the-bastion

Commit Graph

Author	SHA1	Message	Date
Stéphane Lesimple	70feff2c2d	enh: install: use in-place overwrite for sudoers files This fixes a race condition in sudo where it would log a log of error messages to syslog if used while we're running the install script: files around sudoers.d/ are then moved around, and it'll yell for each file it previously listed if the file no longer exists when it tries to stat() it. It also deprecates the --no-wait flag of the install script, as now the sudoers.d/ directory will always have integrity at all times. Signed-off-by: Stéphane Lesimple <stephane.lesimple+bastion@ovhcloud.com>	5 years ago
Stéphane Lesimple	1129850771	fix: global-log: directly set proper perms on file creation	5 years ago
Stéphane Lesimple	1676979913	feat: add PIV keys support and policy enforcement A new global option 'ingressRequirePIV' was added, to enable or disable a bastion-wide policy forcing everybody to use only PIV keys.	5 years ago
Stéphane Lesimple	62d6393d56	feat: add yubico-piv-checker install script	5 years ago
Stéphane Lesimple	a479810d83	feat: revamp logs All connections and plugin executions emit two logs, an 'open' and a 'close' log. We now add all the details of the connection to the 'close' logs, those that were previously only available in the corresponding 'open' log. This way, it is no longer required to correlate both logs with their uniqid to have all the data: the 'close' log should suffice. The 'open' log is still there if for some reason the 'close' log can't be emitted (kill -9, system crash, etc.), or if the 'open' and the 'close' log are several hours, days or months appart. An additional field "duration" has been added to the 'close' logs, this represents the number of seconds (with millisecond precision) the connection lasted. Two new fields "globalsql" and "accountsql" have been added to the 'open'-type logs. These will contain either "ok" if we successfully logged to the corresponding log database, "no" if it is disabled, or "error $aDetailedMessage" if we got an error trying to insert the row. The 'close'-type log also has the new "accountsql_close" field, but misses the "globalsql_close" field as we never update the global database on this event. On the 'close' log, we can also have the value "missing", indicating that we couldn't update the access log row in the database, as the corresponding 'open' log couldn't insert it. The "ttyrecsize" log field for the 'close'-type logs has been removed, as it was never completely implemented, and contains bogus data if ttyrec log rotation occurs. It has also been removed from the sqlite log databases. The 'open' and 'close' events are now pushed to our own log files, in addition to syslog, if logging to those files is enabled (see ``enableGlobalAccesssLog`` and ``enableAccountAccessLog``), previously the 'close' events were only pushed to syslog. The /home/osh.log is no longer used for ``enableGlobalAccessLog``, the global log is instead written to /home/logkeeper/global-log-YYYYMM.log. The global sql file, enabled with ``enableGlobalSqlLog``, is now split by year-month instead of by year, to /home/logkeeper/global-log-YYYYMM.sqlite.	5 years ago
Stéphane Lesimple	457a8fae82	chore: packages-check: remove unused packages	5 years ago
Stéphane Lesimple	dca45a44c5	chore: fix latest centos 8 release, add tests for last 3 minors	5 years ago
Stéphane Lesimple	c4d2cea3b0	fix: packages-check: centos8: handle new repo names	5 years ago
Stéphane Lesimple	50c016be10	fix: sudogen: properly handle accounts & groups containing '.'	5 years ago
Stéphane Lesimple	4cb09a9570	nh: remove hardcoded .ssh/authorized_keys2 everywhere	5 years ago
Thomas SOËTE	2a51a78b54	fix: Enable perl-tidy.sh test * Move to ubuntu-20.04 runner * Remove check in dockers tests	5 years ago
Stéphane Lesimple	15cad00c27	fix: osh.pl: validate user and host format	5 years ago
Stéphane Lesimple	d6be60e4a2	Merge branch 'master' into centos	6 years ago
Stéphane Lesimple	4fd24a3dbc	enh: install: freebsd: check whether acls are enabled	6 years ago
Stéphane Lesimple	231c62b581	feat: install: add SELinux module for TOTP MFA Fixes #26	6 years ago
Stéphane Lesimple	615f26af8b	enh: freebsd: use ttyrec prebuild static version	6 years ago
Stéphane Lesimple	cb02fd2a33	fixes after review	6 years ago
Stéphane Lesimple	ee81bd4070	enh: packages-check.sh: better handling of FreeBSD packagees	6 years ago
Stéphane Lesimple	7ee203aa71	enh: install-ttyrec.h: error msg for non-supported OSes	6 years ago
Stéphane Lesimple	9f1a8b925e	enh: install: better handling of non-Linux standard paths	6 years ago
Stéphane Lesimple	234dd0768a	feat: freebsd: add specific FreeBSD ssh config templates	6 years ago
Stéphane Lesimple	09bd6dffd9	fix: freebsd: add md5sum_compat() to account for systems where md5sum's binary name is gmd5sum	6 years ago
Stéphane Lesimple	4105c10193	fix: freebsd: replace 'root' by '0' so that it works even if uid0's name is not root	6 years ago
Stéphane Lesimple	418dc3a332	feat: add more archs to dockerhub sandbox	6 years ago
Stéphane Lesimple	cfef70daef	chore: install-ttyrec.sh: adapt for multiarch	6 years ago
Stéphane Lesimple	5c72c92bdd	chore: fix typos everywhere	6 years ago
Stéphane Lesimple	619000fa84	enh: install-ttyrec.sh replaces build-and-install-ttyrec.sh No longer build ttyrec inplace, either download and install the Debian/RPM package, or install the prebuild static binaries. Modify the Dockerfiles accordingly.	6 years ago
Stéphane Lesimple	202790367d	enh: packages-check.sh: add qrencode-libs for rhel/centos This enables direct printing of the qrcode on the terminal for TOTP enrollment	6 years ago
Thomas Soëte	9a23c1ce6a	Add missing dev package Install shellcheck too Signed-off-by: Thomas SOËTE <github@alkorin.fr>	6 years ago
Stéphane Lesimple	e453377245	chore: add some documentation and fix a few comments	6 years ago
Thomas Soëte	e766a54a35	Enhance osh-sync-watcher logs With server name and step number	6 years ago
Stéphane Lesimple	fde20136ef	Initial commit	6 years ago

32 Commits (70feff2c2d57696ea9b4e3741f721fac6ebf3be3)