235 Commits (jsonvalidator)

Author	SHA1	Message	Date
Stéphane Lesimple	45cfb78b0b	fix: httpproxy: allow more passthrough headers ... The following additional header is now allowed to come back from the remote server to the client: * Content-Length The following additional headers are now passed through to the remote server: * Content-Length * Content-Encoding	5 years ago
Stéphane Lesimple	b364706f37	feat: httpproxy: add functional tests	5 years ago
Stéphane Lesimple	d6291f3ad4	feat: httpproxy: add and use execute_simple() for more performance ... Also handle errors better in hand_http_request()	5 years ago
Stéphane Lesimple	4ad41712fd	fix: interactive: use load_configuration_file() to handle comments in JSON files	5 years ago
Stéphane Lesimple	17a38ff960	fix: json_load(): remove dead code	5 years ago
Stéphane Lesimple	8cc990ad57	feat: add filtering options to several cmds,nicify print_acls() ... The commands selfListAccesses, accountListAccesses, groupList, groupListServers, groupListGuestAccesses and accountList now have options to filter their output through pattern matching, with --include and --exclude. The output from the commands using print_acls() is also more human-friendly, with auto-adjusting column length, and empty columns omitted. Closes #60.	5 years ago
Stéphane Lesimple	adb9d8c374	feat: add UTF-8 chars to output when supported and allowed ... To enhance the readability and visibility of important messages (such as critical ones). This can be disabled with the `allowUTF8` global option set to `false`. It's never enabled if the user locale or their terminal don't seem to support it.	5 years ago
Stéphane Lesimple	f3ce9dfb06	enh: clearer error message on non-existing group	5 years ago
Stéphane Lesimple	2a905aca96	release v3.03.01	5 years ago
Stéphane Lesimple	003052530e	feat: preparatory work to support Debian 11 "Bullseye" ... We still need to replacee pam_tally2 by pam_faillock Debian 11 is NOT yet supported, and won't be before it's released as stable.	5 years ago
Stéphane Lesimple	e37e235bf5	enh: install.inc: try harder to hit GitHub API in CI	5 years ago
Stéphane Lesimple	7b7c395c55	enh: osh-orphaned-homedir.sh: add more security checks to ensure we don't archive still-used home dirs	5 years ago
Stéphane Lesimple	7dabfc7135	fix: install-yubico-piv-checker: ppc64le installation was broken	5 years ago
Stéphane Lesimple	89e49ac8b7	fix: add a case to the ignored perl panic race condition	5 years ago
Stéphane Lesimple	b6c7503a73	release v3.03.00	5 years ago
Stéphane Lesimple	3764d652da	enh: interactive: avoid a warn() when TERM is undef	5 years ago
Stéphane Lesimple	383f2a011c	enh: guests: groupAddGuestAccess now supports setting a comment ... If no comment is set, the comment is inherited from the group ACL, as seen in groupListServers. selfAddPersonalAccess now also return details about the added server in the returned JSON. Closes #18 Closes #17	5 years ago
Stéphane Lesimple	b480316386	fix: groupDelGuestAccess: deleting a guest access returned an error on TTL-forced groups	5 years ago
Stéphane Lesimple	ed77c1ef3e	feat: transmit PIV enforcement status to remote realms ... Closes #33	5 years ago
Stéphane Lesimple	2327c4dfa1	chore: remove useless '## no critic', perltidy	5 years ago
Stéphane Lesimple	5eb5135d26	doc: update	5 years ago
Stéphane Lesimple	488ec6382e	enh: move unexpected-sudo messages from security to code-warning type	5 years ago
Stéphane Lesimple	e760cf6142	feat: add groupGenerateEgressKey and groupDelEgressKey	5 years ago
Stéphane Lesimple	fe58cf1d14	enh: egress ssh key: compute an ID so that keys can be pointed to and deleted	5 years ago
Stéphane Lesimple	c88be2def1	enh: get_group_keys: return the keyhome to avoid hardcoding it on several places	5 years ago
Stéphane Lesimple	02b76d301a	fix: groupSetRole: pass sudo param to subfuncs to avoid a security warning	5 years ago
Stéphane Lesimple	4624f71ea2	fix: execute: remove osh_warn on tainted params to avoid exposing arguments on coding error	5 years ago
Stéphane Lesimple	3b37242317	chore: more readable version of sql statements ... Signed-off-by: Stéphane Lesimple <stephane.lesimple+bastion@ovhcloud.com>	5 years ago
Stéphane Lesimple	70feff2c2d	enh: install: use in-place overwrite for sudoers files ... This fixes a race condition in sudo where it would log a log of error messages to syslog if used while we're running the install script: files around sudoers.d/ are then moved around, and it'll yell for each file it previously listed if the file no longer exists when it tries to stat() it. It also deprecates the --no-wait flag of the install script, as now the sudoers.d/ directory will always have integrity at all times. Signed-off-by: Stéphane Lesimple <stephane.lesimple+bastion@ovhcloud.com>	5 years ago
Stéphane Lesimple	59187fcf4c	fix: interactive: omit inactivity msg warning when set to 0 seconds ... Signed-off-by: Stéphane Lesimple <stephane.lesimple+bastion@ovhcloud.com>	5 years ago
Stéphane Lesimple	d430c602bf	release v3.02.00	5 years ago
Stéphane Lesimple	a913c5aa8a	bump to v3.01.99-rc4	5 years ago
Stéphane Lesimple	5d36e820ca	fix: admins no longer inherited superowner powers ... Regression since rc1	5 years ago
Stéphane Lesimple	3bb1db3a4d	bump to v3.01.99-rc3	5 years ago
Stéphane Lesimple	fd97845c1c	chore: update autoload list accordingly	5 years ago
Stéphane Lesimple	efe3710e4c	feat: groupList/accountList: add --include --exclude	5 years ago
Stéphane Lesimple	80ade2ba4c	fix: debian9: create_file_if_not_exists couldn't chgrp by filehanddle	5 years ago
Stéphane Lesimple	69778815bb	enh: groupList: use cache to speedup calls ... On bastions with thousands of group, the speedup is ~x10	5 years ago
Stéphane Lesimple	928bf0c7b0	enh: config: detect warnBefore/idleTimeout misconfiguration ... Before, an inconsistency in the configuration settings of the warnBefore(Lock|Kill)Seconds and idle(Lock|Kill)Timeout could break any new connection (ttyrec refuses to launch). Now we detect this case properly, and fallback to a sane setting for warnBefore(Lock|Kill)Seconds (zero) if those were set without enabling the corresponding idle(Lock|Kill)Timeout setting. We also log an error to syslog when it happens, so that the sysadmin can fix their configuration. Added hints about how these configuration options work together in the bastion.conf.dist file. Fixes #125	5 years ago
Stéphane Lesimple	8d0004f8aa	fix: config: be more permissive for documentationURL regex	5 years ago
Stéphane Lesimple	36d0c709db	bump to v3.01.99-rc2	5 years ago
Stéphane Lesimple	c6446495aa	fix: logs: sql dbname was not properly passed through the update logs func	5 years ago
Stéphane Lesimple	1378ba84f5	fix: re-introduce the ttyrecfile field ... This field was mistakenly removed along with the ttyrecsize one by mistake in a479810d83. Add tests to ensure this can't break again.	5 years ago
Stéphane Lesimple	27d09e8cbe	bump to v3.01.99-rc1	5 years ago
Stéphane Lesimple	1129850771	fix: global-log: directly set proper perms on file creation	5 years ago
Stéphane Lesimple	1676979913	feat: add PIV keys support and policy enforcement ... A new global option 'ingressRequirePIV' was added, to enable or disable a bastion-wide policy forcing everybody to use only PIV keys.	5 years ago
Stéphane Lesimple	62d6393d56	feat: add yubico-piv-checker install script	5 years ago
Stéphane Lesimple	41121f7723	fix: proper sqlite log location for invalid realm accounts	5 years ago
Stéphane Lesimple	16323667e2	Merge pull request #106 from ovh/logs ... feat: revamp logs	5 years ago
Stéphane Lesimple	a479810d83	feat: revamp logs ... All connections and plugin executions emit two logs, an 'open' and a 'close' log. We now add all the details of the connection to the 'close' logs, those that were previously only available in the corresponding 'open' log. This way, it is no longer required to correlate both logs with their uniqid to have all the data: the 'close' log should suffice. The 'open' log is still there if for some reason the 'close' log can't be emitted (kill -9, system crash, etc.), or if the 'open' and the 'close' log are several hours, days or months appart. An additional field "duration" has been added to the 'close' logs, this represents the number of seconds (with millisecond precision) the connection lasted. Two new fields "globalsql" and "accountsql" have been added to the 'open'-type logs. These will contain either "ok" if we successfully logged to the corresponding log database, "no" if it is disabled, or "error $aDetailedMessage" if we got an error trying to insert the row. The 'close'-type log also has the new "accountsql_close" field, but misses the "globalsql_close" field as we never update the global database on this event. On the 'close' log, we can also have the value "missing", indicating that we couldn't update the access log row in the database, as the corresponding 'open' log couldn't insert it. The "ttyrecsize" log field for the 'close'-type logs has been removed, as it was never completely implemented, and contains bogus data if ttyrec log rotation occurs. It has also been removed from the sqlite log databases. The 'open' and 'close' events are now pushed to our own log files, in addition to syslog, if logging to those files is enabled (see ``enableGlobalAccesssLog`` and ``enableAccountAccessLog``), previously the 'close' events were only pushed to syslog. The /home/osh.log is no longer used for ``enableGlobalAccessLog``, the global log is instead written to /home/logkeeper/global-log-YYYYMM.log. The global sql file, enabled with ``enableGlobalSqlLog``, is now split by year-month instead of by year, to /home/logkeeper/global-log-YYYYMM.sqlite.	5 years ago
Stéphane Lesimple	2117773945	fix: groupList: remove 9K group limit	5 years ago
Stéphane Lesimple	8c31ea277c	fix: remove useless warning when there is no guest access	5 years ago
Stéphane Lesimple	a204313af9	feat: accountModify: add --osh-only (closes #97)	5 years ago
Stéphane Lesimple	d6574221a3	fix: bastion.conf.dist & configuration.inc after #98	5 years ago
Stéphane Lesimple	4a45df4432	chore: tidy after merge, adjust & regen doc	5 years ago
Stéphane Lesimple	9c370b8ac1	Merge branch 'master' into configlint	5 years ago
Stéphane Lesimple	b131395a21	Merge pull request #79 from axl89/master ... Fixed wrong default values in bastion.conf comments	5 years ago
Stéphane Lesimple	163a3fd726	chore: perlcritic/perltidy passes	5 years ago
Stéphane Lesimple	ef6efa6dc3	enh: config: better parsing and normalization ... We now warn (to syslog) for invalid values where we have to fallback to defaults, and for boolean options, actual true/false JSON values are now properly recognized. 0 and 1 will still always be parsed correctly, to not break compatibility.	5 years ago
Stéphane Lesimple	03ad1da046	chore: perlcritic: including forgotten .inc files	5 years ago
Stéphane Lesimple	1c33903203	release v3.01.03	5 years ago
Stéphane Lesimple	790802e6da	fix: osh.pl: plugin_config 'disabled' key is a boolean	5 years ago
Stéphane Lesimple	39ddc4c462	fix: guests: get rid of ghost guest accesses in corner cases ... Adding a guest access to a member of a group is now denied, to avoid having dangling guest accesses when their membership is revoked. In effect, they could no longer access the group servers, even as guest, because they no longer had access to the group key, but their previous guest accesses were still visible in groupListGuestAccesses, causing possible confusion. We now also revoke all guest accesses of an account to a group, if any, when it's being set as a member of this group, so that when/if the account membership is revoked, we don't end up with the same ghost guest accesses as above.	5 years ago
Stéphane Lesimple	a3b2b7d8e4	bump to v3.01.02	5 years ago
Stéphane Lesimple	18d8195027	fix: is_valid_remote_user: extend allowed size from 32 to 128	5 years ago
Axel Amigo Arnold	9b06db1461	Changed ttyrecFilenameFormat default value ... See #79 Additional details: a085cc467e (r536813898)	5 years ago
Stéphane Lesimple	534ce45812	release v3.01.01	5 years ago
Stéphane Lesimple	9c1870e990	fix: interactive mode: mark non-printable chars as such to avoid readline quirks	5 years ago
Stéphane Lesimple	4cb09a9570	nh: remove hardcoded .ssh/authorized_keys2 everywhere	5 years ago
Thomas SOËTE	a4dc86cfde	fix: Allow dot in group name as it is allowed in account ... Fixes #61	5 years ago
Stéphane Lesimple	f07e00b1e9	Merge branch 'master' into adminSudo	5 years ago
Stéphane Lesimple	e2a64a9d8f	enh: adminSudo: better autocompletion rules	5 years ago
Thomas SOËTE	2a51a78b54	fix: Enable perl-tidy.sh test ... * Move to ubuntu-20.04 runner * Remove check in dockers tests	5 years ago
Stéphane Lesimple	5ecab9888b	bump to v3.01.00	6 years ago
Stéphane Lesimple	15cad00c27	fix: osh.pl: validate user and host format	6 years ago
Stéphane Lesimple	8f60646c65	feat: add interactiveModeByDefault option	6 years ago
Stéphane Lesimple	cb02fd2a33	fixes after review	6 years ago
Stéphane Lesimple	9f1a8b925e	enh: install: better handling of non-Linux standard paths	6 years ago
Stéphane Lesimple	09bd6dffd9	fix: freebsd: add md5sum_compat() ... to account for systems where md5sum's binary name is gmd5sum	6 years ago
Stéphane Lesimple	b87107dd23	bump to v3.00.02	6 years ago
Stéphane Lesimple	ae1bcbf223	release v3.00.01	6 years ago
Stéphane Lesimple	5c72c92bdd	chore: fix typos everywhere	6 years ago
Stéphane Lesimple	4da7a39f27	release v3.00.00	6 years ago
Stéphane Lesimple	26e78f424b	chore: fix some links in documentation	6 years ago
Stéphane Lesimple	fde20136ef	Initial commit	6 years ago