update the global database on this event. On the 'close' log, we can also have the value "missing", indicating that we couldn't update the access log row in the database, as the corresponding 'open' log couldn't insert it. The "ttyrecsize" log field for the 'close'-type logs has been removed, as it was never completely implemented, and contains bogus data if ttyrec log rotation occurs. It has also been removed from the sqlite log databases. The 'open' and 'close' events are now pushed to our own log files, in addition to syslog, if logging to those files is enabled (see ``enableGlobalAccesssLog`` and ``enableAccountAccessLog``), previously the 'close' events were only pushed to syslog. The /home/osh.log is no longer used for ``enableGlobalAccessLog``, the global log is instead written to /home/logkeeper/global-log-YYYYMM.log. The global sql file, enabled with ``enableGlobalSqlLog``, is now split by year-month instead of by year, to /home/logkeeper/global-log-YYYYMM.sqlite.	5 years ago
Stéphane Lesimple	81db4b10bb	feat: realms: use remote bastion MFA validation information for local policy enforcement	5 years ago
Stéphane Lesimple	16f42221ca	feat: add LC_BASTION_DETAILS envvar	5 years ago
Stéphane Lesimple	a204313af9	feat: accountModify: add --osh-only (closes #97)	5 years ago
Stéphane Lesimple	790802e6da	fix: osh.pl: plugin_config 'disabled' key is a boolean	5 years ago
Thomas SOËTE	2a51a78b54	fix: Enable perl-tidy.sh test ... * Move to ubuntu-20.04 runner * Remove check in dockers tests	5 years ago
Stéphane Lesimple	15cad00c27	fix: osh.pl: validate user and host format	6 years ago
Stéphane Lesimple	8f60646c65	feat: add interactiveModeByDefault option	6 years ago
Stéphane Lesimple	cb02fd2a33	fixes after review	6 years ago
Stéphane Lesimple	1b164c1197	fix typo	6 years ago
Stéphane Lesimple	7085b2d091	fix: osh.pl: fix pamtester use under FreeBSD ... Under FreeBSD, users can't read /etc/spwd.db, and there is no helper for pam_unix.so to validate user passwords, as this is the case under Linux, so we have to launch pamtester under root so that pam_unix.so can do its job	6 years ago
Stéphane Lesimple	60cea897f8	enh: osh.pl: replace harcoded selfMFASetupPassword logic by configuration	6 years ago
Stéphane Lesimple	5c72c92bdd	chore: fix typos everywhere	6 years ago
Stéphane Lesimple	fde20136ef	Initial commit	6 years ago