83 Commits (70feff2c2d57696ea9b4e3741f721fac6ebf3be3)

Author	SHA1	Message	Date
Stéphane Lesimple	70feff2c2d	enh: install: use in-place overwrite for sudoers files ... This fixes a race condition in sudo where it would log a log of error messages to syslog if used while we're running the install script: files around sudoers.d/ are then moved around, and it'll yell for each file it previously listed if the file no longer exists when it tries to stat() it. It also deprecates the --no-wait flag of the install script, as now the sudoers.d/ directory will always have integrity at all times. Signed-off-by: Stéphane Lesimple <stephane.lesimple+bastion@ovhcloud.com>	5 years ago
Stéphane Lesimple	efe3710e4c	feat: groupList/accountList: add --include --exclude	5 years ago
Stéphane Lesimple	148d5206e5	enh: rootListIngressKeys: look for all well-known authkeys files	5 years ago
Stéphane Lesimple	69778815bb	enh: groupList: use cache to speedup calls ... On bastions with thousands of group, the speedup is ~x10	5 years ago
Stéphane Lesimple	141791db92	fix: scripts: (( )) returns 1 if evaluated to zero	5 years ago
Stéphane Lesimple	d04b15a19e	fix: tocttou in ttyrec rotation script	5 years ago
Stéphane Lesimple	361c6a37a2	fix: osh-lingering-sessions-reaper.sh: tocttou on kill could terminate the script early	5 years ago
Pierre Kuhner	e7e045a40d	fix: confusing error messages in groupDelServer	5 years ago
Stéphane Lesimple	1129850771	fix: global-log: directly set proper perms on file creation	5 years ago
Stéphane Lesimple	1676979913	feat: add PIV keys support and policy enforcement ... A new global option 'ingressRequirePIV' was added, to enable or disable a bastion-wide policy forcing everybody to use only PIV keys.	5 years ago
Stéphane Lesimple	62d6393d56	feat: add yubico-piv-checker install script	5 years ago
Stéphane Lesimple	41121f7723	fix: proper sqlite log location for invalid realm accounts	5 years ago
Stéphane Lesimple	e8d60810f1	Merge pull request #111 from ovh/perluseall ... chore: perl-use-all: dynamically find required modules	5 years ago
Stéphane Lesimple	b4f32d5afe	Merge pull request #110 from ovh/aclbackup ... enh: satellite scripts: better error handling	5 years ago
Stéphane Lesimple	16323667e2	Merge pull request #106 from ovh/logs ... feat: revamp logs	5 years ago
Stéphane Lesimple	8e7fc9b949	chore: perl-use-all: dynamically find required modules	5 years ago
Stéphane Lesimple	9a10ddebd9	enh: satellite scripts: better error handling	5 years ago
Stéphane Lesimple	a479810d83	feat: revamp logs ... All connections and plugin executions emit two logs, an 'open' and a 'close' log. We now add all the details of the connection to the 'close' logs, those that were previously only available in the corresponding 'open' log. This way, it is no longer required to correlate both logs with their uniqid to have all the data: the 'close' log should suffice. The 'open' log is still there if for some reason the 'close' log can't be emitted (kill -9, system crash, etc.), or if the 'open' and the 'close' log are several hours, days or months appart. An additional field "duration" has been added to the 'close' logs, this represents the number of seconds (with millisecond precision) the connection lasted. Two new fields "globalsql" and "accountsql" have been added to the 'open'-type logs. These will contain either "ok" if we successfully logged to the corresponding log database, "no" if it is disabled, or "error $aDetailedMessage" if we got an error trying to insert the row. The 'close'-type log also has the new "accountsql_close" field, but misses the "globalsql_close" field as we never update the global database on this event. On the 'close' log, we can also have the value "missing", indicating that we couldn't update the access log row in the database, as the corresponding 'open' log couldn't insert it. The "ttyrecsize" log field for the 'close'-type logs has been removed, as it was never completely implemented, and contains bogus data if ttyrec log rotation occurs. It has also been removed from the sqlite log databases. The 'open' and 'close' events are now pushed to our own log files, in addition to syslog, if logging to those files is enabled (see ``enableGlobalAccesssLog`` and ``enableAccountAccessLog``), previously the 'close' events were only pushed to syslog. The /home/osh.log is no longer used for ``enableGlobalAccessLog``, the global log is instead written to /home/logkeeper/global-log-YYYYMM.log. The global sql file, enabled with ``enableGlobalSqlLog``, is now split by year-month instead of by year, to /home/logkeeper/global-log-YYYYMM.sqlite.	5 years ago
Stéphane Lesimple	2cfde997f3	fix: realmDelete: bad sudoers configuration	5 years ago
Stéphane Lesimple	81db4b10bb	feat: realms: use remote bastion MFA validation information for local policy enforcement	5 years ago
Stéphane Lesimple	16f42221ca	feat: add LC_BASTION_DETAILS envvar	5 years ago
Stéphane Lesimple	a204313af9	feat: accountModify: add --osh-only (closes #97)	5 years ago
Stéphane Lesimple	03ad1da046	chore: perlcritic: including forgotten .inc files	5 years ago
Stéphane Lesimple	a676692fe6	chore: fix an error message	5 years ago
Stéphane Lesimple	fdb786d62c	Merge pull request #89 from ovh/dev/aleblanc/bin-helper-osh-account-delete ... fix: osh-accountDelete: fix typo	5 years ago
Stéphane Lesimple	790802e6da	fix: osh.pl: plugin_config 'disabled' key is a boolean	5 years ago
Antoine Leblanc	82f2c96ea6	fix: osh-accountDelete: fix typo ... Signed-off-by: Antoine Leblanc <antoine.leblanc@ovhcloud.com>	5 years ago
Stéphane Lesimple	e2186978da	fix: sudogen: don't check for account/groups validity too much when deleting them ... Fixes #86	5 years ago
Stéphane Lesimple	c68b696702	chore: shellcheck & perltidy	5 years ago
Stéphane Lesimple	7707b1c351	fix: osh-groupCreate: fix for centos 8.3	5 years ago
Stéphane Lesimple	457a8fae82	chore: packages-check: remove unused packages	5 years ago
Stéphane Lesimple	dca45a44c5	chore: fix latest centos 8 release, add tests for last 3 minors	5 years ago
Stéphane Lesimple	c4d2cea3b0	fix: packages-check: centos8: handle new repo names	5 years ago
Stéphane Lesimple	8276f3878d	Merge pull request #76 from ovh/fixsudoers ... fix: sudogen: handle '.' and OS-specific templates correctly	5 years ago
thibault.dewailly	1e32cfde7d	osh-encrypt-rsync: Remove logfile as mandatory parameter	5 years ago
Stéphane Lesimple	50c016be10	fix: sudogen: properly handle accounts & groups containing '.'	5 years ago
Stéphane Lesimple	526a5d0389	fix: sudogen: proper detection of OS-specific templates	5 years ago
Thomas Soëte	9647ae9cdb	fix: Fix 'selfAddPersonalAccess' helptext	5 years ago
Stéphane Lesimple	4cb09a9570	nh: remove hardcoded .ssh/authorized_keys2 everywhere	5 years ago
Stéphane Lesimple	71cd9a46df	Merge branch 'master' into autocompletion	5 years ago
Stéphane Lesimple	9fb6b8d444	enh: accountCreate: handle --uid-auto in autocompletion rules	5 years ago
Thomas SOËTE	ef531308d5	enh: doc: add from parameter as it is mandatory	5 years ago
Stéphane Lesimple	f07e00b1e9	Merge branch 'master' into adminSudo	5 years ago
Stéphane Lesimple	e2a64a9d8f	enh: adminSudo: better autocompletion rules	5 years ago
Thomas SOËTE	2a51a78b54	fix: Enable perl-tidy.sh test ... * Move to ubuntu-20.04 runner * Remove check in dockers tests	5 years ago
Stéphane Lesimple	d0e7e9046b	enh: httpproxy: add informational headers to the egress side request	5 years ago
Stéphane Lesimple	15cad00c27	fix: osh.pl: validate user and host format	5 years ago
Stéphane Lesimple	396e0d2d32	Merge branch 'master' into backupfix	6 years ago
Stéphane Lesimple	5d3de83e50	fix: osh-encrypt-rsync.pl: allow more broad chars to avoid letting weird-named files behind	6 years ago
Stéphane Lesimple	e907532447	fix: osh-backup-acl-keys.sh: don't exclude .gpg, or we'll miss /root/.gnupg/secring.gpg	6 years ago