danvics/goldwarden
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Improve SSH context handling

Browse source
This commit is contained in:
Bernd Schoolmann 2024-01-19 07:32:41 +01:00
parent f75dcbd624
commit 64985fcaed
No known key found for this signature in database
2 changed files with 31 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
agent/sockets/callingcontext.go
View file

@ -16,6 +16,7 @@ type CallingContext struct {
ProcessPid int ProcessPid int
ParentProcessPid int ParentProcessPid int
GrandParentProcessPid int GrandParentProcessPid int
Error bool
} }
func GetCallingContext(connection net.Conn) CallingContext { func GetCallingContext(connection net.Conn) CallingContext {
@ -28,11 +29,23 @@ func GetCallingContext(connection net.Conn) CallingContext {
ProcessPid: 0, ProcessPid: 0,
ParentProcessPid: 0, ParentProcessPid: 0,
GrandParentProcessPid: 0, GrandParentProcessPid: 0,
Error: true,
} }
if err != nil { if err != nil {
return errorContext return errorContext
} }
pid, _ := creds.PID() uid, _ := creds.UserID()
username, err := user.LookupId(uid)
if err != nil {
return errorContext
}
errorContext.UserName = username.Username
pid, ok := creds.PID()
if !ok {
return errorContext
}
process, err := gops.FindProcess(pid) process, err := gops.FindProcess(pid)
if err != nil { if err != nil {
return errorContext return errorContext
@ -50,7 +63,6 @@ func GetCallingContext(connection net.Conn) CallingContext {
} }
} }
uid, _ := creds.UserID()
ppid := process.PPid() ppid := process.PPid()
if err != nil { if err != nil {
return errorContext return errorContext
@ -66,11 +78,6 @@ func GetCallingContext(connection net.Conn) CallingContext {
return errorContext return errorContext
} }
username, err := user.LookupId(uid)
if err != nil {
return errorContext
}
return CallingContext{ return CallingContext{
UserName: username.Username, UserName: username.Username,
ProcessName: process.Executable(), ProcessName: process.Executable(),
@ -79,5 +86,6 @@ func GetCallingContext(connection net.Conn) CallingContext {
ProcessPid: pid, ProcessPid: pid,
ParentProcessPid: ppid, ParentProcessPid: ppid,
GrandParentProcessPid: parentParentProcess.PPid(), GrandParentProcessPid: parentParentProcess.PPid(),
Error: false,
} }
} }

20
agent/ssh/ssh.go
View file

@ -107,11 +107,23 @@ func (vaultAgent vaultAgent) Sign(key ssh.PublicKey, data []byte) (*ssh.Signatur
isGit = true isGit = true
} }
requestTemplate := "%s on %s>%s>%s is requesting ssh signage with key %s" requestTemplate := ""
if isGit { message := ""
requestTemplate = "%s on %s>%s>%s is requesting git signage with key %s" if !vaultAgent.context.Error {
if isGit {
requestTemplate = "%s on %s>%s>%s is requesting git signage with key %s"
} else {
requestTemplate = "%s on %s>%s>%s is requesting ssh signage with key %s"
}
message = fmt.Sprintf(requestTemplate, vaultAgent.context.UserName, vaultAgent.context.GrandParentProcessName, vaultAgent.context.ParentProcessName, vaultAgent.context.ProcessName, sshKey.Name)
} else {
if isGit {
requestTemplate = "%s is requesting git signage with key %s"
} else {
requestTemplate = "%s is requesting ssh signage with key %s"
}
message = fmt.Sprintf(requestTemplate, vaultAgent.context.UserName, sshKey.Name)
} }
message := fmt.Sprintf(requestTemplate, vaultAgent.context.UserName, vaultAgent.context.GrandParentProcessName, vaultAgent.context.ParentProcessName, vaultAgent.context.ProcessName, sshKey.Name)
if approved, err := pinentry.GetApproval("SSH Key Signing Request", message); err != nil || !approved { if approved, err := pinentry.GetApproval("SSH Key Signing Request", message); err != nil || !approved {
log.Info("Sign Request for key: %s denied", sshKey.Name) log.Info("Sign Request for key: %s denied", sshKey.Name)