Merge pull request #13 from ST2Projects/tk/client-prep

neo1908 · web-flow · commit 1c6edea2e543 · 2022-08-27T18:40:00.000+01:00
Tk/client prep
diff --git a/.gitignore b/.gitignore
@@ -171,4 +171,4 @@ fabric.properties
 
 resources
 dist/
-./ssh-sentinel-server
+ssh-sentinel-server
diff --git a/.goreleaser.yml b/.goreleaser.yml
@@ -16,6 +16,11 @@ archives:
       linux: Linux
       386: i386
       amd64: x86_64
+    files:
+      - samples
+      - README.md
+      - LICENSE
+      - install/Makefile
 checksum:
   name_template: 'checksums.txt'
 snapshot:
diff --git a/README.md b/README.md
@@ -6,6 +6,35 @@ A simple to use and deploy SSH CA server.
 
 Once ready, I will update the README and provide some more info in terms of usage and deployment
 
+## Installation
+
+The release archive contains the binary `ssh-sentinel-server` and a samples directory containing a config template and a systemd service file.
+
+You **will** need to edit the `config.json` to suit your needs. You may need to edit the service file depending on your OS.
+
+To install, unpack the archive into the `/opt` directory then run the then install
+
+```shell
+mkdir /opt/sentinel
+# Copy archive into directory
+tar xvzf ssh-sentinel-server_$VERSION_$ARCH.tar.gz
+
+make install
+```
+
+## Configuration
+
+Configuration is defined in the `config.json`. Properties are explained below. All paths are relative to the `resources` directory
+
+- `CAPrivateKey` - Name of the CA private key. The key must be unencrypted - a future enhancement will allow encrypted keys
+- `CAPublicKey` - Name of the CA public key.
+- `MaxValidTime` - Maximum lifespan of signed keys, in the normal [go duration format](https://pkg.go.dev/time#ParseDuration)
+- `db.dialect` - Must be `sqlite3`. A future release will add support for other DBs
+- `db.username` - Username of the DB user
+- `db.password` - Password of the DB user
+- `db.connection` - Connection URL for the DB. For sqlite3 this is a file path
+- `db.dbName` - Name of the DB
+
 ## Goals
 
 There are a couple of SSH CA servers out there - I have found them all difficult to use and have specific platform
diff --git a/app/admin_runner.go b/app/admin_runner.go
@@ -2,9 +2,9 @@ package app
 
 import (
 	log "github.com/sirupsen/logrus"
-	"ssh-sentinel-server/config"
-	"ssh-sentinel-server/model/db"
-	"ssh-sentinel-server/sql"
+	"github.com/st2projects/ssh-sentinel-server/config"
+	"github.com/st2projects/ssh-sentinel-server/model/db"
+	"github.com/st2projects/ssh-sentinel-server/sql"
 )
 
 func RunAdmin(configPath string, createUser bool, name string, username string, principals []string) {
diff --git a/app/initialiser.go b/app/initialiser.go
@@ -2,12 +2,13 @@ package app
 
 import (
 	log "github.com/sirupsen/logrus"
-	"ssh-sentinel-server/config"
-	"ssh-sentinel-server/server"
-	"ssh-sentinel-server/sql"
+	"github.com/st2projects/ssh-sentinel-server/config"
+	"github.com/st2projects/ssh-sentinel-server/model"
+	"github.com/st2projects/ssh-sentinel-server/server"
+	"github.com/st2projects/ssh-sentinel-server/sql"
 )
 
-func InitialiseApp(configPath string, devMode bool) {
+func InitialiseApp(configPath string, devMode bool, httpConfig *model.HTTPConfig) {
 
 	customLogFormat := new(log.TextFormatter)
 	customLogFormat.TimestampFormat = "2022-01-01 01:01:01.123"
@@ -19,5 +20,5 @@ func InitialiseApp(configPath string, devMode bool) {
 	config.MakeConfig(configPath, devMode)
 	sql.Connect()
 
-	server.Serve()
+	server.Serve(httpConfig)
 }
diff --git a/cmd/admin.go b/cmd/admin.go
@@ -2,7 +2,7 @@ package cmd
 
 import (
 	"github.com/spf13/cobra"
-	"ssh-sentinel-server/app"
+	"github.com/st2projects/ssh-sentinel-server/app"
 )
 
 var create bool
diff --git a/cmd/serve.go b/cmd/serve.go
@@ -2,23 +2,29 @@ package cmd
 
 import (
 	"github.com/spf13/cobra"
-	"ssh-sentinel-server/app"
+	"github.com/st2projects/ssh-sentinel-server/app"
+	"github.com/st2projects/ssh-sentinel-server/model"
 )
 
 var devMode bool
 
+var httpConfig = model.HTTPConfig{}.Default()
+
 // serveCmd represents the serve command
 var serveCmd = &cobra.Command{
 	Use:   "serve",
 	Short: "Start the CA server",
 	Run: func(cmd *cobra.Command, args []string) {
-		app.InitialiseApp(configPath, devMode)
+		app.InitialiseApp(configPath, devMode, httpConfig)
 	},
 }
 
 func init() {
+
 	rootCmd.AddCommand(serveCmd)
 	serveCmd.Flags().StringVarP(&configPath, "config", "c", "", "Config file")
+	serveCmd.Flags().IntVarP(&httpConfig.HttpsPort, "https-port", "s", 443, "HTTPS Port")
+	serveCmd.Flags().IntVarP(&httpConfig.HttpPort, "http-port", "i", 80, "HTTP Port")
 	serveCmd.Flags().BoolVarP(&devMode, "dev-mode", "d", false, "Run in DEV mode. See README for implications")
 
 	serveCmd.MarkFlagRequired("config")
diff --git a/go.mod b/go.mod
@@ -1,4 +1,4 @@
-module ssh-sentinel-server
+module github.com/st2projects/ssh-sentinel-server
 
 go 1.18
 
@@ -10,6 +10,7 @@ require (
 	github.com/justinas/alice v1.2.0
 	github.com/sirupsen/logrus v1.9.0
 	github.com/spf13/cobra v1.5.0
+	github.com/st2projects/ssh-sentinel-core v1.0.0
 	golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d
 	golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e
 	gorm.io/driver/sqlite v1.3.6
diff --git a/go.sum b/go.sum
@@ -732,6 +732,8 @@ github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.7.0/go.mod h1:8WkrPz2fc9jxqZNCJI/76HCieCp4Q8HaLFoCha5qpdg=
 github.com/spf13/viper v1.7.1/go.mod h1:8WkrPz2fc9jxqZNCJI/76HCieCp4Q8HaLFoCha5qpdg=
+github.com/st2projects/ssh-sentinel-core v1.0.0 h1:9MKquOBeExd660PWkJ221pIa6qw11Bvec9TfA90W1os=
+github.com/st2projects/ssh-sentinel-core v1.0.0/go.mod h1:x7Lj7JO1u4BT0iWnj66eIbn9fqQD1qB2ollTFsVzzHg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.3.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
diff --git a/install/Makefile b/install/Makefile
@@ -0,0 +1,8 @@
+install:
+	cp -a samples/config.json .
+	mkdir -p resources
+	cp samples/ssh-sentinel.service /etc/systemd/system/ssh-sentinel.service
+	systemctl daemon-reload
+
+	echo "Config file copied to ${PWD}/config.json. Please edit it before starting the service"
+	echo "To start the service run systemctl start ssh-sentinel - To enable start on boot: systemctl enable ssh-sentinel"
diff --git a/main.go b/main.go
@@ -1,7 +1,7 @@
 package main
 
 import (
-	"ssh-sentinel-server/cmd"
+	"github.com/st2projects/ssh-sentinel-server/cmd"
 )
 
 func main() {
diff --git a/model/db/user.go b/model/db/user.go
@@ -3,8 +3,8 @@ package db
 import (
 	"github.com/google/uuid"
 	log "github.com/sirupsen/logrus"
+	"github.com/st2projects/ssh-sentinel-server/crypto"
 	"gorm.io/gorm"
-	"ssh-sentinel-server/crypto"
 )
 
 type User struct {
diff --git a/model/http/key_sign_request.go b/model/http/key_sign_request.go
diff --git a/model/http/key_sign_response.go b/model/http/key_sign_response.go
diff --git a/model/port.go b/model/port.go
@@ -0,0 +1,13 @@
+package model
+
+type HTTPConfig struct {
+	HttpPort  int
+	HttpsPort int
+}
+
+func (h HTTPConfig) Default() *HTTPConfig {
+	return &HTTPConfig{
+		HttpPort:  80,
+		HttpsPort: 443,
+	}
+}
diff --git a/samples/ssh-sentinel.service b/samples/ssh-sentinel.service
@@ -0,0 +1,14 @@
+[Unit]
+Description=SSH Sentinel Service
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+ExecReload=/bin/kill -HUP $MAINPID
+ExecStart=/opt/sentinel/ssh-sentinel-server --config /opt/sentinel/config.json
+SyslogIdentifier=semaphore
+Restart=always
+
+[Install]
+WantedBy=multi-user.target
diff --git a/server/handler_utils.go b/server/handler_utils.go
@@ -1,6 +1,6 @@
 package server
 
-import "ssh-sentinel-server/model/db"
+import "github.com/st2projects/ssh-sentinel-server/model/db"
 
 func CheckPrincipals(allowed []db.Principal, requested []string) bool {
 
diff --git a/server/handlers.go b/server/handlers.go
@@ -5,12 +5,12 @@ import (
 	"encoding/json"
 	"fmt"
 	log "github.com/sirupsen/logrus"
+	"github.com/st2projects/ssh-sentinel-core/model"
+	"github.com/st2projects/ssh-sentinel-server/crypto"
+	"github.com/st2projects/ssh-sentinel-server/helper"
+	"github.com/st2projects/ssh-sentinel-server/sql"
 	"io/ioutil"
 	"net/http"
-	"ssh-sentinel-server/crypto"
-	"ssh-sentinel-server/helper"
-	model "ssh-sentinel-server/model/http"
-	"ssh-sentinel-server/sql"
 	"time"
 )
 
diff --git a/server/server.go b/server/server.go
@@ -3,20 +3,22 @@ package server
 import (
 	"crypto/rand"
 	"encoding/json"
+	"fmt"
 	"github.com/foomo/simplecert"
 	"github.com/foomo/tlsconfig"
 	"github.com/gorilla/mux"
 	"github.com/justinas/alice"
 	log "github.com/sirupsen/logrus"
+	"github.com/st2projects/ssh-sentinel-core/model"
+	"github.com/st2projects/ssh-sentinel-server/config"
+	"github.com/st2projects/ssh-sentinel-server/helper"
+	cmd_model "github.com/st2projects/ssh-sentinel-server/model"
 	"golang.org/x/crypto/ssh"
 	"golang.org/x/net/context"
 	"io"
 	"io/ioutil"
 	"net/http"
 	"os"
-	"ssh-sentinel-server/config"
-	"ssh-sentinel-server/helper"
-	http2 "ssh-sentinel-server/model/http"
 	"time"
 )
 
@@ -49,18 +51,18 @@ func KeySignHandler(writer http.ResponseWriter, request *http.Request) {
 
 	signedCert := ssh.MarshalAuthorizedKey(cert)
 
-	var response = http2.NewKeySignResponse(true, "")
+	var response = model.NewKeySignResponse(true, "")
 	response.SignedKey = string(signedCert)
 
 	writer.WriteHeader(http.StatusOK)
 	responseEncoder.Encode(response)
 
 }
 
-func MarshallSigningRequest(requestReader io.Reader) (http2.KeySignRequest, error) {
+func MarshallSigningRequest(requestReader io.Reader) (model.KeySignRequest, error) {
 
 	body, err := ioutil.ReadAll(requestReader)
-	signRequest := http2.KeySignRequest{}
+	signRequest := model.KeySignRequest{}
 
 	if err == nil {
 		json.Unmarshal(body, &signRequest)
@@ -120,7 +122,7 @@ func Version(response http.ResponseWriter, r *http.Request) {
 	io.WriteString(response, "Version: 0.0.0.1")
 }
 
-func Serve() {
+func Serve(httpConfig *cmd_model.HTTPConfig) {
 
 	var (
 		certReloader *simplecert.CertReloader
@@ -135,7 +137,7 @@ func Serve() {
 		// a simple constructor for a http.Server with our Handler
 		makeServer = func() *http.Server {
 			return &http.Server{
-				Addr:      ":443",
+				Addr:      fmt.Sprintf(":%d", httpConfig.HttpsPort),
 				Handler:   makeRouter(),
 				TLSConfig: tlsConf,
 			}
@@ -182,7 +184,7 @@ func Serve() {
 	}
 
 	// Redirect 80 -> 443
-	go http.ListenAndServe(":80", http.HandlerFunc(simplecert.Redirect))
+	go http.ListenAndServe(fmt.Sprintf(":%d", httpConfig.HttpPort), http.HandlerFunc(simplecert.Redirect))
 
 	tlsConf.GetCertificate = certReloader.GetCertificateFunc()
 	log.Infof("Serving at https://%s", configuredTls.CertDomains[0])
diff --git a/sql/SqlDb.go b/sql/SqlDb.go
@@ -2,10 +2,10 @@ package sql
 
 import (
 	log "github.com/sirupsen/logrus"
+	"github.com/st2projects/ssh-sentinel-server/config"
+	"github.com/st2projects/ssh-sentinel-server/model/db"
 	_ "gorm.io/driver/sqlite" // Import sqlite3 driver
 	"gorm.io/gorm"
-	"ssh-sentinel-server/config"
-	"ssh-sentinel-server/model/db"
 )
 
 var dbConnection *gorm.DB

Original file line number	Diff line number	Diff line change
`@@ -2,7 +2,7 @@ package cmd`
`2`	`2`
`3`	`3`	`import (`
`4`	`4`	`"github.com/spf13/cobra"`
`5`		`- "ssh-sentinel-server/app"`
	`5`	`+ "github.com/st2projects/ssh-sentinel-server/app"`
`6`	`6`	`)`
`7`	`7`
`8`	`8`	`var create bool`