feat: saved SSH hosts per user, the way in sealed with AES-GCM under a server key kept beside the database
This commit is contained in:
redtea committed
1 parent
1f930e5aea
commit
94bf292494
10 files changed
+347
-7
No files matched your search
@@ -0,0 +1,215 @@
|
||||
package server
|
||||
|
||||
import (
|
||||
"crypto/aes"
|
||||
"crypto/cipher"
|
||||
"crypto/rand"
|
||||
"encoding/base64"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"net/http"
|
||||
"os"
|
||||
"strconv"
|
||||
"strings"
|
||||
"sync"
|
||||
|
||||
"github.com/x-grk/longpolling-remote-access/internal/proto"
|
||||
)
|
||||
|
||||
// Saved SSH hosts: each user keeps their own list of hosts with the way in -
|
||||
// password or key - so the SSH dialog connects with one choice. The secret is
|
||||
// sealed with AES-256-GCM under the server's key, which lives apart from the
|
||||
// database (LPRA_SECRET_KEY, or a file beside the database made on first
|
||||
// use), and bound to its owner: a row read out of the database, or moved to
|
||||
// another user, opens to nobody.
|
||||
|
||||
type savedHost struct {
|
||||
ID int64 `json:"id"`
|
||||
Label string `json:"label"`
|
||||
Host string `json:"host"`
|
||||
Port int `json:"port"`
|
||||
User string `json:"user"`
|
||||
Auth string `json:"auth"` // password, key or agent
|
||||
}
|
||||
|
||||
type sshSecret struct {
|
||||
Password string `json:"password,omitempty"`
|
||||
Key string `json:"key,omitempty"`
|
||||
Passphrase string `json:"passphrase,omitempty"`
|
||||
}
|
||||
|
||||
var (
|
||||
secretKeyOnce sync.Once
|
||||
secretKey []byte
|
||||
secretKeyErr error
|
||||
)
|
||||
|
||||
// sealKey is the server's key for saved secrets.
|
||||
func (s *Server) sealKey() ([]byte, error) {
|
||||
secretKeyOnce.Do(func() {
|
||||
if v := strings.TrimSpace(os.Getenv("LPRA_SECRET_KEY")); v != "" {
|
||||
k, err := hex.DecodeString(v)
|
||||
if err != nil || len(k) != 32 {
|
||||
k, err = base64.StdEncoding.DecodeString(v)
|
||||
}
|
||||
if err != nil || len(k) != 32 {
|
||||
secretKeyErr = errors.New("LPRA_SECRET_KEY: нужны 32 байта (hex или base64)")
|
||||
return
|
||||
}
|
||||
secretKey = k
|
||||
return
|
||||
}
|
||||
path := s.db.path + ".key"
|
||||
if b, err := os.ReadFile(path); err == nil {
|
||||
k, err := hex.DecodeString(strings.TrimSpace(string(b)))
|
||||
if err != nil || len(k) != 32 {
|
||||
secretKeyErr = errors.New(path + ": испорчен ключ")
|
||||
return
|
||||
}
|
||||
secretKey = k
|
||||
return
|
||||
}
|
||||
k := make([]byte, 32)
|
||||
_, _ = rand.Read(k)
|
||||
if err := os.WriteFile(path, []byte(hex.EncodeToString(k)+"\n"), 0o600); err != nil {
|
||||
secretKeyErr = err
|
||||
return
|
||||
}
|
||||
secretKey = k
|
||||
})
|
||||
return secretKey, secretKeyErr
|
||||
}
|
||||
|
||||
func (s *Server) seal(owner int64, plain []byte) (string, error) {
|
||||
k, err := s.sealKey()
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
blk, _ := aes.NewCipher(k)
|
||||
g, _ := cipher.NewGCM(blk)
|
||||
nonce := make([]byte, g.NonceSize())
|
||||
_, _ = rand.Read(nonce)
|
||||
out := g.Seal(nonce, nonce, plain, []byte("ssh:"+strconv.FormatInt(owner, 10)))
|
||||
return base64.StdEncoding.EncodeToString(out), nil
|
||||
}
|
||||
|
||||
func (s *Server) open(owner int64, sealed string) ([]byte, error) {
|
||||
k, err := s.sealKey()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
b, err := base64.StdEncoding.DecodeString(sealed)
|
||||
blk, _ := aes.NewCipher(k)
|
||||
g, _ := cipher.NewGCM(blk)
|
||||
if err != nil || len(b) < g.NonceSize() {
|
||||
return nil, errors.New("испорчена запись")
|
||||
}
|
||||
return g.Open(nil, b[:g.NonceSize()], b[g.NonceSize():], []byte("ssh:"+strconv.FormatInt(owner, 10)))
|
||||
}
|
||||
|
||||
func (s *Server) saveSSHHost(owner int64, h savedHost, sec sshSecret) (int64, error) {
|
||||
plain, _ := json.Marshal(sec)
|
||||
sealed, err := s.seal(owner, plain)
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
res, err := s.db.sql.Exec(`INSERT INTO ssh_hosts (admin_id, label, host, port, user, auth, secret) VALUES (?, ?, ?, ?, ?, ?, ?)`,
|
||||
owner, h.Label, h.Host, h.Port, h.User, h.Auth, sealed)
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
return res.LastInsertId()
|
||||
}
|
||||
|
||||
func (s *Server) listSSHHosts(owner int64) []savedHost {
|
||||
rows, err := s.db.sql.Query(`SELECT id, label, host, port, user, auth FROM ssh_hosts WHERE admin_id = ? ORDER BY label, host`, owner)
|
||||
list := []savedHost{}
|
||||
if err != nil {
|
||||
return list
|
||||
}
|
||||
defer rows.Close()
|
||||
for rows.Next() {
|
||||
var h savedHost
|
||||
if rows.Scan(&h.ID, &h.Label, &h.Host, &h.Port, &h.User, &h.Auth) == nil {
|
||||
list = append(list, h)
|
||||
}
|
||||
}
|
||||
return list
|
||||
}
|
||||
|
||||
// fillSaved puts the saved host t.Saved of owner - address and way in - into
|
||||
// t, which then goes on as if typed in.
|
||||
func (s *Server) fillSaved(owner int64, t *proto.SSHTarget) error {
|
||||
if t == nil || t.Saved == 0 {
|
||||
return nil
|
||||
}
|
||||
var h savedHost
|
||||
var sealed string
|
||||
err := s.db.sql.QueryRow(`SELECT host, port, user, auth, secret FROM ssh_hosts WHERE id = ? AND admin_id = ?`, t.Saved, owner).
|
||||
Scan(&h.Host, &h.Port, &h.User, &h.Auth, &sealed)
|
||||
if err != nil {
|
||||
return errors.New("сохранённый хост не найден")
|
||||
}
|
||||
plain, err := s.open(owner, sealed)
|
||||
if err != nil {
|
||||
return errors.New("сохранённый хост не расшифровался")
|
||||
}
|
||||
var sec sshSecret
|
||||
_ = json.Unmarshal(plain, &sec)
|
||||
*t = proto.SSHTarget{Host: h.Host, Port: h.Port, User: h.User, Password: sec.Password, Key: sec.Key, Passphrase: sec.Passphrase}
|
||||
return nil
|
||||
}
|
||||
|
||||
// GET /api/panel/ssh/hosts - the user's saved hosts, without secrets.
|
||||
func (s *Server) handleSSHHosts(w http.ResponseWriter, r *http.Request) {
|
||||
writeJSON(w, s.listSSHHosts(s.currentAdmin(r).ID))
|
||||
}
|
||||
|
||||
// POST /api/panel/ssh/hosts - save a host: {label, host, port, user, auth,
|
||||
// password | key, passphrase}.
|
||||
func (s *Server) handleSSHHostAdd(w http.ResponseWriter, r *http.Request) {
|
||||
var in struct {
|
||||
savedHost
|
||||
sshSecret
|
||||
}
|
||||
if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 64<<10)).Decode(&in); err != nil {
|
||||
writeJSON(w, map[string]any{"ok": false, "error": "плохой запрос"})
|
||||
return
|
||||
}
|
||||
h := in.savedHost
|
||||
h.Host, h.User, h.Label = strings.TrimSpace(h.Host), strings.TrimSpace(h.User), strings.TrimSpace(h.Label)
|
||||
if h.Port == 0 {
|
||||
h.Port = 22
|
||||
}
|
||||
if h.Host == "" || h.User == "" || h.Port < 1 || h.Port > 65535 || strings.ContainsAny(h.Host+h.User, " \t\r\n/") {
|
||||
writeJSON(w, map[string]any{"ok": false, "error": "нужны хост, порт и пользователь"})
|
||||
return
|
||||
}
|
||||
if h.Label == "" {
|
||||
h.Label = h.User + "@" + h.Host
|
||||
}
|
||||
sec := in.sshSecret
|
||||
switch h.Auth {
|
||||
case "key":
|
||||
sec.Password = ""
|
||||
case "agent":
|
||||
sec = sshSecret{}
|
||||
default:
|
||||
h.Auth = "password"
|
||||
sec.Key, sec.Passphrase = "", ""
|
||||
}
|
||||
id, err := s.saveSSHHost(s.currentAdmin(r).ID, h, sec)
|
||||
if err != nil {
|
||||
writeJSON(w, map[string]any{"ok": false, "error": err.Error()})
|
||||
return
|
||||
}
|
||||
writeJSON(w, map[string]any{"ok": true, "id": id})
|
||||
}
|
||||
|
||||
// POST /api/panel/ssh/hosts/{hid}/delete
|
||||
func (s *Server) handleSSHHostDelete(w http.ResponseWriter, r *http.Request) {
|
||||
id, _ := strconv.ParseInt(r.PathValue("hid"), 10, 64)
|
||||
_, _ = s.db.sql.Exec(`DELETE FROM ssh_hosts WHERE id = ? AND admin_id = ?`, id, s.currentAdmin(r).ID)
|
||||
writeJSON(w, map[string]any{"ok": true})
|
||||
}
|
||||
Reference in new issue
Block a user