From 245a815267928096ea18d9d49cd395b87a7af175 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 24 Jan 2013 23:40:05 +0100 Subject: services: minimal services.txt-over-ssh provider (twisted) --- services/Makefile | 14 ++++++ services/authorized_keys | 1 + services/checkers.py | 25 +++++++++++ services/services.txt | 2 + services/test.py | 108 +++++++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 150 insertions(+) create mode 100644 services/Makefile create mode 100644 services/authorized_keys create mode 100644 services/checkers.py create mode 100644 services/services.txt create mode 100644 services/test.py (limited to 'services') diff --git a/services/Makefile b/services/Makefile new file mode 100644 index 00000000..a68f095d --- /dev/null +++ b/services/Makefile @@ -0,0 +1,14 @@ +help:;@cat Makefile + +export authorized_keys_file := authorized_keys +export services_file := services.txt +export host_key_file := test.key + +test-client: + ssh localhost -p 1337 2>/dev/null + +test-server: + python test.py + +$(host_key_file): + ssh-keygen -t rsa -P '' -f $@ diff --git a/services/authorized_keys b/services/authorized_keys new file mode 100644 index 00000000..dcb8bfeb --- /dev/null +++ b/services/authorized_keys @@ -0,0 +1 @@ +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7YrLdnXDRU2XEdZDu1BmgiT0Vaxplf3bfvSm+5o3g4AcR2yCv7h2D633c9uA0gq52EJ3V5m8B1ZcxqA0zqDptKwx+ZTMUGDls7StH5xpJyk9j5gf8DzyDLQPQG2IYszCH+8esKjo3BOFxfey8NaX+k6gvQsG3lyV0PjLvvIy4gDuMn6dPZfVAlwNYFOUNgwpku3W3A0d+UFyVjt3/sgZxM+8C3y6QE1gwT5/NfBbHM5vaEqjHcVq1ui+7a4iOXFGKkZDcd7EX6cQZSbCzZL7sZ0OmB1WpAsDCvIXfzX1YfNA0sso7ldSF6ZUGNgwEk1LootnQlCK/dfbM+i62SZ+1 tv@iiso diff --git a/services/checkers.py b/services/checkers.py new file mode 100644 index 00000000..dbfe1323 --- /dev/null +++ b/services/checkers.py @@ -0,0 +1,25 @@ + +import base64, binascii +from twisted.python.filepath import FilePath +from twisted.conch.checkers import SSHPublicKeyDatabase + + +class PublicKeyChecker(SSHPublicKeyDatabase): + + def __init__(self, filename): + self.filepath = FilePath(filename) + + def getAuthorizedKeysFiles(self, credentials): + return [self.filepath] + + def checkKey(self, credentials): + for line in self.filepath.open(): + parts = line.split() + if len(parts) < 2: + continue + try: + if base64.decodestring(parts[1]) == credentials.blob: + return True + except binascii.Error: + continue + return False diff --git a/services/services.txt b/services/services.txt new file mode 100644 index 00000000..a2b97670 --- /dev/null +++ b/services/services.txt @@ -0,0 +1,2 @@ +# this is a comment +TODO declare proper services format diff --git a/services/test.py b/services/test.py new file mode 100644 index 00000000..06340a54 --- /dev/null +++ b/services/test.py @@ -0,0 +1,108 @@ +#! /usr/bin/env python + +from os import environ as env + +authorized_keys_file = env.get('authorized_keys_file', '/dev/null') +services_file = env.get('services_file', '/dev/null') +host_key_file = env.get('host_key_file', '/dev/null') +host_key_pub_file = host_key_file + '.pub' + + +from checkers import PublicKeyChecker +from twisted.conch.avatar import ConchUser +from twisted.conch.ssh.connection import SSHConnection +from twisted.conch.ssh.factory import SSHFactory +from twisted.conch.ssh.keys import Key +from twisted.conch.ssh.session import SSHSession, ISession, wrapProtocol +from twisted.conch.ssh.userauth import SSHUserAuthServer +from twisted.cred.error import UnauthorizedLogin +from twisted.cred.portal import IRealm, Portal +from twisted.internet.protocol import Protocol +from twisted.internet.reactor import listenTCP, run +from twisted.python.components import registerAdapter +from zope.interface import implements + +from twisted.python.log import startLogging +from sys import stderr +startLogging(stderr) + + +class MyRealm: + implements(IRealm) + + def requestAvatar(self, avatarId, mind, *interfaces): + return interfaces[0], MyUser(), lambda: None + + +class MyUser(ConchUser): + def __init__(self): + ConchUser.__init__(self) + self.channelLookup.update({ 'session': SSHSession }) + + +class MySession: + + def __init__(self, avatar): + pass + + def getPty(self, term, windowSize, attrs): + pass + + def execCommand(self, proto, cmd): + raise Exception("no executing commands") + + def openShell(self, trans): + ep = MyProtocol() + ep.makeConnection(trans) + trans.makeConnection(wrapProtocol(ep)) + + def eofReceived(self): + pass + + def closed(self): + pass + + +registerAdapter(MySession, MyUser, ISession) + + +def slurpTextfile(filename): + file = open(filename, 'r') + try: + return file.read() + finally: + file.close() + +class MyProtocol(Protocol): + def connectionMade(self): + data = slurpTextfile(services_file).replace('\n', '\r\n') + self.transport.write(data) + self.transport.loseConnection() + + #def dataReceived(self, data): + # if data == '\r': + # data = '\r\n' + # elif data == '\x03': #^C + # self.transport.loseConnection() + # return + # self.transport.write(data) + + +class MyFactory(SSHFactory): + privateKeys = { + 'ssh-rsa': Key.fromFile(filename=host_key_file) + } + publicKeys = { + 'ssh-rsa': Key.fromFile(filename=host_key_pub_file) + } + services = { + 'ssh-userauth': SSHUserAuthServer, + 'ssh-connection': SSHConnection + } + +if __name__ == '__main__': + portal = Portal(MyRealm()) + portal.registerChecker(PublicKeyChecker(authorized_keys_file)) + MyFactory.portal = portal + listenTCP(1337, MyFactory()) + run() -- cgit v1.2.3 From 1025fa3e19d2678da41a13c2bce0846a661c0624 Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 29 Jan 2013 11:58:13 +0000 Subject: add authorized_keys config for openssh-server --- services/Makefile | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) (limited to 'services') diff --git a/services/Makefile b/services/Makefile index a68f095d..901769b8 100644 --- a/services/Makefile +++ b/services/Makefile @@ -1,9 +1,29 @@ help:;@cat Makefile - export authorized_keys_file := authorized_keys export services_file := services.txt export host_key_file := test.key +export services_home := /opt/services + +.PHONY: authorized_keys +$(services_home)/.ssh: + mkdir $@ + chown services:services $@ + +$(services_home)/.ssh/authorized_keys: $(services_home)/.ssh $(authorized_keys_file) + cp $(authorized_keys_file) $(services_home)/.ssh/authorized_keys + @echo "restricting authorized_keys..." + @sed -i 's#^#command="/bin/cat $(services_home)/services.txt",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty #' $(services_home)/.ssh/authorized_keys + +$(services_home)/services.txt: + @echo 'make sure to configure the services correctly in $(services_home)/services.txt' + cp $(services_file) $(services_home)/services.txt + +service-user: $(services_home)/services.txt $(services_home)/.ssh/authorized_keys + @echo 'also make sure that the user is created: make create-service-user' +create-service-user: + useradd -m -r -l -f -1 -d /opt/services services + test-client: ssh localhost -p 1337 2>/dev/null -- cgit v1.2.3 From 965b2bce7b66605df16fdaf70b4da1f78ebae546 Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 29 Jan 2013 14:24:23 +0000 Subject: add pigstarter to authorized_keys --- services/authorized_keys | 1 + 1 file changed, 1 insertion(+) (limited to 'services') diff --git a/services/authorized_keys b/services/authorized_keys index dcb8bfeb..a7368693 100644 --- a/services/authorized_keys +++ b/services/authorized_keys @@ -1 +1,2 @@ ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7YrLdnXDRU2XEdZDu1BmgiT0Vaxplf3bfvSm+5o3g4AcR2yCv7h2D633c9uA0gq52EJ3V5m8B1ZcxqA0zqDptKwx+ZTMUGDls7StH5xpJyk9j5gf8DzyDLQPQG2IYszCH+8esKjo3BOFxfey8NaX+k6gvQsG3lyV0PjLvvIy4gDuMn6dPZfVAlwNYFOUNgwpku3W3A0d+UFyVjt3/sgZxM+8C3y6QE1gwT5/NfBbHM5vaEqjHcVq1ui+7a4iOXFGKkZDcd7EX6cQZSbCzZL7sZ0OmB1WpAsDCvIXfzX1YfNA0sso7ldSF6ZUGNgwEk1LootnQlCK/dfbM+i62SZ+1 tv@iiso +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCv9TTt4FkzT3jlQ0VS2tX/GpQO9Ef0wIQ+g96foe4qSniBwR667T1gIhURrod/p7N9oQcWRrNohjgmSBZRYA0kW6ZyqYJkLvRv54nXv6j/8Xq2nG/KVfDqL0kp8if+JGeFlQElpWJiAbGifYkopFy69QiLYU2ndR7aPbx+5qm/dcwPJ7K+n6dyePynCZadtcabm3PuBFUxGLdT9ImDXMOPfXxPMlN/3eb78byuEuHnhCIvIGLMBGx+8QTXvu7kHpZObvkbsF1xjVs9fDpwVLjh7GWdwf3BZ/agFlI24ffyqCPFnuaxUVyfUZeqf4twRsIZkTTB47lHDhYiVkyGe8gd root@pigstarter.de -- cgit v1.2.3 From 60f353a64ac890c35a327c9c2cbcbe0b7b2bc87c Mon Sep 17 00:00:00 2001 From: root Date: Tue, 29 Jan 2013 16:39:23 +0100 Subject: Add sammy@muhbaasu pubkey --- services/authorized_keys | 2 ++ 1 file changed, 2 insertions(+) (limited to 'services') diff --git a/services/authorized_keys b/services/authorized_keys index a7368693..e7298315 100644 --- a/services/authorized_keys +++ b/services/authorized_keys @@ -1,2 +1,4 @@ ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7YrLdnXDRU2XEdZDu1BmgiT0Vaxplf3bfvSm+5o3g4AcR2yCv7h2D633c9uA0gq52EJ3V5m8B1ZcxqA0zqDptKwx+ZTMUGDls7StH5xpJyk9j5gf8DzyDLQPQG2IYszCH+8esKjo3BOFxfey8NaX+k6gvQsG3lyV0PjLvvIy4gDuMn6dPZfVAlwNYFOUNgwpku3W3A0d+UFyVjt3/sgZxM+8C3y6QE1gwT5/NfBbHM5vaEqjHcVq1ui+7a4iOXFGKkZDcd7EX6cQZSbCzZL7sZ0OmB1WpAsDCvIXfzX1YfNA0sso7ldSF6ZUGNgwEk1LootnQlCK/dfbM+i62SZ+1 tv@iiso ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCv9TTt4FkzT3jlQ0VS2tX/GpQO9Ef0wIQ+g96foe4qSniBwR667T1gIhURrod/p7N9oQcWRrNohjgmSBZRYA0kW6ZyqYJkLvRv54nXv6j/8Xq2nG/KVfDqL0kp8if+JGeFlQElpWJiAbGifYkopFy69QiLYU2ndR7aPbx+5qm/dcwPJ7K+n6dyePynCZadtcabm3PuBFUxGLdT9ImDXMOPfXxPMlN/3eb78byuEuHnhCIvIGLMBGx+8QTXvu7kHpZObvkbsF1xjVs9fDpwVLjh7GWdwf3BZ/agFlI24ffyqCPFnuaxUVyfUZeqf4twRsIZkTTB47lHDhYiVkyGe8gd root@pigstarter.de +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7df1RfMGNHPJe0iF6rD9DBs/4VujN6nNr7RbRCFk7HF/JzLXSn9Vcwk+3JefP4/d/bUo0h03rhQaRohDhBScrJidj2YacF6gmZOuTf3AMWprdz9D/1dDkN/ytwzGhADhqbHEWeomIllsa8Up4PvEeDcIHJGzYvuc0BbGqRk0XgxwqIrLAhdpTfEKaTbt7IzmUqEofxThTZ/4k020PKn2WDBWKQYGZJ9Ba2WzlKUXWx842ncW29oxC2faRz4M3eMPy0JMpBLkK9U3dccE75dgT/89/4ofVjM7+J3FOP3dgXzrtk+A5aN5a/veJUViQ9xdGxXvoa++iCr5q/BVRv0Bb sammy@muhbaasu.de + -- cgit v1.2.3 From 77501543d0f9aa94dcc9a814f420c43e07f09611 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 29 Jan 2013 16:42:41 +0100 Subject: //services/bin/services: initial commit --- services/bin/services | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100755 services/bin/services (limited to 'services') diff --git a/services/bin/services b/services/bin/services new file mode 100755 index 00000000..90d3f624 --- /dev/null +++ b/services/bin/services @@ -0,0 +1,18 @@ +#! /bin/sh +# usage: services [user@]hostname[:port] +set -euf + +user=services +hostname=${1-localhost} +port=1337 + +if echo $hostname | grep -q @; then + user=`echo $hostname | cut -d@ -f1` + hostname=`echo $hostname | cut -d@ -f2` +fi +if echo $hostname | grep -q :; then + port=`echo $hostname | cut -d: -f2` + hostname=`echo $hostname | cut -d: -f1` +fi + +ssh $user@$hostname -p $port -- cgit v1.2.3 From f9a3b1b51a469ca56f9d573832ae50c7c3e38bd6 Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 29 Jan 2013 15:47:26 +0000 Subject: fix useradd issues --- services/Makefile | 14 +++++++++----- services/authorized_keys | 1 + 2 files changed, 10 insertions(+), 5 deletions(-) (limited to 'services') diff --git a/services/Makefile b/services/Makefile index 901769b8..3ef670a3 100644 --- a/services/Makefile +++ b/services/Makefile @@ -5,6 +5,15 @@ export host_key_file := test.key export services_home := /opt/services .PHONY: authorized_keys + +service-user: $(services_home)/services.txt $(services_home)/.ssh/authorized_keys + @echo 'also make sure that the user is created: make create-service-user' + +create-service-user: + mkdir -p $(services_home) + rmdir $(services_home) + useradd -m -r -l -f -1 -d $(services_home) services + $(services_home)/.ssh: mkdir $@ chown services:services $@ @@ -18,11 +27,6 @@ $(services_home)/services.txt: @echo 'make sure to configure the services correctly in $(services_home)/services.txt' cp $(services_file) $(services_home)/services.txt -service-user: $(services_home)/services.txt $(services_home)/.ssh/authorized_keys - @echo 'also make sure that the user is created: make create-service-user' - -create-service-user: - useradd -m -r -l -f -1 -d /opt/services services test-client: ssh localhost -p 1337 2>/dev/null diff --git a/services/authorized_keys b/services/authorized_keys index a7368693..404f6552 100644 --- a/services/authorized_keys +++ b/services/authorized_keys @@ -1,2 +1,3 @@ ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7YrLdnXDRU2XEdZDu1BmgiT0Vaxplf3bfvSm+5o3g4AcR2yCv7h2D633c9uA0gq52EJ3V5m8B1ZcxqA0zqDptKwx+ZTMUGDls7StH5xpJyk9j5gf8DzyDLQPQG2IYszCH+8esKjo3BOFxfey8NaX+k6gvQsG3lyV0PjLvvIy4gDuMn6dPZfVAlwNYFOUNgwpku3W3A0d+UFyVjt3/sgZxM+8C3y6QE1gwT5/NfBbHM5vaEqjHcVq1ui+7a4iOXFGKkZDcd7EX6cQZSbCzZL7sZ0OmB1WpAsDCvIXfzX1YfNA0sso7ldSF6ZUGNgwEk1LootnQlCK/dfbM+i62SZ+1 tv@iiso ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCv9TTt4FkzT3jlQ0VS2tX/GpQO9Ef0wIQ+g96foe4qSniBwR667T1gIhURrod/p7N9oQcWRrNohjgmSBZRYA0kW6ZyqYJkLvRv54nXv6j/8Xq2nG/KVfDqL0kp8if+JGeFlQElpWJiAbGifYkopFy69QiLYU2ndR7aPbx+5qm/dcwPJ7K+n6dyePynCZadtcabm3PuBFUxGLdT9ImDXMOPfXxPMlN/3eb78byuEuHnhCIvIGLMBGx+8QTXvu7kHpZObvkbsF1xjVs9fDpwVLjh7GWdwf3BZ/agFlI24ffyqCPFnuaxUVyfUZeqf4twRsIZkTTB47lHDhYiVkyGe8gd root@pigstarter.de +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCl3RTOHd5DLiVeUbUr/GSiKoRWknXQnbkIf+uNiFO+XxiqZVojPlumQUVhasY8UzDzj9tSDruUKXpjut50FhIO5UFAgsBeMJyoZbgY/+R+QKU00Q19+IiUtxeFol/9dCO+F4o937MC0OpAC10LbOXN/9SYIXueYk3pJxIycXwUqhYmyEqtDdVh9Rx32LBVqlBoXRHpNGPLiswV2qNe0b5p919IGcslzf1XoUzfE3a3yjk/XbWh/59xnl4V7Oe7+iQheFxOT6rFA30WYwEygs5As//ZYtxvnn0gA02gOnXJsNjOW9irlxOUeP7IOU6Ye3WRKFRR0+7PS+w8IJLag2xb makefu@pornocauster -- cgit v1.2.3 From 2da96a69e9ab02db32cdafd194ef3e5f87ca71dc Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 29 Jan 2013 17:00:43 +0100 Subject: //services services: use $services_identity_file --- services/bin/services | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'services') diff --git a/services/bin/services b/services/bin/services index 90d3f624..c142a363 100755 --- a/services/bin/services +++ b/services/bin/services @@ -1,11 +1,17 @@ #! /bin/sh # usage: services [user@]hostname[:port] +# environment: +# services_identity_file path to ssh(1) identity_file set -euf user=services hostname=${1-localhost} port=1337 +if test -n "${services_identity_file-}"; then + options="${options+$options }-i $services_identity_file" +fi + if echo $hostname | grep -q @; then user=`echo $hostname | cut -d@ -f1` hostname=`echo $hostname | cut -d@ -f2` @@ -15,4 +21,4 @@ if echo $hostname | grep -q :; then hostname=`echo $hostname | cut -d: -f1` fi -ssh $user@$hostname -p $port +ssh $options $user@$hostname -p $port -- cgit v1.2.3 From f8d90b443fb71597b7f47fb0026861fd028ffab2 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 29 Jan 2013 17:46:19 +0000 Subject: add service template --- services/services.txt | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'services') diff --git a/services/services.txt b/services/services.txt index a2b97670..dc88cbac 100644 --- a/services/services.txt +++ b/services/services.txt @@ -1,2 +1,7 @@ -# this is a comment -TODO declare proper services format +owner: +type: +mail: +expires: +location: +services://{{hostname}}:22/ +tinc://{{hostname}}/ -- cgit v1.2.3