731 lines
29 KiB
Python
731 lines
29 KiB
Python
|
"""SSH / SSHD Configuration Manager routes."""
|
||
|
|
|
||
|
|
import logging
|
||
|
|
import os
|
||
|
|
import re
|
||
|
|
import tempfile
|
||
|
|
import time
|
||
|
|
|
||
|
|
from flask import Blueprint, render_template, request, jsonify
|
||
|
|
from web.auth import login_required
|
||
|
|
from core.daemon import root_exec
|
||
|
|
|
||
|
|
log = logging.getLogger(__name__)
|
||
|
|
|
||
|
|
ssh_manager_bp = Blueprint('ssh_manager', __name__, url_prefix='/ssh')
|
||
|
|
|
||
|
|
# ─── Helpers ─────────────────────────────────────────────────────────────────
|
||
|
|
|
||
|
|
def _parse_sshd_config(text: str) -> dict:
|
||
|
|
"""Parse sshd_config text into a dict of {directive: value} pairs.
|
||
|
|
|
||
|
|
Handles comments, blank lines, and Match blocks (flattened).
|
||
|
|
For repeated directives only the first occurrence is kept (sshd semantics).
|
||
|
|
"""
|
||
|
|
result = {}
|
||
|
|
for line in text.splitlines():
|
||
|
|
stripped = line.strip()
|
||
|
|
if not stripped or stripped.startswith('#'):
|
||
|
|
continue
|
||
|
|
parts = stripped.split(None, 1)
|
||
|
|
if len(parts) == 2:
|
||
|
|
key, value = parts
|
||
|
|
elif len(parts) == 1:
|
||
|
|
key, value = parts[0], ''
|
||
|
|
else:
|
||
|
|
continue
|
||
|
|
# sshd uses first-match semantics; keep only the first occurrence
|
||
|
|
if key not in result:
|
||
|
|
result[key] = value
|
||
|
|
return result
|
||
|
|
|
||
|
|
|
||
|
|
# ─── Routes ──────────────────────────────────────────────────────────────────
|
||
|
|
|
||
|
|
@ssh_manager_bp.route('/')
|
||
|
|
@login_required
|
||
|
|
def index():
|
||
|
|
"""Render the SSH manager page."""
|
||
|
|
return render_template('ssh_manager.html')
|
||
|
|
|
||
|
|
|
||
|
|
# ── Status ───────────────────────────────────────────────────────────────────
|
||
|
|
|
||
|
|
@ssh_manager_bp.route('/status', methods=['GET'])
|
||
|
|
@login_required
|
||
|
|
def status():
|
||
|
|
"""Return JSON with SSH service status."""
|
||
|
|
# Check active state — try sshd first, then ssh
|
||
|
|
active_result = root_exec('systemctl is-active sshd', timeout=10)
|
||
|
|
if active_result.get('code', 1) != 0:
|
||
|
|
active_result = root_exec('systemctl is-active ssh', timeout=10)
|
||
|
|
active = active_result.get('stdout', '').strip()
|
||
|
|
|
||
|
|
# Enabled state
|
||
|
|
enabled_result = root_exec('systemctl is-enabled sshd', timeout=10)
|
||
|
|
if enabled_result.get('code', 1) != 0:
|
||
|
|
enabled_result = root_exec('systemctl is-enabled ssh', timeout=10)
|
||
|
|
enabled = enabled_result.get('stdout', '').strip()
|
||
|
|
|
||
|
|
# Config exists
|
||
|
|
config_exists = os.path.isfile('/etc/ssh/sshd_config')
|
||
|
|
|
||
|
|
# Version — sshd -V prints to stderr on OpenSSH
|
||
|
|
ver_result = root_exec('sshd -V', timeout=10)
|
||
|
|
version = (ver_result.get('stderr', '') + ver_result.get('stdout', '')).strip()
|
||
|
|
# Often the first meaningful line is all we need
|
||
|
|
if version:
|
||
|
|
version = version.splitlines()[0]
|
||
|
|
|
||
|
|
return jsonify({
|
||
|
|
'ok': True,
|
||
|
|
'active': active,
|
||
|
|
'enabled': enabled,
|
||
|
|
'config_exists': config_exists,
|
||
|
|
'version': version,
|
||
|
|
})
|
||
|
|
|
||
|
|
|
||
|
|
# ── Security Scan ────────────────────────────────────────────────────────────
|
||
|
|
|
||
|
|
@ssh_manager_bp.route('/scan', methods=['POST'])
|
||
|
|
@login_required
|
||
|
|
def scan():
|
||
|
|
"""Security scan of sshd_config."""
|
||
|
|
result = root_exec('cat /etc/ssh/sshd_config', timeout=10)
|
||
|
|
if not result.get('ok'):
|
||
|
|
return jsonify({'ok': False, 'error': 'Failed to read sshd_config: ' + result.get('stderr', '')}), 500
|
||
|
|
|
||
|
|
cfg = _parse_sshd_config(result['stdout'])
|
||
|
|
checks = []
|
||
|
|
|
||
|
|
def _add(name, severity, current, recommended, description, status='fail'):
|
||
|
|
checks.append({
|
||
|
|
'name': name,
|
||
|
|
'status': status,
|
||
|
|
'severity': severity,
|
||
|
|
'current_value': current,
|
||
|
|
'recommended': recommended,
|
||
|
|
'description': description,
|
||
|
|
})
|
||
|
|
|
||
|
|
# PermitRootLogin
|
||
|
|
val = cfg.get('PermitRootLogin', 'prohibit-password')
|
||
|
|
if val.lower() == 'yes':
|
||
|
|
_add('PermitRootLogin', 'CRITICAL', val, 'no', 'Root login with password is enabled — extremely dangerous.')
|
||
|
|
else:
|
||
|
|
_add('PermitRootLogin', 'CRITICAL', val, 'no', 'Root login is restricted.', 'pass')
|
||
|
|
|
||
|
|
# PasswordAuthentication
|
||
|
|
val = cfg.get('PasswordAuthentication', 'yes')
|
||
|
|
if val.lower() == 'yes':
|
||
|
|
_add('PasswordAuthentication', 'WARNING', val, 'no', 'Password authentication is enabled — prefer SSH keys.')
|
||
|
|
else:
|
||
|
|
_add('PasswordAuthentication', 'WARNING', val, 'no', 'Password authentication is disabled.', 'pass')
|
||
|
|
|
||
|
|
# PermitEmptyPasswords
|
||
|
|
val = cfg.get('PermitEmptyPasswords', 'no')
|
||
|
|
if val.lower() == 'yes':
|
||
|
|
_add('PermitEmptyPasswords', 'CRITICAL', val, 'no', 'Empty passwords are permitted — critical risk.')
|
||
|
|
else:
|
||
|
|
_add('PermitEmptyPasswords', 'CRITICAL', val, 'no', 'Empty passwords are not permitted.', 'pass')
|
||
|
|
|
||
|
|
# X11Forwarding
|
||
|
|
val = cfg.get('X11Forwarding', 'no')
|
||
|
|
if val.lower() == 'yes':
|
||
|
|
_add('X11Forwarding', 'LOW', val, 'no', 'X11 forwarding is enabled — consider disabling if not needed.')
|
||
|
|
else:
|
||
|
|
_add('X11Forwarding', 'LOW', val, 'no', 'X11 forwarding is disabled.', 'pass')
|
||
|
|
|
||
|
|
# Port
|
||
|
|
val = cfg.get('Port', '22')
|
||
|
|
if val == '22':
|
||
|
|
_add('Port', 'INFO', val, 'non-default', 'SSH is running on the default port — consider changing to reduce automated attacks.', 'info')
|
||
|
|
else:
|
||
|
|
_add('Port', 'INFO', val, 'non-default', 'SSH is running on a non-default port.', 'pass')
|
||
|
|
|
||
|
|
# Protocol
|
||
|
|
val = cfg.get('Protocol', '')
|
||
|
|
if val == '1':
|
||
|
|
_add('Protocol', 'CRITICAL', val, '2', 'SSHv1 is enabled — it has known vulnerabilities.')
|
||
|
|
elif val:
|
||
|
|
_add('Protocol', 'CRITICAL', val, '2', 'Protocol version is set.', 'pass')
|
||
|
|
|
||
|
|
# MaxAuthTries
|
||
|
|
val = cfg.get('MaxAuthTries', '6')
|
||
|
|
try:
|
||
|
|
if int(val) > 6:
|
||
|
|
_add('MaxAuthTries', 'WARNING', val, '3-6', 'MaxAuthTries is high — allows excessive brute-force attempts.')
|
||
|
|
else:
|
||
|
|
_add('MaxAuthTries', 'WARNING', val, '3-6', 'MaxAuthTries is within acceptable range.', 'pass')
|
||
|
|
except ValueError:
|
||
|
|
_add('MaxAuthTries', 'WARNING', val, '3-6', 'Could not parse MaxAuthTries value.')
|
||
|
|
|
||
|
|
# LoginGraceTime
|
||
|
|
val = cfg.get('LoginGraceTime', '120')
|
||
|
|
try:
|
||
|
|
numeric = int(val.rstrip('smSM'))
|
||
|
|
if numeric > 120:
|
||
|
|
_add('LoginGraceTime', 'WARNING', val, '60-120', 'LoginGraceTime is too long — connections can linger.')
|
||
|
|
else:
|
||
|
|
_add('LoginGraceTime', 'WARNING', val, '60-120', 'LoginGraceTime is acceptable.', 'pass')
|
||
|
|
except ValueError:
|
||
|
|
_add('LoginGraceTime', 'WARNING', val, '60-120', 'Could not parse LoginGraceTime value.')
|
||
|
|
|
||
|
|
# UsePAM
|
||
|
|
val = cfg.get('UsePAM', 'yes')
|
||
|
|
if val.lower() == 'no':
|
||
|
|
_add('UsePAM', 'WARNING', val, 'yes', 'PAM is disabled — may break system authentication features.')
|
||
|
|
else:
|
||
|
|
_add('UsePAM', 'WARNING', val, 'yes', 'PAM is enabled.', 'pass')
|
||
|
|
|
||
|
|
# AllowTcpForwarding
|
||
|
|
val = cfg.get('AllowTcpForwarding', 'yes')
|
||
|
|
if val.lower() == 'yes':
|
||
|
|
_add('AllowTcpForwarding', 'LOW', val, 'no', 'TCP forwarding is enabled — consider disabling if not required.')
|
||
|
|
else:
|
||
|
|
_add('AllowTcpForwarding', 'LOW', val, 'no', 'TCP forwarding is disabled.', 'pass')
|
||
|
|
|
||
|
|
# ClientAliveInterval
|
||
|
|
val = cfg.get('ClientAliveInterval', '0')
|
||
|
|
try:
|
||
|
|
if int(val) == 0:
|
||
|
|
_add('ClientAliveInterval', 'WARNING', val, '300', 'No client alive interval — idle sessions will never timeout.')
|
||
|
|
else:
|
||
|
|
_add('ClientAliveInterval', 'WARNING', val, '300', 'Client alive interval is set.', 'pass')
|
||
|
|
except ValueError:
|
||
|
|
_add('ClientAliveInterval', 'WARNING', val, '300', 'Could not parse ClientAliveInterval value.')
|
||
|
|
|
||
|
|
return jsonify({'ok': True, 'checks': checks})
|
||
|
|
|
||
|
|
|
||
|
|
# ── Config Read / Save ───────────────────────────────────────────────────────
|
||
|
|
|
||
|
|
@ssh_manager_bp.route('/config', methods=['GET'])
|
||
|
|
@login_required
|
||
|
|
def config_read():
|
||
|
|
"""Read sshd_config file contents."""
|
||
|
|
result = root_exec('cat /etc/ssh/sshd_config', timeout=10)
|
||
|
|
if not result.get('ok'):
|
||
|
|
return jsonify({'ok': False, 'error': result.get('stderr', 'Failed to read config')}), 500
|
||
|
|
return jsonify({'ok': True, 'config': result['stdout']})
|
||
|
|
|
||
|
|
|
||
|
|
@ssh_manager_bp.route('/config/save', methods=['POST'])
|
||
|
|
@login_required
|
||
|
|
def config_save():
|
||
|
|
"""Save sshd_config with backup and syntax validation."""
|
||
|
|
data = request.get_json(silent=True)
|
||
|
|
if not data or 'config' not in data:
|
||
|
|
return jsonify({'ok': False, 'error': 'Missing config field'}), 400
|
||
|
|
|
||
|
|
config_text = data['config']
|
||
|
|
timestamp = int(time.time())
|
||
|
|
backup_path = f'/etc/ssh/sshd_config.bak.{timestamp}'
|
||
|
|
|
||
|
|
# 1. Create backup
|
||
|
|
bak = root_exec(f'cp /etc/ssh/sshd_config {backup_path}', timeout=10)
|
||
|
|
if not bak.get('ok'):
|
||
|
|
return jsonify({'ok': False, 'error': 'Failed to create backup: ' + bak.get('stderr', '')}), 500
|
||
|
|
|
||
|
|
# 2. Write new config via a temp file
|
||
|
|
try:
|
||
|
|
tmp = tempfile.NamedTemporaryFile(mode='w', suffix='.sshd_config', delete=False)
|
||
|
|
tmp.write(config_text)
|
||
|
|
tmp.close()
|
||
|
|
|
||
|
|
cp_result = root_exec(f'cp {tmp.name} /etc/ssh/sshd_config', timeout=10)
|
||
|
|
os.unlink(tmp.name)
|
||
|
|
|
||
|
|
if not cp_result.get('ok'):
|
||
|
|
# Restore backup
|
||
|
|
root_exec(f'cp {backup_path} /etc/ssh/sshd_config', timeout=10)
|
||
|
|
return jsonify({'ok': False, 'error': 'Failed to write config: ' + cp_result.get('stderr', '')}), 500
|
||
|
|
except Exception as exc:
|
||
|
|
root_exec(f'cp {backup_path} /etc/ssh/sshd_config', timeout=10)
|
||
|
|
return jsonify({'ok': False, 'error': f'Write error: {exc}'}), 500
|
||
|
|
|
||
|
|
# 3. Validate syntax
|
||
|
|
validate = root_exec('sshd -t', timeout=10)
|
||
|
|
if validate.get('code', 1) != 0:
|
||
|
|
# Restore backup
|
||
|
|
root_exec(f'cp {backup_path} /etc/ssh/sshd_config', timeout=10)
|
||
|
|
err = (validate.get('stderr', '') + validate.get('stdout', '')).strip()
|
||
|
|
return jsonify({'ok': False, 'error': 'Syntax validation failed — backup restored.', 'validation': err}), 400
|
||
|
|
|
||
|
|
return jsonify({
|
||
|
|
'ok': True,
|
||
|
|
'validation': 'Configuration is valid.',
|
||
|
|
'backup': backup_path,
|
||
|
|
})
|
||
|
|
|
||
|
|
|
||
|
|
# ── Config Generate ──────────────────────────────────────────────────────────
|
||
|
|
|
||
|
|
# All supported directives grouped logically
|
||
|
|
_CONFIG_GROUPS = {
|
||
|
|
'Connection': [
|
||
|
|
'Port', 'AddressFamily', 'ListenAddress', 'Protocol',
|
||
|
|
],
|
||
|
|
'Authentication': [
|
||
|
|
'PermitRootLogin', 'PubkeyAuthentication', 'PasswordAuthentication',
|
||
|
|
'PermitEmptyPasswords', 'ChallengeResponseAuthentication',
|
||
|
|
'KbdInteractiveAuthentication', 'UsePAM', 'AuthenticationMethods',
|
||
|
|
'MaxAuthTries', 'LoginGraceTime',
|
||
|
|
],
|
||
|
|
'Keys': [
|
||
|
|
'HostKey', 'AuthorizedKeysFile', 'AuthorizedPrincipalsFile',
|
||
|
|
],
|
||
|
|
'Session': [
|
||
|
|
'MaxSessions', 'ClientAliveInterval', 'ClientAliveCountMax', 'TCPKeepAlive',
|
||
|
|
],
|
||
|
|
'Access Control': [
|
||
|
|
'AllowUsers', 'AllowGroups', 'DenyUsers', 'DenyGroups',
|
||
|
|
],
|
||
|
|
'Forwarding': [
|
||
|
|
'AllowTcpForwarding', 'X11Forwarding', 'X11DisplayOffset',
|
||
|
|
'GatewayPorts', 'PermitTunnel',
|
||
|
|
],
|
||
|
|
'Logging': [
|
||
|
|
'SyslogFacility', 'LogLevel',
|
||
|
|
],
|
||
|
|
'Security': [
|
||
|
|
'StrictModes', 'HostbasedAuthentication', 'IgnoreRhosts',
|
||
|
|
'IgnoreUserKnownHosts', 'RekeyLimit', 'Ciphers', 'MACs', 'KexAlgorithms',
|
||
|
|
],
|
||
|
|
'Other': [
|
||
|
|
'Subsystem', 'Banner', 'PrintMotd', 'PrintLastLog',
|
||
|
|
'AcceptEnv', 'UseDNS', 'PermitUserEnvironment', 'Compression',
|
||
|
|
],
|
||
|
|
}
|
||
|
|
|
||
|
|
# Flatten for quick lookup
|
||
|
|
_ALL_DIRECTIVES = set()
|
||
|
|
for _directives in _CONFIG_GROUPS.values():
|
||
|
|
_ALL_DIRECTIVES.update(_directives)
|
||
|
|
|
||
|
|
|
||
|
|
@ssh_manager_bp.route('/config/generate', methods=['POST'])
|
||
|
|
@login_required
|
||
|
|
def config_generate():
|
||
|
|
"""Generate a hardened sshd_config from submitted fields.
|
||
|
|
|
||
|
|
Returns the text without saving so the user can review it first.
|
||
|
|
"""
|
||
|
|
data = request.get_json(silent=True) or {}
|
||
|
|
|
||
|
|
lines = [
|
||
|
|
'# sshd_config — generated by AUTARCH SSH Manager',
|
||
|
|
f'# Generated: {time.strftime("%Y-%m-%d %H:%M:%S %Z")}',
|
||
|
|
'#',
|
||
|
|
'# Review carefully before applying.',
|
||
|
|
'',
|
||
|
|
]
|
||
|
|
|
||
|
|
for group_name, directives in _CONFIG_GROUPS.items():
|
||
|
|
group_lines = []
|
||
|
|
for directive in directives:
|
||
|
|
value = data.get(directive)
|
||
|
|
if value is not None and str(value).strip() != '':
|
||
|
|
group_lines.append(f'{directive} {value}')
|
||
|
|
if group_lines:
|
||
|
|
lines.append(f'# ── {group_name} {"─" * (60 - len(group_name))}')
|
||
|
|
lines.extend(group_lines)
|
||
|
|
lines.append('')
|
||
|
|
|
||
|
|
config_text = '\n'.join(lines) + '\n'
|
||
|
|
return jsonify({'ok': True, 'config': config_text})
|
||
|
|
|
||
|
|
|
||
|
|
# ── Service Control ──────────────────────────────────────────────────────────
|
||
|
|
|
||
|
|
_ALLOWED_ACTIONS = {'start', 'stop', 'restart', 'enable', 'disable'}
|
||
|
|
|
||
|
|
|
||
|
|
@ssh_manager_bp.route('/service/<action>', methods=['POST'])
|
||
|
|
@login_required
|
||
|
|
def service_action(action):
|
||
|
|
"""Start / stop / restart / enable / disable the SSH service."""
|
||
|
|
if action not in _ALLOWED_ACTIONS:
|
||
|
|
return jsonify({'ok': False, 'error': f'Invalid action: {action}'}), 400
|
||
|
|
|
||
|
|
# Try sshd first, fall back to ssh
|
||
|
|
result = root_exec(f'systemctl {action} sshd', timeout=20)
|
||
|
|
if result.get('code', 1) != 0:
|
||
|
|
result = root_exec(f'systemctl {action} ssh', timeout=20)
|
||
|
|
|
||
|
|
output = (result.get('stdout', '') + '\n' + result.get('stderr', '')).strip()
|
||
|
|
return jsonify({
|
||
|
|
'ok': result.get('code', 1) == 0,
|
||
|
|
'output': output,
|
||
|
|
})
|
||
|
|
|
||
|
|
|
||
|
|
# ── Key Generation ───────────────────────────────────────────────────────────
|
||
|
|
|
||
|
|
@ssh_manager_bp.route('/keys/generate', methods=['POST'])
|
||
|
|
@login_required
|
||
|
|
def keys_generate():
|
||
|
|
"""Generate an SSH key pair (does not require root)."""
|
||
|
|
data = request.get_json(silent=True) or {}
|
||
|
|
key_type = data.get('type', 'ed25519')
|
||
|
|
bits = int(data.get('bits', 4096))
|
||
|
|
comment = data.get('comment', '')
|
||
|
|
passphrase = data.get('passphrase', '')
|
||
|
|
|
||
|
|
if key_type not in ('ed25519', 'rsa'):
|
||
|
|
return jsonify({'ok': False, 'error': 'Unsupported key type (use ed25519 or rsa)'}), 400
|
||
|
|
|
||
|
|
try:
|
||
|
|
tmp_dir = tempfile.mkdtemp(prefix='autarch_sshkey_')
|
||
|
|
key_path = os.path.join(tmp_dir, 'id_key')
|
||
|
|
|
||
|
|
cmd = ['ssh-keygen', '-t', key_type, '-f', key_path, '-N', passphrase]
|
||
|
|
if key_type == 'rsa':
|
||
|
|
cmd += ['-b', str(bits)]
|
||
|
|
if comment:
|
||
|
|
cmd += ['-C', comment]
|
||
|
|
|
||
|
|
import subprocess
|
||
|
|
proc = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
|
||
|
|
if proc.returncode != 0:
|
||
|
|
return jsonify({'ok': False, 'error': proc.stderr.strip()}), 500
|
||
|
|
|
||
|
|
with open(key_path, 'r') as f:
|
||
|
|
private_key = f.read()
|
||
|
|
with open(key_path + '.pub', 'r') as f:
|
||
|
|
public_key = f.read().strip()
|
||
|
|
|
||
|
|
# Get fingerprint
|
||
|
|
fp_proc = subprocess.run(
|
||
|
|
['ssh-keygen', '-lf', key_path + '.pub'],
|
||
|
|
capture_output=True, text=True, timeout=10,
|
||
|
|
)
|
||
|
|
fingerprint = fp_proc.stdout.strip()
|
||
|
|
|
||
|
|
# Clean up temp files
|
||
|
|
os.unlink(key_path)
|
||
|
|
os.unlink(key_path + '.pub')
|
||
|
|
os.rmdir(tmp_dir)
|
||
|
|
|
||
|
|
return jsonify({
|
||
|
|
'ok': True,
|
||
|
|
'public_key': public_key,
|
||
|
|
'private_key': private_key,
|
||
|
|
'fingerprint': fingerprint,
|
||
|
|
})
|
||
|
|
except Exception as exc:
|
||
|
|
log.exception('SSH key generation failed')
|
||
|
|
return jsonify({'ok': False, 'error': str(exc)}), 500
|
||
|
|
|
||
|
|
|
||
|
|
# ── Host Keys ────────────────────────────────────────────────────────────────
|
||
|
|
|
||
|
|
@ssh_manager_bp.route('/keys/host', methods=['GET'])
|
||
|
|
@login_required
|
||
|
|
def keys_host():
|
||
|
|
"""List host public keys and their fingerprints."""
|
||
|
|
import subprocess
|
||
|
|
|
||
|
|
result = root_exec('ls /etc/ssh/ssh_host_*_key.pub', timeout=10)
|
||
|
|
if not result.get('ok'):
|
||
|
|
return jsonify({'ok': False, 'error': 'No host keys found or permission denied.'}), 500
|
||
|
|
|
||
|
|
pub_files = [f.strip() for f in result['stdout'].splitlines() if f.strip()]
|
||
|
|
keys = []
|
||
|
|
for pub_file in pub_files:
|
||
|
|
# Read the key
|
||
|
|
cat_result = root_exec(f'cat {pub_file}', timeout=10)
|
||
|
|
if not cat_result.get('ok'):
|
||
|
|
continue
|
||
|
|
key_text = cat_result['stdout'].strip()
|
||
|
|
key_type = key_text.split()[0] if key_text else 'unknown'
|
||
|
|
|
||
|
|
# Fingerprint
|
||
|
|
fp_result = root_exec(f'ssh-keygen -lf {pub_file}', timeout=10)
|
||
|
|
fingerprint = fp_result.get('stdout', '').strip() if fp_result.get('ok') else ''
|
||
|
|
|
||
|
|
keys.append({
|
||
|
|
'type': key_type,
|
||
|
|
'fingerprint': fingerprint,
|
||
|
|
'file': pub_file,
|
||
|
|
})
|
||
|
|
|
||
|
|
return jsonify({'ok': True, 'keys': keys})
|
||
|
|
|
||
|
|
|
||
|
|
# ── Authorized Keys ─────────────────────────────────────────────────────────
|
||
|
|
|
||
|
|
def _authorized_keys_path() -> str:
|
||
|
|
return os.path.expanduser('~/.ssh/authorized_keys')
|
||
|
|
|
||
|
|
|
||
|
|
@ssh_manager_bp.route('/keys/authorized', methods=['GET'])
|
||
|
|
@login_required
|
||
|
|
def keys_authorized():
|
||
|
|
"""Read ~/.ssh/authorized_keys."""
|
||
|
|
ak_path = _authorized_keys_path()
|
||
|
|
keys = []
|
||
|
|
try:
|
||
|
|
if os.path.isfile(ak_path):
|
||
|
|
with open(ak_path, 'r') as f:
|
||
|
|
for line in f:
|
||
|
|
line = line.strip()
|
||
|
|
if not line or line.startswith('#'):
|
||
|
|
continue
|
||
|
|
parts = line.split(None, 2)
|
||
|
|
comment = parts[2] if len(parts) >= 3 else ''
|
||
|
|
keys.append({'key': line, 'comment': comment})
|
||
|
|
except Exception as exc:
|
||
|
|
return jsonify({'ok': False, 'error': str(exc)}), 500
|
||
|
|
|
||
|
|
return jsonify({'ok': True, 'keys': keys})
|
||
|
|
|
||
|
|
|
||
|
|
@ssh_manager_bp.route('/keys/authorized/add', methods=['POST'])
|
||
|
|
@login_required
|
||
|
|
def keys_authorized_add():
|
||
|
|
"""Append a public key to authorized_keys."""
|
||
|
|
data = request.get_json(silent=True) or {}
|
||
|
|
key = data.get('key', '').strip()
|
||
|
|
if not key:
|
||
|
|
return jsonify({'ok': False, 'error': 'No key provided'}), 400
|
||
|
|
|
||
|
|
ak_path = _authorized_keys_path()
|
||
|
|
try:
|
||
|
|
ssh_dir = os.path.dirname(ak_path)
|
||
|
|
os.makedirs(ssh_dir, mode=0o700, exist_ok=True)
|
||
|
|
with open(ak_path, 'a') as f:
|
||
|
|
f.write(key + '\n')
|
||
|
|
os.chmod(ak_path, 0o600)
|
||
|
|
except Exception as exc:
|
||
|
|
return jsonify({'ok': False, 'error': str(exc)}), 500
|
||
|
|
|
||
|
|
return jsonify({'ok': True})
|
||
|
|
|
||
|
|
|
||
|
|
@ssh_manager_bp.route('/keys/authorized/remove', methods=['POST'])
|
||
|
|
@login_required
|
||
|
|
def keys_authorized_remove():
|
||
|
|
"""Remove a key by index from authorized_keys."""
|
||
|
|
data = request.get_json(silent=True) or {}
|
||
|
|
index = data.get('index')
|
||
|
|
if index is None:
|
||
|
|
return jsonify({'ok': False, 'error': 'No index provided'}), 400
|
||
|
|
|
||
|
|
try:
|
||
|
|
index = int(index)
|
||
|
|
except (ValueError, TypeError):
|
||
|
|
return jsonify({'ok': False, 'error': 'Index must be an integer'}), 400
|
||
|
|
|
||
|
|
ak_path = _authorized_keys_path()
|
||
|
|
try:
|
||
|
|
if not os.path.isfile(ak_path):
|
||
|
|
return jsonify({'ok': False, 'error': 'authorized_keys file does not exist'}), 404
|
||
|
|
|
||
|
|
with open(ak_path, 'r') as f:
|
||
|
|
lines = f.readlines()
|
||
|
|
|
||
|
|
# Build list of non-empty, non-comment key lines with original indices
|
||
|
|
key_lines = []
|
||
|
|
for i, line in enumerate(lines):
|
||
|
|
stripped = line.strip()
|
||
|
|
if stripped and not stripped.startswith('#'):
|
||
|
|
key_lines.append(i)
|
||
|
|
|
||
|
|
if index < 0 or index >= len(key_lines):
|
||
|
|
return jsonify({'ok': False, 'error': f'Index {index} out of range (0-{len(key_lines) - 1})'}), 400
|
||
|
|
|
||
|
|
# Remove the line at the original file index
|
||
|
|
del lines[key_lines[index]]
|
||
|
|
|
||
|
|
with open(ak_path, 'w') as f:
|
||
|
|
f.writelines(lines)
|
||
|
|
os.chmod(ak_path, 0o600)
|
||
|
|
except Exception as exc:
|
||
|
|
return jsonify({'ok': False, 'error': str(exc)}), 500
|
||
|
|
|
||
|
|
return jsonify({'ok': True})
|
||
|
|
|
||
|
|
|
||
|
|
# ══════════════════════════════════════════════════════════════════════════════
|
||
|
|
# FAIL2BAN
|
||
|
|
# ══════════════════════════════════════════════════════════════════════════════
|
||
|
|
|
||
|
|
@ssh_manager_bp.route('/fail2ban/status')
|
||
|
|
@login_required
|
||
|
|
def f2b_status():
|
||
|
|
r = root_exec(['fail2ban-client', 'status'])
|
||
|
|
if not r['ok']:
|
||
|
|
return jsonify({'ok': False, 'error': r['stderr'] or 'fail2ban not running', 'active': False})
|
||
|
|
jails = []
|
||
|
|
total_banned = 0
|
||
|
|
for line in r['stdout'].split('\n'):
|
||
|
|
if 'Jail list:' in line:
|
||
|
|
jails = [j.strip() for j in line.split(':')[1].strip().split(',') if j.strip()]
|
||
|
|
jail_details = []
|
||
|
|
for jail in jails:
|
||
|
|
jr = root_exec(['fail2ban-client', 'status', jail])
|
||
|
|
banned = 0
|
||
|
|
banned_ips = []
|
||
|
|
if jr['ok']:
|
||
|
|
for line in jr['stdout'].split('\n'):
|
||
|
|
if 'Currently banned:' in line:
|
||
|
|
try: banned = int(line.split(':')[1].strip())
|
||
|
|
except: pass
|
||
|
|
elif 'Banned IP list:' in line:
|
||
|
|
banned_ips = [ip.strip() for ip in line.split(':',1)[1].strip().split() if ip.strip()]
|
||
|
|
total_banned += banned
|
||
|
|
jail_details.append({'name': jail, 'banned': banned, 'banned_ips': banned_ips})
|
||
|
|
sr = root_exec(['systemctl', 'is-active', 'fail2ban'])
|
||
|
|
return jsonify({'ok': True, 'active': sr['stdout'].strip() == 'active',
|
||
|
|
'jail_count': len(jails), 'total_banned': total_banned, 'jails': jail_details})
|
||
|
|
|
||
|
|
|
||
|
|
@ssh_manager_bp.route('/fail2ban/service/<action>', methods=['POST'])
|
||
|
|
@login_required
|
||
|
|
def f2b_service(action):
|
||
|
|
if action not in ('start', 'stop', 'restart', 'enable', 'disable'):
|
||
|
|
return jsonify({'ok': False, 'error': 'Invalid action'})
|
||
|
|
r = root_exec(['systemctl', action, 'fail2ban'])
|
||
|
|
return jsonify({'ok': r['ok'], 'output': r['stdout'] + r['stderr']})
|
||
|
|
|
||
|
|
|
||
|
|
@ssh_manager_bp.route('/fail2ban/banned')
|
||
|
|
@login_required
|
||
|
|
def f2b_banned():
|
||
|
|
r = root_exec(['fail2ban-client', 'status'])
|
||
|
|
if not r['ok']:
|
||
|
|
return jsonify({'ok': False, 'error': 'fail2ban not running'})
|
||
|
|
all_banned = []
|
||
|
|
jails = []
|
||
|
|
for line in r['stdout'].split('\n'):
|
||
|
|
if 'Jail list:' in line:
|
||
|
|
jails = [j.strip() for j in line.split(':')[1].strip().split(',') if j.strip()]
|
||
|
|
for jail in jails:
|
||
|
|
jr = root_exec(['fail2ban-client', 'status', jail])
|
||
|
|
if jr['ok']:
|
||
|
|
for line in jr['stdout'].split('\n'):
|
||
|
|
if 'Banned IP list:' in line:
|
||
|
|
for ip in line.split(':', 1)[1].strip().split():
|
||
|
|
if ip.strip():
|
||
|
|
all_banned.append({'ip': ip.strip(), 'jail': jail})
|
||
|
|
return jsonify({'ok': True, 'banned': all_banned, 'total': len(all_banned)})
|
||
|
|
|
||
|
|
|
||
|
|
@ssh_manager_bp.route('/fail2ban/ban', methods=['POST'])
|
||
|
|
@login_required
|
||
|
|
def f2b_ban():
|
||
|
|
data = request.get_json(silent=True) or {}
|
||
|
|
ip = data.get('ip', '').strip()
|
||
|
|
jail = data.get('jail', 'sshd').strip()
|
||
|
|
if not ip: return jsonify({'ok': False, 'error': 'IP required'})
|
||
|
|
r = root_exec(['fail2ban-client', 'set', jail, 'banip', ip])
|
||
|
|
return jsonify({'ok': r['ok'], 'output': r['stdout'] + r['stderr']})
|
||
|
|
|
||
|
|
|
||
|
|
@ssh_manager_bp.route('/fail2ban/unban', methods=['POST'])
|
||
|
|
@login_required
|
||
|
|
def f2b_unban():
|
||
|
|
data = request.get_json(silent=True) or {}
|
||
|
|
ip = data.get('ip', '').strip()
|
||
|
|
jail = data.get('jail', '').strip()
|
||
|
|
if not ip: return jsonify({'ok': False, 'error': 'IP required'})
|
||
|
|
r = root_exec(['fail2ban-client', 'set', jail, 'unbanip', ip]) if jail else root_exec(['fail2ban-client', 'unban', ip])
|
||
|
|
return jsonify({'ok': r['ok'], 'output': r['stdout'] + r['stderr']})
|
||
|
|
|
||
|
|
|
||
|
|
@ssh_manager_bp.route('/fail2ban/search', methods=['POST'])
|
||
|
|
@login_required
|
||
|
|
def f2b_search():
|
||
|
|
data = request.get_json(silent=True) or {}
|
||
|
|
ip = data.get('ip', '').strip()
|
||
|
|
if not ip: return jsonify({'ok': False, 'error': 'IP required'})
|
||
|
|
results = []
|
||
|
|
r = root_exec(['fail2ban-client', 'status'])
|
||
|
|
jails = []
|
||
|
|
if r['ok']:
|
||
|
|
for line in r['stdout'].split('\n'):
|
||
|
|
if 'Jail list:' in line:
|
||
|
|
jails = [j.strip() for j in line.split(':')[1].strip().split(',') if j.strip()]
|
||
|
|
for jail in jails:
|
||
|
|
jr = root_exec(['fail2ban-client', 'status', jail])
|
||
|
|
if jr['ok'] and ip in jr['stdout']:
|
||
|
|
results.append({'jail': jail, 'status': 'banned'})
|
||
|
|
lr = root_exec(['grep', ip, '/var/log/fail2ban.log'])
|
||
|
|
log_entries = [l.strip() for l in lr['stdout'].strip().split('\n')[-20:] if l.strip()] if lr['ok'] else []
|
||
|
|
return jsonify({'ok': True, 'ip': ip, 'active_bans': results, 'log_entries': log_entries})
|
||
|
|
|
||
|
|
|
||
|
|
@ssh_manager_bp.route('/fail2ban/jail/create', methods=['POST'])
|
||
|
|
@login_required
|
||
|
|
def f2b_jail_create():
|
||
|
|
data = request.get_json(silent=True) or {}
|
||
|
|
name = data.get('name', '').strip()
|
||
|
|
if not name or not re.match(r'^[a-zA-Z0-9_-]+$', name):
|
||
|
|
return jsonify({'ok': False, 'error': 'Invalid jail name'})
|
||
|
|
config = f"[{name}]\nenabled = {'true' if data.get('enabled', True) else 'false'}\nfilter = {data.get('filter', name)}\nlogpath = {data.get('logpath', '')}\nmaxretry = {data.get('maxretry', '5')}\nfindtime = {data.get('findtime', '10m')}\nbantime = {data.get('bantime', '1h')}\naction = {data.get('action', '%(action_mwl)s')}\n"
|
||
|
|
tmp = tempfile.NamedTemporaryFile(mode='w', suffix='.local', delete=False)
|
||
|
|
tmp.write(config); tmp.close()
|
||
|
|
r = root_exec(['cp', tmp.name, f'/etc/fail2ban/jail.d/{name}.local'])
|
||
|
|
os.unlink(tmp.name)
|
||
|
|
if not r['ok']: return jsonify({'ok': False, 'error': r['stderr']})
|
||
|
|
root_exec(['fail2ban-client', 'reload'])
|
||
|
|
return jsonify({'ok': True, 'config': config})
|
||
|
|
|
||
|
|
|
||
|
|
@ssh_manager_bp.route('/fail2ban/scan-apps', methods=['POST'])
|
||
|
|
@login_required
|
||
|
|
def f2b_scan_apps():
|
||
|
|
checks = [
|
||
|
|
('sshd', 'openssh-server', '/var/log/auth.log', 'sshd'),
|
||
|
|
('apache2', 'apache2', '/var/log/apache2/error.log', 'apache-auth'),
|
||
|
|
('nginx', 'nginx', '/var/log/nginx/error.log', 'nginx-http-auth'),
|
||
|
|
('postfix', 'postfix', '/var/log/mail.log', 'postfix'),
|
||
|
|
('dovecot', 'dovecot-core', '/var/log/mail.log', 'dovecot'),
|
||
|
|
('mysql', 'mysql-server', '/var/log/mysql/error.log', 'mysqld-auth'),
|
||
|
|
('postgresql', 'postgresql', '/var/log/postgresql/*.log', 'postgresql'),
|
||
|
|
('vsftpd', 'vsftpd', '/var/log/vsftpd.log', 'vsftpd'),
|
||
|
|
('exim4', 'exim4', '/var/log/exim4/mainlog', 'exim'),
|
||
|
|
('recidive', None, '/var/log/fail2ban.log', 'recidive'),
|
||
|
|
]
|
||
|
|
existing = set()
|
||
|
|
r = root_exec(['fail2ban-client', 'status'])
|
||
|
|
if r['ok']:
|
||
|
|
for line in r['stdout'].split('\n'):
|
||
|
|
if 'Jail list:' in line:
|
||
|
|
existing = set(j.strip() for j in line.split(':')[1].strip().split(',') if j.strip())
|
||
|
|
apps = []
|
||
|
|
for service, pkg, logpath, filt in checks:
|
||
|
|
installed = True if not pkg else (root_exec(['dpkg', '-l', pkg])['ok'] and 'ii' in root_exec(['dpkg', '-l', pkg])['stdout'])
|
||
|
|
lr = root_exec(['ls', logpath.split('*')[0] if '*' in logpath else logpath])
|
||
|
|
apps.append({'service': service, 'package': pkg, 'installed': installed,
|
||
|
|
'log_path': logpath, 'log_exists': lr['ok'], 'filter': filt,
|
||
|
|
'has_jail': filt in existing or service in existing})
|
||
|
|
return jsonify({'ok': True, 'apps': apps})
|
||
|
|
|
||
|
|
|
||
|
|
@ssh_manager_bp.route('/fail2ban/auto-config', methods=['POST'])
|
||
|
|
@login_required
|
||
|
|
def f2b_auto_config():
|
||
|
|
data = request.get_json(silent=True) or {}
|
||
|
|
apply_now = data.get('apply', False)
|
||
|
|
checks = [
|
||
|
|
('sshd', '/var/log/auth.log', 'sshd', '5', '10m', '1h'),
|
||
|
|
('apache2', '/var/log/apache2/error.log', 'apache-auth', '5', '10m', '1h'),
|
||
|
|
('nginx', '/var/log/nginx/error.log', 'nginx-http-auth', '5', '10m', '1h'),
|
||
|
|
('postfix', '/var/log/mail.log', 'postfix', '5', '10m', '1h'),
|
||
|
|
('recidive', '/var/log/fail2ban.log', 'recidive', '3', '1d', '1w'),
|
||
|
|
]
|
||
|
|
generated = []
|
||
|
|
for svc, logpath, filt, maxr, findt, bant in checks:
|
||
|
|
if not root_exec(['ls', logpath])['ok']: continue
|
||
|
|
generated.append({'service': svc, 'config': f"[{svc}]\nenabled = true\nfilter = {filt}\nlogpath = {logpath}\nmaxretry = {maxr}\nfindtime = {findt}\nbantime = {bant}\n"})
|
||
|
|
if apply_now and generated:
|
||
|
|
tmp = tempfile.NamedTemporaryFile(mode='w', suffix='.local', delete=False)
|
||
|
|
tmp.write('\n'.join(g['config'] for g in generated)); tmp.close()
|
||
|
|
root_exec(['cp', tmp.name, '/etc/fail2ban/jail.d/autarch-auto.local'])
|
||
|
|
os.unlink(tmp.name)
|
||
|
|
root_exec(['fail2ban-client', 'reload'])
|
||
|
|
return jsonify({'ok': True, 'generated': generated, 'applied': apply_now, 'count': len(generated)})
|