2018-04-07 20:04:10 +00:00
|
|
|
// hkexshd server
|
|
|
|
//
|
|
|
|
// Copyright (c) 2017-2018 Russell Magee
|
|
|
|
// Licensed under the terms of the MIT license (see LICENSE.mit in this
|
|
|
|
// distribution)
|
|
|
|
//
|
|
|
|
// golang implementation by Russ Magee (rmagee_at_gmail.com)
|
2018-01-06 15:30:56 +00:00
|
|
|
package main
|
|
|
|
|
|
|
|
import (
|
2018-01-13 06:24:40 +00:00
|
|
|
"flag"
|
2018-01-06 15:30:56 +00:00
|
|
|
"fmt"
|
2018-01-19 02:57:37 +00:00
|
|
|
"io"
|
2018-01-21 23:46:40 +00:00
|
|
|
"io/ioutil"
|
2018-01-06 15:30:56 +00:00
|
|
|
"log"
|
2018-01-21 04:37:27 +00:00
|
|
|
"os"
|
2018-01-18 00:39:01 +00:00
|
|
|
"os/exec"
|
|
|
|
"os/user"
|
2018-05-05 06:25:26 +00:00
|
|
|
"runtime"
|
2018-01-18 00:39:01 +00:00
|
|
|
"syscall"
|
2018-01-09 02:27:01 +00:00
|
|
|
|
2018-06-02 03:34:49 +00:00
|
|
|
"blitter.com/go/go_login"
|
2018-04-28 23:05:33 +00:00
|
|
|
hkexsh "blitter.com/go/hkexsh"
|
|
|
|
"blitter.com/go/hkexsh/spinsult"
|
2018-01-19 02:57:37 +00:00
|
|
|
"github.com/kr/pty"
|
2018-01-06 15:30:56 +00:00
|
|
|
)
|
|
|
|
|
2018-01-21 04:37:27 +00:00
|
|
|
type cmdSpec struct {
|
|
|
|
op []byte
|
|
|
|
who []byte
|
|
|
|
cmd []byte
|
|
|
|
authCookie []byte
|
2018-01-18 04:36:53 +00:00
|
|
|
status int
|
2018-01-18 00:39:01 +00:00
|
|
|
}
|
|
|
|
|
2018-01-19 02:57:37 +00:00
|
|
|
/* -------------------------------------------------------------- */
|
|
|
|
|
2018-03-26 04:47:38 +00:00
|
|
|
/*
|
|
|
|
// Run a command (via os.exec) as a specific user
|
2018-01-19 05:17:57 +00:00
|
|
|
//
|
|
|
|
// Uses ptys to support commands which expect a terminal.
|
2018-01-18 05:27:00 +00:00
|
|
|
func runCmdAs(who string, cmd string, conn hkex.Conn) (err error) {
|
2018-01-18 00:39:01 +00:00
|
|
|
u, _ := user.Lookup(who)
|
|
|
|
var uid, gid uint32
|
|
|
|
fmt.Sscanf(u.Uid, "%d", &uid)
|
|
|
|
fmt.Sscanf(u.Gid, "%d", &gid)
|
2018-01-18 05:27:00 +00:00
|
|
|
fmt.Println("uid:", uid, "gid:", gid)
|
2018-01-18 00:39:01 +00:00
|
|
|
|
|
|
|
args := strings.Split(cmd, " ")
|
|
|
|
arg0 := args[0]
|
|
|
|
args = args[1:]
|
|
|
|
c := exec.Command(arg0, args...)
|
|
|
|
c.SysProcAttr = &syscall.SysProcAttr{}
|
|
|
|
c.SysProcAttr.Credential = &syscall.Credential{Uid: uid, Gid: gid}
|
2018-01-18 05:27:00 +00:00
|
|
|
c.Stdin = conn
|
|
|
|
c.Stdout = conn
|
|
|
|
c.Stderr = conn
|
|
|
|
|
2018-01-19 02:57:37 +00:00
|
|
|
// Start the command with a pty.
|
|
|
|
ptmx, err := pty.Start(c) // returns immediately with ptmx file
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
// Make sure to close the pty at the end.
|
|
|
|
defer func() { _ = ptmx.Close() }() // Best effort.
|
|
|
|
// Copy stdin to the pty and the pty to stdout.
|
|
|
|
go func() { _, _ = io.Copy(ptmx, conn) }()
|
|
|
|
_, _ = io.Copy(conn, ptmx)
|
|
|
|
|
|
|
|
//err = c.Run() // returns when c finishes.
|
|
|
|
|
2018-01-18 00:39:01 +00:00
|
|
|
if err != nil {
|
|
|
|
log.Printf("Command finished with error: %v", err)
|
|
|
|
log.Printf("[%s]\n", cmd)
|
|
|
|
}
|
|
|
|
return
|
|
|
|
}
|
2018-03-26 04:47:38 +00:00
|
|
|
*/
|
2018-01-18 00:39:01 +00:00
|
|
|
|
2018-01-22 01:31:54 +00:00
|
|
|
// Run a command (via default shell) as a specific user
|
|
|
|
//
|
|
|
|
// Uses ptys to support commands which expect a terminal.
|
2018-05-26 20:43:09 +00:00
|
|
|
func runShellAs(who string, cmd string, interactive bool, conn hkexsh.Conn, chaffing bool) (err error) {
|
2018-01-22 01:31:54 +00:00
|
|
|
u, _ := user.Lookup(who)
|
|
|
|
var uid, gid uint32
|
|
|
|
fmt.Sscanf(u.Uid, "%d", &uid)
|
|
|
|
fmt.Sscanf(u.Gid, "%d", &gid)
|
2018-02-17 02:46:29 +00:00
|
|
|
log.Println("uid:", uid, "gid:", gid)
|
2018-01-22 01:31:54 +00:00
|
|
|
|
2018-01-27 00:15:39 +00:00
|
|
|
// Need to clear server's env and set key vars of the
|
|
|
|
// target user. This isn't perfect (TERM doesn't seem to
|
|
|
|
// work 100%; ANSI/xterm colour isn't working even
|
|
|
|
// if we set "xterm" or "ansi" here; and line count
|
|
|
|
// reported by 'stty -a' defaults to 24 regardless
|
|
|
|
// of client shell window used to run client.
|
|
|
|
// Investigate -- rlm 2018-01-26)
|
|
|
|
os.Clearenv()
|
|
|
|
os.Setenv("HOME", u.HomeDir)
|
|
|
|
os.Setenv("TERM", "vt102") // TODO: server or client option?
|
|
|
|
|
2018-01-22 01:31:54 +00:00
|
|
|
var c *exec.Cmd
|
|
|
|
if interactive {
|
2018-01-27 00:15:39 +00:00
|
|
|
c = exec.Command("/bin/bash", "-i", "-l")
|
2018-01-22 01:31:54 +00:00
|
|
|
} else {
|
|
|
|
c = exec.Command("/bin/bash", "-c", cmd)
|
|
|
|
}
|
2018-01-27 00:15:39 +00:00
|
|
|
//If os.Clearenv() isn't called by server above these will be seen in the
|
|
|
|
//client's session env.
|
|
|
|
//c.Env = []string{"HOME=" + u.HomeDir, "SUDO_GID=", "SUDO_UID=", "SUDO_USER=", "SUDO_COMMAND=", "MAIL=", "LOGNAME="+who}
|
|
|
|
c.Dir = u.HomeDir
|
2018-01-22 01:31:54 +00:00
|
|
|
c.SysProcAttr = &syscall.SysProcAttr{}
|
|
|
|
c.SysProcAttr.Credential = &syscall.Credential{Uid: uid, Gid: gid}
|
|
|
|
c.Stdin = conn
|
|
|
|
c.Stdout = conn
|
|
|
|
c.Stderr = conn
|
|
|
|
|
|
|
|
// Start the command with a pty.
|
|
|
|
ptmx, err := pty.Start(c) // returns immediately with ptmx file
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
// Make sure to close the pty at the end.
|
|
|
|
defer func() { _ = ptmx.Close() }() // Best effort.
|
2018-04-29 02:28:37 +00:00
|
|
|
|
|
|
|
// Watch for term resizes
|
|
|
|
go func() {
|
|
|
|
for sz := range conn.WinCh {
|
|
|
|
log.Printf("[Setting term size to: %v %v]\n", sz.Rows, sz.Cols)
|
|
|
|
pty.Setsize(ptmx, &pty.Winsize{Rows: sz.Rows, Cols: sz.Cols})
|
|
|
|
}
|
|
|
|
}()
|
|
|
|
|
2018-03-26 04:47:38 +00:00
|
|
|
// Copy stdin to the pty.. (bgnd goroutine)
|
|
|
|
go func() {
|
2018-06-27 03:14:43 +00:00
|
|
|
_, e := io.Copy(ptmx, conn)
|
|
|
|
if e != nil {
|
|
|
|
log.Printf("** std->pty ended **\n")
|
|
|
|
return
|
|
|
|
}
|
2018-03-26 04:47:38 +00:00
|
|
|
}()
|
2018-05-04 06:53:47 +00:00
|
|
|
|
2018-05-26 20:43:09 +00:00
|
|
|
if chaffing {
|
|
|
|
conn.EnableChaff()
|
|
|
|
}
|
2018-06-27 03:14:43 +00:00
|
|
|
defer conn.DisableChaff()
|
|
|
|
defer conn.ShutdownChaff()
|
2018-06-02 03:34:49 +00:00
|
|
|
|
2018-03-26 04:47:38 +00:00
|
|
|
// ..and the pty to stdout.
|
2018-06-27 03:14:43 +00:00
|
|
|
_, e := io.Copy(conn, ptmx)
|
|
|
|
if e != nil {
|
|
|
|
log.Printf("** pty->stdout ended **\n")
|
|
|
|
return
|
|
|
|
}
|
2018-01-22 01:31:54 +00:00
|
|
|
|
|
|
|
//err = c.Run() // returns when c finishes.
|
|
|
|
|
2018-03-27 04:58:42 +00:00
|
|
|
log.Printf("[%s]\n", cmd)
|
2018-01-22 01:31:54 +00:00
|
|
|
if err != nil {
|
|
|
|
log.Printf("Command finished with error: %v", err)
|
|
|
|
}
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2018-01-22 06:02:08 +00:00
|
|
|
func rejectUserMsg() string {
|
2018-01-23 21:53:05 +00:00
|
|
|
return "Begone, " + spinsult.GetSentence() + "\r\n"
|
2018-01-22 06:02:08 +00:00
|
|
|
}
|
|
|
|
|
2018-01-09 03:16:55 +00:00
|
|
|
// Demo of a simple server that listens and spawns goroutines for each
|
|
|
|
// connecting client. Note this code is identical to standard tcp
|
|
|
|
// server code, save for declaring 'hkex' rather than 'net'
|
|
|
|
// Listener and Conns. The KEx and encrypt/decrypt is done within the type.
|
|
|
|
// Compare to 'serverp.go' in this directory to see the equivalence.
|
2018-01-06 15:30:56 +00:00
|
|
|
func main() {
|
2018-05-13 01:41:39 +00:00
|
|
|
version := "0.1pre (NO WARRANTY)"
|
|
|
|
var vopt bool
|
2018-05-26 20:43:09 +00:00
|
|
|
var chaffEnabled bool
|
2018-05-07 00:41:09 +00:00
|
|
|
var chaffFreqMin uint
|
|
|
|
var chaffFreqMax uint
|
|
|
|
var chaffBytesMax uint
|
2018-01-21 23:46:40 +00:00
|
|
|
var dbg bool
|
2018-01-13 06:24:40 +00:00
|
|
|
var laddr string
|
|
|
|
|
2018-05-13 01:41:39 +00:00
|
|
|
flag.BoolVar(&vopt, "v", false, "show version")
|
2018-01-13 06:24:40 +00:00
|
|
|
flag.StringVar(&laddr, "l", ":2000", "interface[:port] to listen")
|
2018-05-26 20:43:09 +00:00
|
|
|
flag.BoolVar(&chaffEnabled, "cE", true, "enabled chaff pkts (default true)")
|
2018-05-07 00:41:09 +00:00
|
|
|
flag.UintVar(&chaffFreqMin, "cfm", 100, "chaff pkt freq min (msecs)")
|
|
|
|
flag.UintVar(&chaffFreqMax, "cfM", 5000, "chaff pkt freq max (msecs)")
|
|
|
|
flag.UintVar(&chaffBytesMax, "cbM", 64, "chaff pkt size max (bytes)")
|
2018-01-21 23:46:40 +00:00
|
|
|
flag.BoolVar(&dbg, "d", false, "debug logging")
|
2018-01-13 06:24:40 +00:00
|
|
|
flag.Parse()
|
|
|
|
|
2018-05-13 01:41:39 +00:00
|
|
|
if vopt {
|
2018-05-26 20:43:09 +00:00
|
|
|
fmt.Printf("version v%s\n", version)
|
2018-05-13 01:41:39 +00:00
|
|
|
os.Exit(0)
|
|
|
|
}
|
|
|
|
|
2018-01-21 23:46:40 +00:00
|
|
|
if dbg {
|
|
|
|
log.SetOutput(os.Stdout)
|
|
|
|
} else {
|
|
|
|
log.SetOutput(ioutil.Discard)
|
|
|
|
}
|
2018-01-18 05:27:00 +00:00
|
|
|
|
2018-01-06 15:30:56 +00:00
|
|
|
// Listen on TCP port 2000 on all available unicast and
|
|
|
|
// anycast IP addresses of the local system.
|
2018-04-04 22:43:27 +00:00
|
|
|
l, err := hkexsh.Listen("tcp", laddr)
|
2018-01-06 15:30:56 +00:00
|
|
|
if err != nil {
|
|
|
|
log.Fatal(err)
|
|
|
|
}
|
|
|
|
defer l.Close()
|
|
|
|
|
2018-02-17 02:46:29 +00:00
|
|
|
log.Println("Serving on", laddr)
|
2018-01-06 15:30:56 +00:00
|
|
|
for {
|
|
|
|
// Wait for a connection.
|
|
|
|
conn, err := l.Accept()
|
|
|
|
if err != nil {
|
2018-04-29 02:28:37 +00:00
|
|
|
log.Printf("Accept() got error(%v), hanging up.\n", err)
|
|
|
|
conn.Close()
|
2018-04-28 23:05:33 +00:00
|
|
|
//log.Fatal(err)
|
|
|
|
} else {
|
|
|
|
log.Println("Accepted client")
|
2018-01-06 15:30:56 +00:00
|
|
|
|
2018-05-07 00:41:09 +00:00
|
|
|
// Set up chaffing to client
|
2018-05-26 20:43:09 +00:00
|
|
|
// Will only start when runShellAs() is called
|
|
|
|
// after stdin/stdout are hooked up
|
2018-06-27 03:14:43 +00:00
|
|
|
conn.SetupChaff(chaffFreqMin, chaffFreqMax, chaffBytesMax) // configure server->client chaffing
|
2018-05-07 00:41:09 +00:00
|
|
|
|
2018-04-28 23:05:33 +00:00
|
|
|
// Handle the connection in a new goroutine.
|
|
|
|
// The loop then returns to accepting, so that
|
|
|
|
// multiple connections may be served concurrently.
|
|
|
|
go func(c hkexsh.Conn) (e error) {
|
|
|
|
defer c.Close()
|
2018-01-21 04:37:27 +00:00
|
|
|
|
2018-04-28 23:05:33 +00:00
|
|
|
//We use io.ReadFull() here to guarantee we consume
|
|
|
|
//just the data we want for the cmdSpec, and no more.
|
|
|
|
//Otherwise data will be sitting in the channel that isn't
|
|
|
|
//passed down to the command handlers.
|
|
|
|
var rec cmdSpec
|
|
|
|
var len1, len2, len3, len4 uint32
|
2018-03-26 04:47:38 +00:00
|
|
|
|
2018-04-28 23:05:33 +00:00
|
|
|
n, err := fmt.Fscanf(c, "%d %d %d %d\n", &len1, &len2, &len3, &len4)
|
|
|
|
log.Printf("cmdSpec read:%d %d %d %d\n", len1, len2, len3, len4)
|
2018-03-26 04:47:38 +00:00
|
|
|
|
2018-04-28 23:05:33 +00:00
|
|
|
if err != nil || n < 4 {
|
|
|
|
log.Println("[Bad cmdSpec fmt]")
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
//fmt.Printf(" lens:%d %d %d %d\n", len1, len2, len3, len4)
|
2018-01-21 04:37:27 +00:00
|
|
|
|
2018-04-28 23:05:33 +00:00
|
|
|
rec.op = make([]byte, len1, len1)
|
|
|
|
_, err = io.ReadFull(c, rec.op)
|
|
|
|
if err != nil {
|
|
|
|
log.Println("[Bad cmdSpec.op]")
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
rec.who = make([]byte, len2, len2)
|
|
|
|
_, err = io.ReadFull(c, rec.who)
|
|
|
|
if err != nil {
|
|
|
|
log.Println("[Bad cmdSpec.who]")
|
|
|
|
return err
|
|
|
|
}
|
2018-01-21 04:37:27 +00:00
|
|
|
|
2018-04-28 23:05:33 +00:00
|
|
|
rec.cmd = make([]byte, len3, len3)
|
|
|
|
_, err = io.ReadFull(c, rec.cmd)
|
|
|
|
if err != nil {
|
|
|
|
log.Println("[Bad cmdSpec.cmd]")
|
|
|
|
return err
|
|
|
|
}
|
2018-01-21 04:37:27 +00:00
|
|
|
|
2018-04-28 23:05:33 +00:00
|
|
|
rec.authCookie = make([]byte, len4, len4)
|
|
|
|
_, err = io.ReadFull(c, rec.authCookie)
|
|
|
|
if err != nil {
|
|
|
|
log.Println("[Bad cmdSpec.authCookie]")
|
|
|
|
return err
|
|
|
|
}
|
2018-03-26 02:58:04 +00:00
|
|
|
|
2018-04-28 23:05:33 +00:00
|
|
|
log.Printf("[cmdSpec: op:%c who:%s cmd:%s auth:****]\n",
|
|
|
|
rec.op[0], string(rec.who), string(rec.cmd))
|
2018-01-21 04:37:27 +00:00
|
|
|
|
2018-04-28 23:05:33 +00:00
|
|
|
valid, allowedCmds := hkexsh.AuthUser(string(rec.who), string(rec.authCookie), "/etc/hkexsh.passwd")
|
2018-05-05 06:25:26 +00:00
|
|
|
// Security scrub
|
|
|
|
for i := range rec.authCookie {
|
|
|
|
rec.authCookie[i] = 0
|
|
|
|
}
|
|
|
|
runtime.GC()
|
|
|
|
|
2018-04-28 23:05:33 +00:00
|
|
|
if !valid {
|
|
|
|
log.Println("Invalid user", string(rec.who))
|
|
|
|
c.Write([]byte(rejectUserMsg()))
|
|
|
|
return
|
|
|
|
}
|
|
|
|
log.Printf("[allowedCmds:%s]\n", allowedCmds)
|
2018-01-22 06:02:08 +00:00
|
|
|
|
2018-04-28 23:05:33 +00:00
|
|
|
if rec.op[0] == 'c' {
|
|
|
|
// Non-interactive command
|
|
|
|
log.Println("[Running command]")
|
2018-05-26 20:43:09 +00:00
|
|
|
runShellAs(string(rec.who), string(rec.cmd), false, conn, chaffEnabled)
|
2018-04-28 23:05:33 +00:00
|
|
|
// Returned hopefully via an EOF or exit/logout;
|
|
|
|
// Clear current op so user can enter next, or EOF
|
|
|
|
rec.op[0] = 0
|
|
|
|
log.Println("[Command complete]")
|
|
|
|
} else if rec.op[0] == 's' {
|
|
|
|
log.Println("[Running shell]")
|
2018-06-02 03:34:49 +00:00
|
|
|
utmpx := go_login.Put_utmp(string(rec.who), string("todo.example.org"))
|
|
|
|
defer func() { go_login.Unput_utmp(utmpx) }()
|
|
|
|
go_login.Put_lastlog_entry("hkexsh", string(rec.who), string("todo.example.org"))
|
2018-05-26 20:43:09 +00:00
|
|
|
runShellAs(string(rec.who), string(rec.cmd), true, conn, chaffEnabled)
|
2018-04-28 23:05:33 +00:00
|
|
|
// Returned hopefully via an EOF or exit/logout;
|
|
|
|
// Clear current op so user can enter next, or EOF
|
|
|
|
rec.op[0] = 0
|
|
|
|
log.Println("[Exiting shell]")
|
|
|
|
} else {
|
|
|
|
log.Println("[Bad cmdSpec]")
|
|
|
|
}
|
|
|
|
return
|
|
|
|
}(conn)
|
|
|
|
} // Accept() success
|
2018-01-21 04:37:27 +00:00
|
|
|
} //endfor
|
2018-02-17 02:46:29 +00:00
|
|
|
log.Println("[Exiting]")
|
2018-01-06 15:30:56 +00:00
|
|
|
}
|