Class: SSH_Utils

Inherits:
Object
  • Object
show all
Defined in:
lib/audit/lib/ssh_utils.rb

Overview

require ssh-keygen command line program

Instance Method Summary collapse

Constructor Details

#initialize(options) ⇒ SSH_Utils

Returns a new instance of SSH_Utils.



9
10
11
12
13
14
15
 
# File 'lib/audit/lib/ssh_utils.rb', line 9

def initialize(options)
	if options[:logger] then
		@logger = options[:logger]
	else
		@logger = Logger.new(STDOUT)
	end
end

Instance Method Details

#convert_to_ssh(openssh_key) ⇒ Object

Get the SSH key in standard SSH format from the OpenSSH format

Parameters:

  • openssh_key —

    Key in OpenSSH format as string

Returns:

  • Key in SSH (RFC) format as string



132
133
134
135
136
137
138
139
140
 
# File 'lib/audit/lib/ssh_utils.rb', line 132

def convert_to_ssh(openssh_key)
	tempfile = Tempfile.new('convert_')
	tempfile << openssh_key; tempfile.flush()
	
	ssh_key = `ssh-keygen -e -f #{tempfile.path()}`
	tempfile.close!()
	
	return ssh_key
end

#enable_root_login(host, username, ssh_options, public_key) ⇒ Object 



152
153
154
155
156
157
158
159
160
161
162
163
164
165
 
# File 'lib/audit/lib/ssh_utils.rb', line 152

def (host, username, ssh_options, public_key)
	ssh_options = {:paranoid => false}.merge(ssh_options)
	root_prefix = get_root_prefix(host, username, ssh_options)
	return if root_prefix.nil?()
	
	Net::SSH.start(host, username, ssh_options) do|conn|
		conn.exec!(root_prefix + "sh -c 'grep -v PermitRootLogin /etc/ssh/sshd_config > /tmp/sshd_config; echo \"PermitRootLogin without-password\" >> /tmp/sshd_config; mv /tmp/sshd_config /etc/ssh/sshd_config'")
		conn.exec!(root_prefix + "kill -SIGHUP $( ps -A -o pid -o cmd | grep /usr/sbin/sshd | grep -v grep | awk '{print $1}')")
	end
	
	Net::SSH.start(host, username, ssh_options) do|conn|
		conn.exec!(root_prefix + "sh -c 'echo \"#{public_key}\" > ${HOME}/.ssh/authorized_keys'") 
	end
end

#find_root_method(host, username, ssh_options) ⇒ Object 



95
96
97
98
99
100
101
102
103
104
105
106
 
# File 'lib/audit/lib/ssh_utils.rb', line 95

def find_root_method(host, username, ssh_options)
	ssh_options = {:paranoid => false}.merge(ssh_options)
	Net::SSH.start(host, username, ssh_options) do|conn|
		output = conn.exec!("id --user 2>/dev/null")
		return :ALREADY_ROOT if output.strip() == "0"
		
		output = conn.exec!("sudo -n id --user 2>/dev/null")
		return :SUDO if output && output.strip() == "0"
	end
	
	return :NONE
end

#get_public_key(private_key, key_name = "") ⇒ Object 



125
126
127
 
# File 'lib/audit/lib/ssh_utils.rb', line 125

def get_public_key(private_key, key_name = "")
	return (`ssh-keygen -y -f #{private_key}`.strip() + " " + key_name).strip()
end

#get_root_prefix(host, username, ssh_options) ⇒ Object 



109
110
111
112
113
114
115
116
117
118
 
# File 'lib/audit/lib/ssh_utils.rb', line 109

def get_root_prefix(host, username, ssh_options)
	root_method = find_root_method(host, username, ssh_options)
	
	case root_method
	when :NONE then return nil
	when :SUDO then return "sudo -H -n "
	when :ALREADY_ROOT then return ""
	else return nil
	end
end

#guess_username(host, ssh_options, possible_usernames, timeout = 5) ⇒ Object 



28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
 
# File 'lib/audit/lib/ssh_utils.rb', line 28

def guess_username(host, ssh_options, possible_usernames, timeout = 5)
	ssh_options = {:paranoid => false}.merge(ssh_options)
	possible_usernames.each do|username|
		begin
			timeout(timeout) do
				Net::SSH.start(host, username, ssh_options) do|conn|
					output = conn.exec!("id --user --name")
					if output.strip() == username then
						@logger.info {"Found user name '#{username}'\n"}
						return username
					else
						@logger.debug {"User name '#{username}' logs in but does not execute commands\n"} 
					end
				end
			end
		rescue Net::SSH::AuthenticationFailed => ex
			@logger.debug {"Authentication with user name '#{username}' failed\n"}
		rescue Timeout::Error => err
			@logger.debug {"Authentication with user name '#{username}' timed out\n"}
		end
	end
	
	return nil
end

#parse_nmap_ssh_keydata(keydata) ⇒ Object 



255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
 
# File 'lib/audit/lib/ssh_utils.rb', line 255

def parse_nmap_ssh_keydata(keydata)
	line_type = :fingerprint_line
	current_key = nil
	keys = []
	keydata.each_line do|line|
		if line_type == :fingerprint_line then
			match = /^([0-9]+) ([0-9a-f:]+) (\([A-Z0-9]+\))$/.match(line)
			if match && !current_key.nil?() then
				#something is desynchronized, skip the key
				puts "Unexpected input at ssh host key data: '#{keydata}'"
				break
			elsif match && current_key.nil?() then
				current_key = { :length => match[1], :fingerprint => match[2], :type => match[3] }
			else
				puts "Unexpected line at ssh host key data, expected fingerprint data: '#{keydata}'"
				break
			end
			line_type = :key_line
		else
			match = /^([a-z0-9_-]+) ([A-Za-z0-9+\/=]+)$/.match(line)
			if match && current_key.nil?() then
				puts "Unexpected line at ssh host key data, expected key data: '#{keydata}'"
				break
			elsif match && !current_key.nil?() then
				current_key[:ssh_type] = match[1]
				current_key[:key] = match[2]
				keys << current_key
				current_key = nil
			else
				puts "Unexpected input at ssh host key data, expected key data: '#{keydata}'"
				break
			end
			line_type = :fingerprint_line
		end
	end
	return keys
end

#start_tunnel(host, private_key_file, local_tun_num = 0, remote_tun_num = 0, local_ip = "172.16.0.1", remote_ip = "172.16.0.2", ssh_options = {}) ⇒ Object 



183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
 
# File 'lib/audit/lib/ssh_utils.rb', line 183

def start_tunnel(host, private_key_file, local_tun_num = 0, remote_tun_num = 0, local_ip = "172.16.0.1", remote_ip = "172.16.0.2", ssh_options = {})
	username = 'root' # tunneling only works with root user, so assume root here
	result = false
	ssh_tunnel_process = "bla" # just any value to initialize the variable and assign the scope
	
	# change ssh server configuration to permit tunneling
	Net::SSH.start(host, username, {:keys => [private_key_file], :paranoid => false}.merge(ssh_options)) do|conn|
		conn.exec!("grep -v PermitTunnel /etc/ssh/sshd_config > /tmp/sshd_config; echo \"PermitTunnel yes\" >> /tmp/sshd_config; mv /tmp/sshd_config /etc/ssh/sshd_config")
		conn.exec!("kill -SIGHUP $( ps -A -o pid -o cmd | grep /usr/sbin/sshd | grep -v grep | awk '{print $1}')")
	end
	
	@logger.debug {"Modified SSH server configuration for tunneling"}
	
	# open the tunnel and configure
	Net::SSH.start(host, username, {:keys => [private_key_file], :paranoid => false}.merge(ssh_options)) do|conn|
		
		ssh_tunnel_cmd = "ssh -NT -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o BatchMode=yes -o ConnectTimeout=30 -w #{local_tun_num}:#{remote_tun_num} -i #{private_key_file} #{username}@#{host}"
		@logger.debug {"LOCAL: Starting tunneling SSH process: '#{ssh_tunnel_cmd}'"}
		ssh_tunnel_process = IO.popen(ssh_tunnel_cmd)
		# configure tunneling interfaces
		sleep(3) #some delay because otherwise tun devices are not configured correctly
		remote_tun_conf_cmd = "ifconfig tun#{remote_tun_num} #{local_ip} #{remote_ip} netmask 255.255.255.0 2>/dev/null 1>/dev/null"
		@logger.debug {"REMOTE: configuring tun interface: '#{remote_tun_conf_cmd}'"}
		conn.exec!(remote_tun_conf_cmd)
		
		local_tun_conf_cmd = "ifconfig tun#{local_tun_num} #{remote_ip} #{local_ip} netmask 255.255.255.0 2>/dev/null 1>/dev/null"
		@logger.debug {"LOCAL: configuring tun interface: '#{local_tun_conf_cmd}'"}
		system(local_tun_conf_cmd)
		# check that the connection works
		ping_cmd = "ping -c1 #{remote_ip} 2>/dev/null 1>/dev/null"
		@logger.debug {"LOCAL: pinging remote interface: '#{ping_cmd}'"}
		result = system(ping_cmd)
	end
	
	return {:success => result, 
	        :tunnel_server_pid => ssh_tunnel_process.pid(), 
	        :remote_ip => remote_ip, 
	        :local_ip => local_ip, 
	        :remote_tun_interface => "tun#{remote_tun_num}",
	        :local_tun_interface => "tun#{local_tun_num}"}
end

#stop_tunnel(tunnel_hash) ⇒ Object 



230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
 
# File 'lib/audit/lib/ssh_utils.rb', line 230

def stop_tunnel(tunnel_hash)
	# first try to end gently
	begin
		Process::kill('TERM', tunnel_hash[:tunnel_server_pid])
	rescue => err
	end
	#check if it really ended
	begin
		Process::kill('TERM', tunnel_hash[:tunnel_server_pid])
	rescue Errno::ESRCH => err
		return
	rescue => err
	end
	
	#if not, wait a second and then try the hard way
	sleep(1)
	begin
		Process::kill('KILL', tunnel_hash[:tunnel_server_pid])
	rescue Errno::ESRCH => err
		return
	rescue => err
	end
end

#wait_for_server(host, port = 22, interval = 20, max_retries = 5) ⇒ Object

Wait for a server to be online.

Parameters:

  • host —

    The host name to poll for a service.

  • port (defaults to: 22) —

    The service port to poll.

  • interval (defaults to: 20) —

    The wait time between two connection tries in seconds

  • max_retries (defaults to: 5) —

    The maximum number of connection retries

Returns:

  • :OK if server is reachable, :CONNECTION_REFUSED if the maximum number of retries was reached and the connection was refused, or :TIMED_OUT if either the overall timeout was reached or the maximum number of retries was reached and the connection timed out. May also return :UNKNOWN_ERROR on unknown error.



61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
 
# File 'lib/audit/lib/ssh_utils.rb', line 61

def wait_for_server(host, port = 22, interval = 20, max_retries = 5)
	for tries in 0 ... max_retries
		begin
			sock = TCPSocket.new(host, port)
			return :OK
		rescue Errno::ECONNREFUSED => ex
			return :CONNECTION_REFUSED if tries >= max_retries - 1
			@logger.debug {"Connection timed out, apparently server has not finished booting yet ... waiting #{interval}s\n"}
			sleep interval
		rescue Errno::ETIMEDOUT => ex
			return :TIMED_OUT if tries >= max_retries - 1
			@logger.debug {"Connection timed out, apparently server has not finished booting yet ... waiting #{interval}s\n"}
			sleep interval
		rescue Errno::EHOSTUNREACH => err
			return :TIMED_OUT if tries >= max_retries - 1
			@logger.debug {"No route to host, routes have not yet been set up ... waiting #{interval}s\n"}
			sleep interval
		end
	end
	
	return :UNKNOWN_ERROR
end