ovh / the-bastion Goto Github PK

---bastion02----------------------------------------------the-bastion-3.01.01---
=> delete an existing bastion group
--------------------------------------------------------------------------------
~ !!!! WARNING !!!! WARNING !!!! WARNING !!!! WARNING !!!! WARNING !!!!
~ !!!! WARNING !!!! WARNING !!!! WARNING !!!! WARNING !!!! WARNING !!!!
~ !!!! WARNING !!!! WARNING !!!! WARNING !!!! WARNING !!!! WARNING !!!!
~
~ You are about to DELETE a bastion group, to be sure you're not drunk, ~ please type the name of the group you want to delete (won't be echoed):
~
~ Removing /home/allowkeeper/surname.givename/allowed.ip.sbw-rs-servers...
~ Found 1 members, removing them from the group ~ ... removing surname.givename from group keysbw-rs-servers-owner ~ Deleting group keysbw-rs-servers-owner...
~ Found 1 members, removing them from the group ~ ... removing surname.givename from group keysbw-rs-servers-aclkeeper ~ Deleting group keysbw-rs-servers-aclkeeper...
~ Found 1 members, removing them from the group ~ ... removing surname.givename from group keysbw-rs-servers-gatekeeper ~ Deleting group keysbw-rs-servers-gatekeeper...
~ Found 2 members, removing them from the group ~ ... removing allowkeeper from group keysbw-rs-servers ~ ... removing surname.givename from group keysbw-rs-servers ~ Deleting main user of group keysbw-rs-servers...
*** Deleting group 'keysbw-rs-servers' sudoers file `-> [ERR.] keysbw-rs-servers doesn't seem to be a valid bastion group

function bls() {
    ssh -i ~/.ssh/key -t user@bastion -- --osh selfListAccesses | grep $1
}

Usage :
bls nameofserver

administrator@bastionhost01(master)> accountCreate --account test.test2 --uid-auto
---bs-server----------------------------------------------the-bastion-3.01.00---
=> create a new bastion account
--------------------------------------------------------------------------------
~ Please paste the SSH key you want to add. This bastion supports the following algorithms:
~ ED25519: strongness[#####] speed[#####], use `ssh-keygen -t ed25519' to generate one
~ ECDSA  : strongness[####.] speed[#####], use `ssh-keygen -t ecdsa -b 521' to generate one
~ RSA    : strongness[###..] speed[#....], use `ssh-keygen -t rsa -b 4096' to generate one
~
~ In any case, don't save it without a passphrase (your paste won't be echoed).
~ Creating group test.test2 with GID 99994...
~ Creating user test.test2 with UID 99994...
~ Creating tty group of account...

~ Group name contains invalid characters

# MFAPasswordMaxDays (int >= 0)
#    DESC: For the PAM UNIX password MFA, sets the maximum amount of days after which the password must be changed (see `chage -M')
# DEFAULT: 90
"MFAPasswordMaxDays": 90,
#
# MFAPasswordMaxDays (int >= 0)
#    DESC: For the PAM UNIX password MFA, sets the number of days before expiration on which the user will be warned to change his password (see `chage -W')
# DEFAULT: 15
"MFAPasswordMaxDays": 15,

jonathanmarsaud@bssh(slave)> groupInfo --group keylogy
---<redacted>--------------------------------------------the-bastion-3.03.01---
=> group info
--------------------------------------------------------------------------------
~ Group logy's Owners are: <redacted>
~ Group logy's GateKeepers (managing the members/guests list) are: <redacted>
~ Group logy's ACLKeepers (managing the group servers list) are: <redacted>
~ Group logy's Members (with access to ALL the group servers) are: <redacted>
~ Group logy's Guests (with access to SOME of the group servers) are: -
~  
~ The public key of this group is:
~  
~ fingerprint: <redacted>
~ keyline follows, please copy the *whole* line:
from="<redacted>" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBQoSC81Q5s92Ysi/VTou2GFNyv0jmK5ctq9d427YzYN logy@bssh:1619685770

 ssh bastion@xxxxxxxx
~ Welcome to bastion.xxxxx.xxxx , xxxx, your last login was 00:00:08 ago (Tue 2021-01-19 04:20:43 UTC) from xxxxxxx)

185.144.208.251:39982 => [email protected]:22 => [email protected]:22 ...
 allowed ... log on(/home/qxmips/ttyrec/xxxxxx/2021-01-19.04-20-51.656242.c4d5847cbfe2.qxmips.bastion.1xxxxxxx.ttyrec)

 will try the following accesses you have:
  - group-member of vyos_infra with RSA-4096 key SHA256:xxxxxxxxxxxxxxxxxxxxx
  - [2021/01/14]

Connecting...
Usage: ttyrec [options] -- <command> [command options]

Usage (legacy compatibility mode): ttyrec -e <command> [options] [ttyrec file name]

Options:
  -z, --uuid UUID           specify an UUID (can be any string) that will appear in the ttyrec output file names,
                              and kept with SIGUSR1 rotations (default: own PID)
  -f, --output FILE         full path of the first ttyrec file to write to (autogenerated if omitted)
  -d, --dir FOLDER          folder where to write the ttyrec files (taken from -f if omitted,
                              defaulting to working directory if both -f and -d are omitted)
  -F, --name-format FMT     custom strftime-compatible format string to qualify the full path of the output files,
                              including the SIGUSR1 rotated ones
  -a, --append              open the ttyrec output file in append mode instead of write-clobber mode
  -Z                        enable on-the-fly compression if available, silently fallback to no compression if not
      --zstd                force on-the-fly compression of output file using zstd,
                              the resulting file will have a '.ttyrec.zst' extension
      --max-flush-time S    specify the maximum number of seconds after which we'll force zstd to flush its output buffers
                              to ensure that even somewhat quiet sessions gets regularly written out to disk, default is 15
  -l, --level LEVEL         set compression level, must be between 1 and 19 for zstd, default is 3
  -n, --count-bytes         count the number of bytes out and print it on termination (experimental)
  -t, --lock-timeout S      lock session on input timeout after S seconds
      --warn-before-lock S  warn S seconds before locking (see --lock-timeout)
  -k, --kill-timeout S      kill session on input timeout after S seconds
      --warn-before-kill S  warn S seconds before killing (see --kill-timeout)
  -C, --no-cheatcodes       disable cheat-codes (see below), this is the default
  -c, --cheatcodes          enable cheat-codes (see below)
  -p, --no-openpty          don't use openpty() even when it's available
  -T, --term MODE           MODE can be either 'never' (never allocate a pseudotty, even if stdin is a tty, and use pipes to
                              handle stdout/stderr instead), 'always' (always allocate a pseudotty, even if stdin is not a tty)
                              or 'auto' (default, allocate a pseudotty if stdin is a tty, uses pipes otherwise)
  -v, --verbose             verbose (debug) mode, use twice for more verbosity
  -V, --version             show version information
  -e, --shell-cmd CMD       enables legacy compatibility mode and specifies the command to be run under the user's $SHELL -c

Examples:
  Run some shell commands in legacy mode: ttyrec -e 'for i in a b c; do echo $i; done' outfile.ttyrec
  Run some shell commands in normal mode: ttyrec -f /tmp/normal.ttyrec -- sh -c 'for i in a b c; do echo $i; done'
  Connect to a remote machine interactively: ttyrec -t 60 -k 300 -- ssh remoteserver
  Execute a local script remotely with the default remote shell: ttyrec -- ssh remoteserver < script.sh
  Record a screen session: ttyrec screen

Handled signals:
  SIGUSR1     close current ttyrec file and reopen a new one (log rotation)
  SIGURG      lock session
  SIGUSR2     unlock session

Cheat-codes (magic keystrokes combinations):
  ^L^L^L^L^L^L^L^L   lock your session (that's 8 CTRL+L's)
  ^K^I^L^L^K^I^L^L   kill your session

Remark about session lock and session kill:
  If we don't have a tty, we can't lock, so -t will be ignored,
  whereas -k will be applied without warning, as there's no tty to output a warning to.
You specified --warn-before-kill without enabling --timeout-kill, this doesn't make sense

Bad or empty command

-i
-- -i
ssh root@someserver
info
-i info

~ Unable to resolve host '<ipv6_address>' (IP <ipv6_address> version is not allowed)

---bastion--------------------------------------the-bastion-3.00.01---
=> launching a bastion command or connection, impersonating another user
--------------------------------------------------------------------------------
~ ADMIN SUDO: admin, you'll now impersonate user, this has been logged.
---bastion--------------------------------------the-bastion-3.00.01---
=> replay a past session
--------------------------------------------------------------------------------
~       ID: 3c5135b19531
~  Started: 2020/11/13 12:57:41
~    Ended: 2020/11/13 12:57:58
~ Duration: 0d+00:00:16.600744
~     Type: ssh
~     From: 10.254.254.103:50462 (10.254.254.103)
~      Via: [email protected]:22
~       To: [email protected]:22 (10.254.3.1)
~  RetCode: 0
~ 
~ Press '+' to play faster
~ Press '-' to play slower
~ Press '1' to restore normal playing speed
~ 
~ When you're ready to replay session 3c5135b19531, press ENTER.
~ Starting from the next line, the Total Recall begins. Press CTRL+C to jolt awake.

/opt/bastion/bin/admin/unlock-home.sh: line 5: /etc/bastion/luks-config.sh: No such file or directory
Not configured or badly configured (check /etc/bastion/luks-config.sh), nothing to do.
`-> [ OK ]

NAME   MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
sr0     11:0    1 1024M  0 rom  
vda    254:0    0   20G  0 disk 
|-vda1 254:1    0  476M  0 part /boot
|-vda2 254:2    0  954M  0 part /
|-vda3 254:3    0  5.6G  0 part /usr
|-vda4 254:4    0  477M  0 part [SWAP]
|-vda5 254:5    0  477M  0 part [SWAP]
|-vda6 254:6    0  954M  0 part /tmp
`-vda7 254:7    0 11.2G  0 part /var
vdb    254:16   0   10G  0 disk 
|-vdb1 254:17   0  4.7G  0 part 
`-vdb2 254:18   0  5.4G  0 part /opt

/dev/disk/by-id/dm-name-home /home ext4 defaults,errors=remount-ro,noauto,nosuid,noexec,nodev 0 0

admin@z1(master)> groupListServers --group example-infra

---bastion-a.eu-central-1a.infra.example.net---------------the-bastion-3.02.00---
=> list of servers pertaining to the group
--------------------------------------------------------------------------------
~ IP               PORT                 USER                      ACCESS-BY   ADDED-BY      ADDED-AT                                       EXPIRY?                                  COMMENT FORCED-KEY?
~ 10.15.0.0/19       22               admin      example-infra(group)  admin    2021-02-18                                             -                                        - -
~ 10.15.0.0/19    (any)           !scpupload      example-infra(group)  admin    2021-02-23                                             -                                        - -
~ 10.15.0.0/19    (any)         !scpdownload      example-infra(group)  admin    2021-02-23                                             -                                        - -
~ 3 accesses listed
----------------------------------------------------------</groupListServers>---

TASK [install_gitlab : Copy GitLab configuration file.] ********************************************************************************************************
fatal: [gitlab.eu-central-1a.infra.example.net]: FAILED! => {"msg": "failed to transfer file to /home/admin/.ansible/tmp/ansible-local-97208bouj9_e6/tmppti5h9zm/gitlab.rb.j2 \u001b[?47l/home/admin/.ansible/tmp/ansible-tmp-1614071537.5889418-97310-161362758918463/source:\n\n>>>Sorry, but even if you have ssh access to [email protected]:22, you still need to be granted specifically for scp\n\\033[31;1m~ Sorry, but even if you have ssh access to [email protected]:22, you still need to be granted specifically for scp\\033[0m\n"}

TASK [install_gitlab : Copy GitLab configuration file.] ********************************************************************************************************
ok: [gitlab.eu-central-1a.infra.example.net]

poweruser@zbst-rbeuque(master)> groupListServers --group foo
---zbst-rbeuque--------------------------------the-bastion-2.99.99-rc9.4-ovh1---
=> list of servers pertaining to the group
--------------------------------------------------------------------------------
~ IP               PORT                 USER                      ACCESS-BY   ADDED-BY      ADDED-AT                                       EXPIRY?                                  COMMENT FORCED-KEY?                                                                                                                                                            
~ 127.0.0.1          22                  ovh                     foo(group)  poweruser    2020-10-26                                             -                                        - -                                                                                                                                                                      
~ 127.0.0.2          22                  ovh                     foo(group)  poweruser    2020-10-26                                             -                             test comment -                                                                                                                                                                      
~ 127.0.0.3          22                  ovh                     foo(group)  poweruser    2020-10-26                                             -                        test foo comment -                                                                                                                                                                      
~ 127.0.0.4          22                  ovh                     foo(group)  poweruser    2020-10-26                                             -                                        - -                                                                                                                                                                      
~ 4 accesses listed

user@zbst-rbeuque(master)> selfListAccesses
---zbst-rbeuque--------------------------------the-bastion-2.99.99-rc9.4-ovh1---
=> your access list
--------------------------------------------------------------------------------
~ Dear robot-framework, you have access to the following servers:
~ IP               PORT                 USER                      ACCESS-BY   ADDED-BY      ADDED-AT                                       EXPIRY?                                  COMMENT FORCED-KEY?                                                                                                                                                            
~ 127.0.0.1          22                  ovh               foo(group-guest)  poweruser    2020-10-26                                             -                                        - -                                                                                                                                                                      
~ 127.0.0.4          22                  ovh               foo(group-guest)  poweruser    2020-10-26                                             -                                        - -                                                                                                                                                                      
~ 3 accesses listed
----------------------------------------------------------</selfListAccesses>---

---bs-server----------------------------------------------the-bastion-3.01.00---
----------------------------------------------------------------------</help>---
administrator@bastionhost01(master)> adminSudo -- --sudo-as

~ Create a new bastion account
~
~ Usage: --osh accountCreate --account ACCOUNT [OPTIONS]
~
~   --account NAME          Account name to create, NAME must contain only valid UNIX account name characters
~   --uid UID               Account system UID, also see --uid-auto
~   --uid-auto              Auto-select an UID from the allowed range (the upper available one will be used)
~   --always-active         This account's activation won't be challenged on connection, even if the bastion is globally
~                             configured to check for account activation
~   --osh-only              This account will only be able to use ``--osh`` commands, and can't connect anywhere through the bastion
~   --immutable-key         Deny any subsequent modification of the account key (selfAddKey and selfDelKey are denied)
~   --comment '"STRING"'    An optional comment when creating the account. Quote it twice as shown if you're under a shell.
~   --public-key '"KEY"'    Account public SSH key to deposit on the bastion, if not present,
~                             you'll be prompted interactively for it. Quote it twice as shown if your're under a shell.
~   --no-key                Don't prompt for an SSH key, no ingress public key will be installed
~   --ttl SECONDS|DURATION  Time after which the account will be deactivated (amount of seconds, or duration string such as "4d12h15m")
~ Missing mandatory parameter 'account' or ('uid' or 'uid-auto')

tsoete@<REDACTED>(slave)> accountModify --account tsoete --pam-auth-bypass yes
---<REDACTED>------------------the-bastion-2.99.99-rc9.4-ovh1---
=> modify the configuration of an account
--------------------------------------------------------------------------------
~ Bypassing sshd PAM auth usage for this account...
~ ... done, this account will no longer use PAM for authentication

-------------------------------------------------------------</accountModify>---
~ IMPORTANT: You have been added to new groups since the session started.
~ You'll need to logout/login again from this interactive session to have
~ your new rights applied, or you'll get sudo errors if you try to use them.