danvics/goldwarden
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Lock down session auth mode

Browse source
This commit is contained in:
Bernd Schoolmann 2024-02-09 19:32:01 +01:00
parent f1395d4b6d
commit 35cc409943
No known key found for this signature in database
4 changed files with 18 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
agent/actions/actions.go
View file

@ -103,7 +103,7 @@ func ensureIsNotLocked(action Action) Action {
} }
} }
systemauth.CreatePinSession(*ctx) systemauth.CreatePinSession(*ctx, systemauth.SSHTTL)
} }
return action(request, cfg, vault, ctx) return action(request, cfg, vault, ctx)

4
agent/ssh/ssh.go
View file

@ -40,7 +40,7 @@ func (vaultAgent vaultAgent) List() ([]*agent.Key, error) {
return nil, errors.New("vault is locked") return nil, errors.New("vault is locked")
} }
systemauth.CreatePinSession(vaultAgent.context) systemauth.CreatePinSession(vaultAgent.context, systemauth.SSHTTL)
} }
vaultSSHKeys := (*vaultAgent.vault).GetSSHKeys() vaultSSHKeys := (*vaultAgent.vault).GetSSHKeys()
@ -87,7 +87,7 @@ func (vaultAgent vaultAgent) Sign(key ssh.PublicKey, data []byte) (*ssh.Signatur
return nil, errors.New("vault is locked") return nil, errors.New("vault is locked")
} }
systemauth.CreatePinSession(vaultAgent.context) systemauth.CreatePinSession(vaultAgent.context, systemauth.SSHTTL)
} }
var signer ssh.Signer var signer ssh.Signer

13
agent/systemauth/systemauth.go
View file

@ -14,7 +14,8 @@ import (
var log = logging.GetLogger("Goldwarden", "Systemauth") var log = logging.GetLogger("Goldwarden", "Systemauth")
const tokenExpiry = 10 * time.Minute const tokenExpiry = 60 * time.Minute
const SSHTTL = 60 * time.Minute
type SessionType string type SessionType string
@ -40,12 +41,12 @@ type SessionStore struct {
Store []Session Store []Session
} }
func (s *SessionStore) CreateSession(pid int, parentpid int, grandparentpid int, sessionType SessionType) Session { func (s *SessionStore) CreateSession(pid int, parentpid int, grandparentpid int, sessionType SessionType, ttl time.Duration) Session {
var session = Session{ var session = Session{
Pid: pid, Pid: pid,
ParentPid: parentpid, ParentPid: parentpid,
GrandParentPid: grandparentpid, GrandParentPid: grandparentpid,
Expires: time.Now().Add(tokenExpiry), Expires: time.Now().Add(ttl),
sessionType: sessionType, sessionType: sessionType,
} }
s.Store = append(s.Store, session) s.Store = append(s.Store, session)
@ -107,7 +108,7 @@ func GetPermission(sessionType SessionType, ctx sockets.CallingContext, config *
// } // }
log.Info("Permission granted, creating session") log.Info("Permission granted, creating session")
sessionStore.CreateSession(ctx.ProcessPid, ctx.ParentProcessPid, ctx.GrandParentProcessPid, sessionType) sessionStore.CreateSession(ctx.ProcessPid, ctx.ParentProcessPid, ctx.GrandParentProcessPid, sessionType, tokenExpiry)
} }
return true, nil return true, nil
} }
@ -128,8 +129,8 @@ func CheckBiometrics(callingContext *sockets.CallingContext, approvalType biomet
return approval return approval
} }
func CreatePinSession(ctx sockets.CallingContext) { func CreatePinSession(ctx sockets.CallingContext, ttl time.Duration) Session {
sessionStore.CreateSession(ctx.ProcessPid, ctx.ParentProcessPid, ctx.GrandParentProcessPid, Pin) return sessionStore.CreateSession(ctx.ProcessPid, ctx.ParentProcessPid, ctx.GrandParentProcessPid, Pin, ttl)
} }
func VerifyPinSession(ctx sockets.CallingContext) bool { func VerifyPinSession(ctx sockets.CallingContext) bool {

15
agent/unixsocketagent.go
View file

@ -2,6 +2,7 @@ package agent
import ( import (
"context" "context"
"crypto/subtle"
"encoding/json" "encoding/json"
"fmt" "fmt"
"net" "net"
@ -65,17 +66,17 @@ func serveAgentSession(c net.Conn, vault *vault.Vault, cfg *config.Config) {
// todo refactor to other file // todo refactor to other file
if msg.Type == messages.MessageTypeForEmptyPayload(messages.SessionAuthRequest{}) { if msg.Type == messages.MessageTypeForEmptyPayload(messages.SessionAuthRequest{}) {
log.Info("Received session auth request")
req := messages.ParsePayload(msg).(messages.SessionAuthRequest) req := messages.ParsePayload(msg).(messages.SessionAuthRequest)
fmt.Println("Daemontoken", cfg.ConfigFile.RuntimeConfig.DaemonAuthToken) verified := subtle.ConstantTimeCompare([]byte(cfg.ConfigFile.RuntimeConfig.DaemonAuthToken), []byte(req.Token)) == 1
fmt.Println("Token", req.Token)
fmt.Println(len(cfg.ConfigFile.RuntimeConfig.DaemonAuthToken), len(req.Token))
payload := messages.SessionAuthResponse{ payload := messages.SessionAuthResponse{
Verified: cfg.ConfigFile.RuntimeConfig.DaemonAuthToken == req.Token, Verified: verified,
} }
log.Info("Verified: %t", payload.Verified) log.Info("Verified: %t", verified)
callingContext := sockets.GetCallingContext(c) callingContext := sockets.GetCallingContext(c)
systemauth.CreatePinSession(callingContext) if verified {
systemauth.CreatePinSession(callingContext, 365*24*time.Hour) // permanent session
}
responsePayload, err := messages.IPCMessageFromPayload(payload) responsePayload, err := messages.IPCMessageFromPayload(payload)
if err != nil { if err != nil {