Compare commits
15 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 wmantly
|
57d0600fc0 | ||
|
wmantly
|
fedbe81690 | ||
|
wmantly
|
a7b3416619 | ||
|
wmantly
|
f357c89ac7 | ||
|
wmantly
|
b9415dcb17 | ||
|
wmantly
|
65ba1b16e3 | ||
|
wmantly
|
8c4ec67282 | ||
|
wmantly
|
36e7dbf8aa | ||
|
wmantly
|
c56bfe21e5 | ||
|
wmantly
|
d533a94718 | ||
|
wmantly
|
fe18393d4e | ||
|
wmantly
|
e41e7ff9e1 | ||
|
wmantly
|
1100872152 | ||
|
wmantly
|
16ab12a61c | ||
|
wmantly
|
0f6be51c35 |
@@ -1,3 +1,12 @@
|
||||
## v1.19.0
|
||||
- fix: **only catalog hosts are jump targets.** `isManagedHost` treated a missing `metadata.managed` flag as permission, so any host the SSO merely *discovered* — an unpromoted Proxmox guest, a UniFi client — was offered in the TUI picker and accepted by the username grammar. The filter is now `isCatalogHost`, mirroring the SSO Directory's own rule: a resource carrying `discovery_sources` but never promoted is excluded, while hand-created hosts (no `discovery_sources`) and promoted ones (`managed: true`) are included, and an explicit `managed: false` is always excluded.
|
||||
- test: regression coverage for all five cases (hand-made, discovered-unpromoted, discovered-promoted, `manual` source, explicitly unmanaged).
|
||||
- docs: `docs/connecting.md` states that discovery results are not jump targets until promoted into the catalog.
|
||||
|
||||
## v1.18.0
|
||||
- feat: Add SSO-style error page (404/500) for browser navigation instead of a bare text response
|
||||
- feat: navbar — username no longer underlined; only the active link is bold + underlined
|
||||
|
||||
## v1.16.1
|
||||
- fix: remove missing DEPLOYMENT.md from Docker build context
|
||||
|
||||
|
||||
@@ -0,0 +1,83 @@
|
||||
# Deployment
|
||||
|
||||
Three ways to run the jump host, in increasing manual effort.
|
||||
|
||||
## 1. Unified theta-env stack
|
||||
|
||||
Set in `theta-env/setup.env`:
|
||||
|
||||
```
|
||||
CFG_JUMP_HOST_ENABLED=true
|
||||
CFG_JUMP_HOST=jump.example.com
|
||||
JUMP_SSH_PORT=2222
|
||||
```
|
||||
|
||||
Re-run `./setup.sh`. It builds the submodule, writes `config/jump-secrets.js`,
|
||||
mints the SSO API token, grants the `sshPublicKey` write-ACL to the shared
|
||||
`cn=ldapclient` bind account, registers `jump.example.com` in the proxy, and
|
||||
seeds a directory entry.
|
||||
|
||||
Expose SSH: forward the public host's `:22` (or `:2222`) to the container's
|
||||
published `JUMP_SSH_PORT`.
|
||||
|
||||
## 2. Standalone Docker
|
||||
|
||||
```
|
||||
cp secrets.js.example config/jump-secrets.js
|
||||
$EDITOR config/jump-secrets.js # LDAP bind (+ sshPublicKey write ACL), SSO url + token
|
||||
docker compose up -d --build
|
||||
```
|
||||
|
||||
Host keys persist in the `jump-data` volume. The web UI is on `:3002`; front it
|
||||
with your own TLS/proxy.
|
||||
|
||||
## 3. Bare metal
|
||||
|
||||
```
|
||||
curl -fsSL https://raw.githubusercontent.com/theta42/jump-host/master/ops/install.sh | sudo bash
|
||||
sudo $EDITOR /etc/jump-host/secrets.js
|
||||
sudo systemctl restart jump-host
|
||||
journalctl -u jump-host -f
|
||||
```
|
||||
|
||||
`ops/install.sh` installs Node 22 + Redis, hard-resets the checkout at
|
||||
`/opt/theta42/jump-host` to the remote branch, symlinks the systemd unit, and
|
||||
runs `npm ci`. Idempotent — re-run to update. Overridable via `REPO_DIR=`,
|
||||
`BRANCH=`, `SECRETS_FILE=`.
|
||||
|
||||
## The LDAP write-ACL (required)
|
||||
|
||||
The bind account must be able to write the `sshPublicKey` attribute so the jump
|
||||
host can inject its key. In the bundled OpenLDAP (`slapd.conf` / `olc`):
|
||||
|
||||
```
|
||||
access to attrs=sshPublicKey
|
||||
by dn.exact="cn=ldapclient,ou=people,dc=example,dc=com" write
|
||||
by self write
|
||||
by * read
|
||||
```
|
||||
|
||||
Without it, key injection fails and every bridge attempt is audited
|
||||
`key-inject-failed`.
|
||||
|
||||
## Listening on port 22
|
||||
|
||||
Default is 2222 (unprivileged). For 22: set `ssh.listenPort: 22`, and either
|
||||
|
||||
- systemd: uncomment `AmbientCapabilities=CAP_NET_BIND_SERVICE` in the unit; or
|
||||
- Docker: publish `22:22`; or
|
||||
- firewall: DNAT `22 → 2222`.
|
||||
|
||||
## Verifying
|
||||
|
||||
```
|
||||
# from a client whose key is in your LDAP sshPublicKey
|
||||
ssh -p 2222 youruid@jump.example.com # TUI picker
|
||||
ssh -p 2222 youruid_-_somehost@jump.example.com
|
||||
sftp -P 2222 youruid_-_somehost@jump.example.com
|
||||
|
||||
curl -s http://localhost:3002/health
|
||||
```
|
||||
|
||||
Watch `journalctl -u jump-host -f` (or `docker logs -f jump-host`) and the
|
||||
audit log at `/audit` in the web UI.
|
||||
@@ -0,0 +1,24 @@
|
||||
# Documentation
|
||||
|
||||
This directory is the GitHub Pages documentation site for the Jump Host project.
|
||||
|
||||
**Live site:** https://theta42.github.io/jump-host/
|
||||
|
||||
## Pages
|
||||
|
||||
- `index.md` — overview and quick start
|
||||
- `connecting.md` — usage: the username grammar, the TUI picker, SFTP/WinSCP
|
||||
- `architecture.md` — how auth, access resolution, key injection, and bridging work
|
||||
- `installation.md` — Docker, bare-metal, and theta-env install; the LDAP write-ACL
|
||||
|
||||
## Local preview
|
||||
|
||||
```bash
|
||||
gem install jekyll bundler
|
||||
cd docs && jekyll serve
|
||||
# http://localhost:4000/jump-host/
|
||||
```
|
||||
|
||||
## Updating
|
||||
|
||||
Edit the markdown, push to `master`, and GitHub Pages rebuilds automatically.
|
||||
@@ -0,0 +1,41 @@
|
||||
title: Jump Host
|
||||
description: An SSH jump host for the theta42 stack — directory-driven host bridging with audit and metrics; LDAP + SSO Manager by default, or fully standalone.
|
||||
url: "https://theta42.github.io"
|
||||
baseurl: "/jump-host"
|
||||
logo: /assets/img/theta42.svg
|
||||
lang: en_US
|
||||
|
||||
plugins:
|
||||
- jekyll-seo-tag
|
||||
- jekyll-sitemap
|
||||
|
||||
github:
|
||||
repository_url: https://github.com/theta42/jump-host
|
||||
zip_url: https://github.com/theta42/jump-host/archive/refs/heads/master.zip
|
||||
tar_url: https://github.com/theta42/jump-host/archive/refs/heads/master.tar.gz
|
||||
repository_name: theta42/jump-host
|
||||
|
||||
nav:
|
||||
- title: Home
|
||||
page: /
|
||||
icon: fa-house
|
||||
- title: Connecting
|
||||
page: /connecting.html
|
||||
icon: fa-terminal
|
||||
- title: Architecture
|
||||
page: /architecture.html
|
||||
icon: fa-sitemap
|
||||
- title: Installation
|
||||
page: /installation.html
|
||||
icon: fa-download
|
||||
- title: Changelog
|
||||
url: https://github.com/theta42/jump-host/blob/master/CHANGELOG.md
|
||||
icon: fa-list
|
||||
|
||||
defaults:
|
||||
- scope:
|
||||
path: ""
|
||||
type: "pages"
|
||||
values:
|
||||
layout: default
|
||||
image: /assets/img/theta42.svg
|
||||
@@ -0,0 +1,82 @@
|
||||
<!doctype html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
|
||||
<link rel="icon" type="image/svg+xml" href="{{ '/assets/img/favicon.svg' | relative_url }}">
|
||||
|
||||
{% seo title=false %}
|
||||
<title>{% if page.title %}{{ page.title }} · {% endif %}{{ site.title }}</title>
|
||||
|
||||
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css">
|
||||
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.2/css/all.min.css">
|
||||
<link rel="stylesheet" href="{{ '/assets/css/style.css' | relative_url }}">
|
||||
</head>
|
||||
<body class="d-flex flex-column min-vh-100">
|
||||
|
||||
<nav class="navbar navbar-expand-md navbar-dark bg-dark fixed-top">
|
||||
<div class="container-fluid px-3">
|
||||
<a class="navbar-brand d-flex align-items-center" href="{{ '/' | relative_url }}">
|
||||
<img src="{{ '/assets/img/theta42.svg' | relative_url }}" height="28" class="me-2" alt="">
|
||||
{{ site.title }}
|
||||
</a>
|
||||
<button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#navMain" aria-controls="navMain" aria-expanded="false" aria-label="Toggle navigation">
|
||||
<span class="navbar-toggler-icon"></span>
|
||||
</button>
|
||||
<div class="collapse navbar-collapse justify-content-end" id="navMain">
|
||||
<ul class="navbar-nav">
|
||||
{% for item in site.nav %}
|
||||
<li class="nav-item">
|
||||
{% if item.page %}
|
||||
<a class="nav-link{% if page.url == item.page %} active{% endif %}" href="{{ item.page | relative_url }}">
|
||||
{% if item.icon %}<i class="fa-solid {{ item.icon }}"></i>{% endif %} {{ item.title }}
|
||||
</a>
|
||||
{% else %}
|
||||
<a class="nav-link" href="{{ item.url }}" target="_blank" rel="noopener">
|
||||
{% if item.icon %}<i class="fa-solid {{ item.icon }}"></i>{% endif %} {{ item.title }}
|
||||
</a>
|
||||
{% endif %}
|
||||
</li>
|
||||
{% endfor %}
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
</nav>
|
||||
|
||||
<main class="flex-grow-1" style="margin-top: 4.5rem;">
|
||||
<div class="container-fluid py-4 py-md-5">
|
||||
<div class="row justify-content-center">
|
||||
<div class="col-12 col-lg-10 col-xl-8">
|
||||
<div class="card shadow-lg">
|
||||
<div class="card-body p-4 p-md-5 site-content">
|
||||
{{ content }}
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
|
||||
<footer class="py-3 bg-dark text-light mt-auto">
|
||||
<div class="container-fluid d-flex flex-wrap justify-content-between align-items-center small gap-2 px-3">
|
||||
<span class="d-flex align-items-center gap-2">
|
||||
<a href="https://theta42.com" target="_blank" rel="noopener">
|
||||
<img width="40" src="{{ '/assets/img/theta42.svg' | relative_url }}" alt="theta42">
|
||||
</a>
|
||||
© {{ 'now' | date: '%Y' }} theta42 ·
|
||||
<a href="{{ site.github.repository_url }}/blob/master/LICENSE" target="_blank" rel="noopener" class="text-light">MIT License</a>
|
||||
</span>
|
||||
<span class="d-flex align-items-center gap-3">
|
||||
<a href="{{ site.github.repository_url }}" target="_blank" rel="noopener" class="text-light text-decoration-none">
|
||||
<i class="fa-brands fa-github"></i> GitHub
|
||||
</a>
|
||||
<a href="{{ site.github.repository_url }}/blob/master/CHANGELOG.md" target="_blank" rel="noopener" class="text-light text-decoration-none">
|
||||
<i class="fa-solid fa-list"></i> Changelog
|
||||
</a>
|
||||
</span>
|
||||
</div>
|
||||
</footer>
|
||||
|
||||
<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,147 @@
|
||||
---
|
||||
layout: default
|
||||
title: Architecture
|
||||
description: How the jump host authenticates users, resolves reachable hosts from the directory, injects per-user keys, and bridges SSH — plus the web UI and audit model.
|
||||
---
|
||||
|
||||
# Architecture
|
||||
|
||||
The jump host is a Node.js service (using [`ssh2`](https://github.com/mscdex/ssh2)
|
||||
as both an SSH **server** and **client**) with two faces: the SSH front door
|
||||
(default `:2222`) and a web UI/API (`:3002`). It holds no user database of its
|
||||
own — identity, authorization, and onward credentials all come from the shared
|
||||
directory.
|
||||
|
||||
```
|
||||
┌────────────────────── jump host ──────────────────────┐
|
||||
ssh │ ssh2 Server (:2222) │ ssh2 Client
|
||||
─────┼─▶ 1. authenticate user ──▶ LDAP (sshPublicKey / bind) │ ───────────▶ downstream
|
||||
user │ 2. resolve target ──▶ SSO /api/discovery │ sshd (as the
|
||||
│ 3. inject key ──▶ LDAP (add sshPublicKey) │ real user)
|
||||
│ 4. bridge channels ◀───────────────────────────────▶ │
|
||||
│ web UI/API (:3002) ──▶ audit + metrics (redis) │
|
||||
└───────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
## 1. Inbound authentication
|
||||
|
||||
When a user connects, the jump host authenticates them against LDAP:
|
||||
|
||||
- **Public key** — it looks up the user's `sshPublicKey` values in the directory
|
||||
and matches the offered key (handling ssh2's probe-then-sign two-phase
|
||||
publickey auth). The jump host's *own* injected key (identified by its comment
|
||||
marker) is deliberately excluded from this match — only the jump host may hold
|
||||
that private key, so accepting it inbound would be a bypass.
|
||||
- **Password** — an LDAP simple bind as the user's DN. Policy is configurable:
|
||||
`off` (keys only — recommended for a public host), `local` (passwords only
|
||||
from loopback/RFC1918 clients, keys-only from the internet), or `all`.
|
||||
|
||||
Every attempt — success or failure, with method and reason — is audited.
|
||||
|
||||
## 2. Access & target resolution
|
||||
|
||||
The hosts a user may reach are computed from the directory, not a local list:
|
||||
|
||||
1. The user's LDAP group memberships (`(&(objectClass=groupOfNames)(member=…))`).
|
||||
2. For each group, the SSO's
|
||||
`GET /api/discovery/resources?group=<cn>` (authenticated with an API token),
|
||||
unioned and filtered to `kind: host`.
|
||||
|
||||
Each host's dial address is `metadata.ip` (or the hostname from
|
||||
`metadata.address`) and port `metadata.sshPort` (default 22). Results are cached
|
||||
briefly per user and shared by both the grammar path and the TUI picker.
|
||||
|
||||
Target matching tries, in order: exact slug → `host_`-prefixed slug → display
|
||||
name → IP → address hostname. A raw IP that isn't an accessible directory host
|
||||
is refused unless explicitly allowed.
|
||||
|
||||
> The directory auto-creates `<slug>_access` / `<slug>_admin` groups for every
|
||||
> host and service (see the SSO's
|
||||
> [Directory & Inventory](https://theta42.github.io/sso-manager-node/directory.html)
|
||||
> docs), which is exactly what this authorization reads.
|
||||
|
||||
## 3. Per-user key injection {#per-user-key-injection}
|
||||
|
||||
The jump host holds **one** keypair. To connect downstream *as the user*
|
||||
without asking them for anything, it must present a key the downstream `sshd`
|
||||
will accept for that user. Downstream hosts (joined via
|
||||
[ldap-client](https://github.com/theta42/ldap-client)) serve authorized keys
|
||||
straight from LDAP via `AuthorizedKeysCommand`. So on a user's first connection,
|
||||
the jump host appends its own public key to that user's `sshPublicKey` attribute
|
||||
in LDAP — comment-marked so it's recognizable — then connects downstream with
|
||||
its private key.
|
||||
|
||||
- Idempotent: the key is added once; a redis flag skips the LDAP round-trip
|
||||
afterwards.
|
||||
- The jump host's bind account therefore needs **write access to the
|
||||
`sshPublicKey` attribute** on user entries (an OpenLDAP ACL — see the README).
|
||||
In the bundled theta-env deployment this is handled for you.
|
||||
- Because the marker key is excluded from inbound auth (step 1), it grants only
|
||||
the jump host's onward path, never inbound impersonation.
|
||||
|
||||
## 4. Bridging
|
||||
|
||||
Once the upstream connection is ready, the jump host splices SSH channels
|
||||
between the two connections:
|
||||
|
||||
- **shell / exec** — piped both ways, with window-change and exit-status
|
||||
forwarded.
|
||||
- **SFTP subsystem** — the two subsystem channels are raw-piped as opaque bytes;
|
||||
no SFTP protocol parsing is needed, which is why WinSCP and `sftp` work
|
||||
unchanged.
|
||||
- Channel requests that arrive before the upstream is ready are buffered and
|
||||
replayed, so nothing is dropped during the connect.
|
||||
- The downstream host key's SHA256 fingerprint is recorded in the audit event
|
||||
(trust-on-use in v1).
|
||||
|
||||
Byte counts per direction are tallied cheaply for the audit record.
|
||||
|
||||
## Web UI, API & audit
|
||||
|
||||
An Express + EJS + Bootstrap app on `:3002` — the same front-end stack and
|
||||
look/feel as the SSO Manager and Proxy. Login is OIDC against the SSO plus a
|
||||
local anti-lockout admin (`auth.adminUsers`), with admin access gated by
|
||||
`auth.adminGroups`. It exposes:
|
||||
|
||||
- `GET /health` — open; `{status, activeSessions, version}`
|
||||
- `GET /api/sessions` — active sessions
|
||||
- `GET /api/audit?page=&uid=&target=&status=` — the paged audit log
|
||||
- `GET /api/metrics` — counters (total, failures, top users/hosts)
|
||||
|
||||
Audit events and counters live in redis. Each event captures: user, auth method,
|
||||
mode (grammar/picker), target slug/address/port, channel type, client IP,
|
||||
success + failure reason, downstream host-key fingerprint, timing, and bytes in/out.
|
||||
|
||||
## Standalone mode
|
||||
|
||||
Everything above describes the default backend. Set `standalone.enabled: true`
|
||||
and two modules become conditional facades, swapping their entire
|
||||
implementation at `require` time based on that flag — nothing else in the
|
||||
codebase (`ssh_server.js`, `bridge.js`, `key_inject.js`, `tui_picker.js`, the
|
||||
web UI) changes or even knows which mode it's running in:
|
||||
|
||||
- **`models/user_ldap.js`** — LDAP client, or `models/user_file.js` (an
|
||||
[@simpleworkjs/orm](https://www.npmjs.com/package/@simpleworkjs/orm)-backed
|
||||
store implementing the same `getUser` / `getGroups` / `checkPassword` /
|
||||
`addSshKey` interface).
|
||||
- **`utils/access.js`** — LDAP groups + SSO `/api/discovery`, or
|
||||
`utils/hosts_file.js` (same ORM package, same `accessibleHosts()` interface).
|
||||
In standalone mode there's no group-based authorization: every stored host
|
||||
is accessible to every stored user.
|
||||
|
||||
The ORM is Sequelize underneath, defaulting to a local SQLite file but
|
||||
accepting any Sequelize-supported dialect via `conf.orm`. See
|
||||
[Installation](installation.html#standalone-mode) for config and how to add
|
||||
users/hosts (there's no admin UI for standalone data yet).
|
||||
|
||||
## Where it sits in the stack
|
||||
|
||||
- **[SSO Manager](https://theta42.github.io/sso-manager-node/)** — provides the
|
||||
OpenLDAP directory (users, groups, `sshPublicKey`) and the inventory API this
|
||||
jump host reads.
|
||||
- **[ldap-client](https://github.com/theta42/ldap-client)** — enrolls the
|
||||
downstream Linux hosts (SSSD/PAM + `AuthorizedKeysCommand`) that the jump host
|
||||
connects into.
|
||||
- **[Proxy](https://theta42.github.io/proxy/)** — fronts the jump host's web UI
|
||||
under TLS.
|
||||
- **[theta-env](https://theta42.github.io/theta-env/)** — wires it all together.
|
||||
@@ -0,0 +1,116 @@
|
||||
/* theta42 docs site — shares the in-app dark navbar/footer + card look
|
||||
(Bootstrap 5 + Font Awesome, same as the running apps) rather than a
|
||||
generic Jekyll theme. */
|
||||
|
||||
body {
|
||||
background-color: #f4f5f6;
|
||||
}
|
||||
|
||||
.navbar-brand img {
|
||||
filter: drop-shadow(0 0 2px rgba(0, 0, 0, .4));
|
||||
}
|
||||
|
||||
.navbar-nav .nav-link.active {
|
||||
color: #fff;
|
||||
font-weight: 600;
|
||||
}
|
||||
|
||||
/* Markdown content typography, scoped to the card body so it doesn't leak
|
||||
into the nav/footer. */
|
||||
.site-content h1:first-child {
|
||||
margin-top: 0;
|
||||
}
|
||||
|
||||
.site-content h1,
|
||||
.site-content h2,
|
||||
.site-content h3 {
|
||||
font-weight: 700;
|
||||
}
|
||||
|
||||
.site-content h2 {
|
||||
margin-top: 2.5rem;
|
||||
padding-bottom: .4rem;
|
||||
border-bottom: 1px solid #e9ecef;
|
||||
}
|
||||
|
||||
.site-content h3 {
|
||||
margin-top: 1.75rem;
|
||||
}
|
||||
|
||||
.site-content a {
|
||||
color: #a3671f;
|
||||
text-decoration-color: rgba(163, 103, 31, .35);
|
||||
}
|
||||
|
||||
.site-content a:hover {
|
||||
color: #8a5a16;
|
||||
}
|
||||
|
||||
.site-content pre {
|
||||
background-color: #212529;
|
||||
color: #f8f9fa;
|
||||
padding: 1rem 1.25rem;
|
||||
border-radius: .375rem;
|
||||
overflow-x: auto;
|
||||
}
|
||||
|
||||
.site-content code {
|
||||
color: #a3671f;
|
||||
background-color: #f4f0e8;
|
||||
padding: .15em .4em;
|
||||
border-radius: .25rem;
|
||||
font-size: .875em;
|
||||
}
|
||||
|
||||
.site-content pre code {
|
||||
color: inherit;
|
||||
background: none;
|
||||
padding: 0;
|
||||
}
|
||||
|
||||
.site-content table {
|
||||
display: block;
|
||||
overflow-x: auto;
|
||||
width: 100%;
|
||||
border-collapse: collapse;
|
||||
margin: 1.25rem 0;
|
||||
}
|
||||
|
||||
.site-content table th,
|
||||
.site-content table td {
|
||||
border: 1px solid #dee2e6;
|
||||
padding: .5rem .75rem;
|
||||
text-align: left;
|
||||
}
|
||||
|
||||
.site-content table th {
|
||||
background-color: #f8f9fa;
|
||||
}
|
||||
|
||||
.site-content blockquote {
|
||||
border-left: 4px solid #C59341;
|
||||
padding: .5rem 1rem;
|
||||
margin: 1.25rem 0;
|
||||
background-color: #f8f6f1;
|
||||
color: #495057;
|
||||
}
|
||||
|
||||
.site-content img {
|
||||
max-width: 100%;
|
||||
height: auto;
|
||||
}
|
||||
|
||||
/* Screenshot grids in the markdown use width="49%" inline attrs for a
|
||||
two-up desktop layout -- stack them on narrow screens instead of
|
||||
squeezing to illegibility. */
|
||||
@media (max-width: 576px) {
|
||||
.site-content img[width] {
|
||||
width: 100% !important;
|
||||
margin-bottom: .75rem;
|
||||
}
|
||||
}
|
||||
|
||||
.site-content hr {
|
||||
margin: 2rem 0;
|
||||
border-top: 1px solid #e9ecef;
|
||||
}
|
||||
@@ -0,0 +1,17 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">
|
||||
<!-- Background circle -->
|
||||
<circle cx="50" cy="50" r="48" fill="#1a1a1a" stroke="#4a9eff" stroke-width="3"/>
|
||||
|
||||
<!-- Network nodes -->
|
||||
<circle cx="30" cy="30" r="8" fill="#4a9eff"/>
|
||||
<circle cx="70" cy="30" r="8" fill="#4a9eff"/>
|
||||
<circle cx="50" cy="50" r="10" fill="#66b3ff"/>
|
||||
<circle cx="30" cy="70" r="8" fill="#4a9eff"/>
|
||||
<circle cx="70" cy="70" r="8" fill="#4a9eff"/>
|
||||
|
||||
<!-- Connection lines -->
|
||||
<line x1="30" y1="30" x2="50" y2="50" stroke="#4a9eff" stroke-width="2"/>
|
||||
<line x1="70" y1="30" x2="50" y2="50" stroke="#4a9eff" stroke-width="2"/>
|
||||
<line x1="30" y1="70" x2="50" y2="50" stroke="#4a9eff" stroke-width="2"/>
|
||||
<line x1="70" y1="70" x2="50" y2="50" stroke="#4a9eff" stroke-width="2"/>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 788 B |
@@ -0,0 +1,51 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 400 400" width="100%" height="100%">
|
||||
<defs>
|
||||
<linearGradient id="gold-grad" x1="0%" y1="0%" x2="100%" y2="100%">
|
||||
<stop offset="0%" stop-color="#C59341" />
|
||||
<stop offset="20%" stop-color="#E4B869" />
|
||||
<stop offset="40%" stop-color="#FBF0B9" />
|
||||
<stop offset="60%" stop-color="#DFB260" />
|
||||
<stop offset="80%" stop-color="#BC8837" />
|
||||
<stop offset="100%" stop-color="#A36F28" />
|
||||
</linearGradient>
|
||||
|
||||
<linearGradient id="text-grad" x1="0%" y1="100%" x2="100%" y2="0%">
|
||||
<stop offset="0%" stop-color="#FFFFFF" />
|
||||
<stop offset="40%" stop-color="#F5E3B5" />
|
||||
<stop offset="70%" stop-color="#D4A343" />
|
||||
<stop offset="100%" stop-color="#8A5A16" />
|
||||
</linearGradient>
|
||||
|
||||
<filter id="drop-shadow" x="-20%" y="-20%" width="140%" height="140%">
|
||||
<feDropShadow dx="0" dy="8" stdDeviation="6" flood-color="#000000" flood-opacity="0.4"/>
|
||||
</filter>
|
||||
</defs>
|
||||
|
||||
<g filter="url(#drop-shadow)">
|
||||
<g fill="url(#gold-grad)">
|
||||
<path d="M 200,40
|
||||
C 290,40 350,110 350,200
|
||||
C 350,290 290,360 200,360
|
||||
C 110,360 50,290 50,200
|
||||
C 50,110 110,40 200,40 Z
|
||||
M 200,75
|
||||
C 130,75 88,130 88,200
|
||||
C 88,270 130,325 200,325
|
||||
C 270,325 312,270 312,200
|
||||
C 312,130 270,75 200,75 Z"
|
||||
fill-rule="evenodd" />
|
||||
|
||||
<path d="M 88,190 L 140,190 C 140,190 142,210 140,210 L 88,210 Z" />
|
||||
|
||||
<path d="M 260,190 L 312,190 C 312,190 310,210 260,210 Z" />
|
||||
</g>
|
||||
|
||||
<text x="200" y="222"
|
||||
font-family="system-ui, -apple-system, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif"
|
||||
font-size="78"
|
||||
font-weight="900"
|
||||
fill="url(#text-grad)"
|
||||
text-anchor="middle"
|
||||
letter-spacing="-2">42</text>
|
||||
</g>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 1.9 KiB |
@@ -0,0 +1,113 @@
|
||||
---
|
||||
layout: default
|
||||
title: Connecting
|
||||
description: How to reach downstream hosts through the jump host — the username grammar, the interactive picker, SFTP/WinSCP, and what access you get.
|
||||
---
|
||||
|
||||
# Connecting
|
||||
|
||||
You reach a downstream host two ways: name the target in your username, or log
|
||||
in plain and pick it from a menu. Either way you authenticate **once**, to the
|
||||
jump host, with your directory credentials.
|
||||
|
||||
## The username grammar
|
||||
|
||||
```
|
||||
{uid}_-_{target}
|
||||
```
|
||||
|
||||
- `{uid}` — your directory username.
|
||||
- `_-_` — the separator (legal in an SSH username everywhere, including WinSCP).
|
||||
- `{target}` — the host to reach: a directory **slug** (`host_web01` or just
|
||||
`web01`), the host's **display name**, its **IP**, or the hostname in its
|
||||
directory `address`.
|
||||
|
||||
```bash
|
||||
ssh alice_-_web01@jump.example.com # by slug (host_ prefix optional)
|
||||
ssh alice_-_10.0.0.10@jump.example.com # by IP (must be a host you can reach)
|
||||
```
|
||||
|
||||
If the target matches a host your directory groups grant, you're bridged
|
||||
straight to its `sshd` — same as if you'd SSH'd directly, but through the
|
||||
audited jump host.
|
||||
|
||||
## SFTP / WinSCP / scp
|
||||
|
||||
Because the whole route is encoded in the username, file transfer tools that
|
||||
only take one connection string work with no extra configuration:
|
||||
|
||||
```bash
|
||||
sftp -P 2222 alice_-_web01@jump.example.com
|
||||
scp -P 2222 file.txt alice_-_web01@jump.example.com:/tmp/
|
||||
```
|
||||
|
||||
**WinSCP:** set Host name to `jump.example.com`, Port to `2222`, and User name
|
||||
to `alice_-_web01`. SFTP is bridged as an opaque byte stream, so all operations
|
||||
(browse, upload, download, rename) work normally.
|
||||
|
||||
## The interactive picker
|
||||
|
||||
Log in with just your username and you get a TUI list of every host you can
|
||||
reach:
|
||||
|
||||
```bash
|
||||
ssh alice@jump.example.com
|
||||
```
|
||||
|
||||
- **↑ / ↓** move the selection
|
||||
- **type** to filter the list incrementally
|
||||
- **Enter** connect to the highlighted host
|
||||
- **number keys** jump straight to that row
|
||||
- **q** or **Ctrl-C** to quit
|
||||
|
||||
Pick a host and you're bridged into it. The picker only ever lists hosts your
|
||||
directory access allows — it doubles as "what can I reach from here?"
|
||||
|
||||
## What you can reach
|
||||
|
||||
The set of hosts is computed per login: your LDAP group memberships intersected
|
||||
with the SSO directory's **catalog** hosts (via the `host_<name>_access` groups
|
||||
the directory auto-creates for each machine). To get access to a new host, an
|
||||
admin adds you to that host's access group in the SSO — nothing on the jump host
|
||||
changes.
|
||||
|
||||
Targets that don't resolve to a host you're allowed to reach are refused (and
|
||||
audited). Raw IPs that aren't a known directory host are denied by default.
|
||||
|
||||
**Only catalog hosts are jump targets.** A machine that the SSO merely
|
||||
*discovered* — a Proxmox guest, a UniFi client — is not a jump target until an
|
||||
admin promotes it into the directory catalog. The jump host applies the same
|
||||
rule the SSO's own Directory listing does: a resource carrying
|
||||
`discovery_sources` but never promoted is excluded, while hand-created hosts and
|
||||
promoted ones are included. Previously the filter treated a missing `managed`
|
||||
flag as permission, so unpromoted discovery results showed up in the picker.
|
||||
|
||||
> On a [standalone](architecture.html#standalone-mode) jump host (no LDAP/SSO),
|
||||
> every registered host is reachable by every registered user — there's no
|
||||
> group-based restriction to ask an admin about.
|
||||
|
||||
## Authentication
|
||||
|
||||
The jump host authenticates **you** against the directory:
|
||||
|
||||
- **Public key** — matched against your `sshPublicKey` entries in LDAP. Use your
|
||||
normal SSH key; the client picks it automatically.
|
||||
- **Password** — your directory password (LDAP bind). Password auth is often
|
||||
restricted to local networks or disabled entirely on a public jump host
|
||||
(keys-only) — check with your operator.
|
||||
|
||||
You never manage a separate credential for the downstream host: the jump host
|
||||
handles onward authentication for you (see
|
||||
[Architecture](architecture.html#per-user-key-injection)).
|
||||
|
||||
## First connection to a host
|
||||
|
||||
The very first time you reach a given downstream host, the jump host provisions
|
||||
its access key for you behind the scenes. If that first attempt races the
|
||||
directory's key-cache refresh you may see a brief
|
||||
|
||||
```
|
||||
jump-host: first-time key propagation, retrying…
|
||||
```
|
||||
|
||||
and it reconnects automatically. Subsequent connections are immediate.
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 90 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 83 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 78 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 72 KiB |
+121
@@ -0,0 +1,121 @@
|
||||
---
|
||||
layout: default
|
||||
title: Home
|
||||
description: An SSH jump host for the theta42 stack — one public host and directory-driven access to every downstream machine you're entitled to; LDAP by default, or fully standalone.
|
||||
---
|
||||
|
||||
# Jump Host
|
||||
|
||||
An SSH jump host for the [theta42](https://github.com/theta42) self-hosted
|
||||
stack. Users SSH into **one** public host and land on any downstream host
|
||||
they're entitled to — authenticated against the shared LDAP directory,
|
||||
authorized from the [SSO Manager](https://theta42.github.io/sso-manager-node/)'s
|
||||
inventory graph, and audited end to end.
|
||||
|
||||
No per-host accounts, no distributing keys, no VPN. The same people who log in
|
||||
to your SSO are the people who can reach your machines — and only the machines
|
||||
their directory groups grant.
|
||||
|
||||
Part of the theta42 self-hosted identity stack, alongside
|
||||
[SSO Manager](https://theta42.github.io/sso-manager-node/) and
|
||||
[Proxy](https://theta42.github.io/proxy/), composable with one command via
|
||||
[theta-env](https://theta42.github.io/theta-env/).
|
||||
|
||||
## Screenshots
|
||||
|
||||
<a href="images/login.png" target="_blank"><img src="images/login.png" alt="Login" width="49%"></a>
|
||||
<a href="images/dashboard.png" target="_blank"><img src="images/dashboard.png" alt="Dashboard" width="49%"></a>
|
||||
<a href="images/sessions.png" target="_blank"><img src="images/sessions.png" alt="Active sessions" width="49%"></a>
|
||||
<a href="images/audit.png" target="_blank"><img src="images/audit.png" alt="Audit log" width="49%"></a>
|
||||
|
||||
*(click any screenshot to view full size)*
|
||||
|
||||
Don't want to run LDAP or the SSO Manager? **Standalone mode** stores users
|
||||
and hosts in a local SQL database instead (SQLite by default, any
|
||||
Sequelize-supported dialect if you want something else) — same SSH front door,
|
||||
key injection, and audit trail. See
|
||||
[Installation](installation.html#standalone-mode) to get started.
|
||||
|
||||
## Two ways to connect
|
||||
|
||||
**Direct (WinSCP/SFTP-friendly):**
|
||||
|
||||
```bash
|
||||
ssh alice_-_web01@jump.example.com
|
||||
sftp -P 2222 alice_-_web01@jump.example.com
|
||||
```
|
||||
|
||||
The username grammar is `{uid}_-_{target}` — `target` is a directory host slug
|
||||
(with or without the `host_` prefix), a bare hostname, or an IP. One username
|
||||
string, no interactive step, so it works cleanly in WinSCP and scripts.
|
||||
|
||||
**Interactive picker:**
|
||||
|
||||
```bash
|
||||
ssh alice@jump.example.com
|
||||
```
|
||||
|
||||
A plain login shows a TUI list of the hosts you can reach; arrow-key or type to
|
||||
filter, Enter to connect.
|
||||
|
||||
See **[Connecting](connecting.html)** for the full usage guide.
|
||||
|
||||
## Why a jump host (and why this one)
|
||||
|
||||
A bastion/jump host is the standard way to give SSH access to internal machines
|
||||
through a single audited entry point. What's usually painful is *authorization*
|
||||
and *credentials*: who may reach which host, and how the bastion authenticates
|
||||
onward without you copying keys everywhere.
|
||||
|
||||
This jump host answers both from your directory:
|
||||
|
||||
- **Authorization is your directory graph.** The hosts you can reach are the
|
||||
union of your LDAP groups × the SSO's inventory (the `host_<name>_access`
|
||||
groups the directory already auto-creates). Add someone to a group; they can
|
||||
reach the host. No bastion-side allow-list to maintain.
|
||||
- **Onward auth is automatic.** The jump host holds one key and injects its
|
||||
public half into your `sshPublicKey` on first use, then connects downstream
|
||||
**as you**. Downstream hosts already serve keys from LDAP (via
|
||||
[ldap-client](https://github.com/theta42/ldap-client)'s
|
||||
`AuthorizedKeysCommand`), so nothing downstream needs configuring.
|
||||
|
||||
## Features
|
||||
|
||||
- **Username-grammar routing** (`uid_-_target`) — straight-through to the host,
|
||||
SFTP included (WinSCP works)
|
||||
- **Interactive TUI host picker** on plain login, scoped to your access
|
||||
- **LDAP inbound auth** — public key or password (keys-only policy recommended
|
||||
for a public host)
|
||||
- **Directory-driven access** — reachable hosts come from the SSO inventory, not
|
||||
a static list
|
||||
- **Per-user key injection** — no downstream changes, no key distribution
|
||||
- **Shell, exec, and SFTP** bridging
|
||||
- **Web UI + HTTP API** for auditing and metrics — active sessions, a searchable
|
||||
audit log, per-user/per-host counters
|
||||
- **Full audit trail** — who, target, method, result, bytes, duration, and the
|
||||
downstream host-key fingerprint
|
||||
- **Standalone mode** — no LDAP, no SSO Manager; users and hosts live in a
|
||||
local SQL database (Sequelize, any dialect — SQLite by default)
|
||||
- Packaged like the rest of the stack: one-command Docker, idempotent bare-metal
|
||||
installer, or bundled in theta-env
|
||||
|
||||
## Get it
|
||||
|
||||
```bash
|
||||
git clone https://github.com/theta42/jump-host.git
|
||||
cd jump-host
|
||||
cp secrets.js.example config/jump-secrets.js # then edit it
|
||||
docker compose up -d --build
|
||||
```
|
||||
|
||||
That's the standalone quick start. For bare-metal and the bundled theta-env
|
||||
option, see **[Installation](installation.html)**.
|
||||
|
||||
## Related projects
|
||||
|
||||
- **[SSO Manager](https://theta42.github.io/sso-manager-node/)** — the OpenLDAP
|
||||
directory + OIDC provider + the inventory graph this jump host reads.
|
||||
- **[Proxy](https://theta42.github.io/proxy/)** — puts your web apps behind the
|
||||
same identity; fronts this jump host's web UI.
|
||||
- **[theta-env](https://theta42.github.io/theta-env/)** — runs the whole stack,
|
||||
jump host included, with one command.
|
||||
@@ -0,0 +1,155 @@
|
||||
---
|
||||
layout: default
|
||||
title: Installation
|
||||
description: Install the jump host three ways — bundled in the theta-env stack, standalone Docker, or bare metal — plus standalone mode (no LDAP/SSO), the LDAP write-ACL, and port-22 options.
|
||||
---
|
||||
|
||||
# Installation
|
||||
|
||||
Three ways to run the jump host, in increasing manual effort. All read their
|
||||
config through [@simpleworkjs/conf](https://www.npmjs.com/package/@simpleworkjs/conf)
|
||||
(`conf/base.js` < `conf/<NODE_ENV>.js` < the `CONF_SECRETS` file < `app_*` env).
|
||||
|
||||
## Standalone mode (no LDAP/SSO) {#standalone-mode}
|
||||
|
||||
Skip LDAP and the SSO Manager entirely. Not to be confused with "Standalone
|
||||
Docker" below, which is still LDAP + SSO, just run outside theta-env. Set in your secrets/config:
|
||||
|
||||
```js
|
||||
standalone: { enabled: true },
|
||||
orm: { dialect: 'sqlite', storage: './data/standalone.sqlite', logging: false },
|
||||
```
|
||||
|
||||
`orm` is passed straight to Sequelize, so any supported dialect works — SQLite
|
||||
is just the zero-dependency default. Everything downstream of auth (bridging,
|
||||
key injection, the web UI, audit) is unchanged.
|
||||
|
||||
There's no admin UI for standalone users/hosts yet, so add them directly with
|
||||
the ORM models:
|
||||
|
||||
```js
|
||||
const StandaloneUser = require('./models/standalone_user');
|
||||
const StandaloneHost = require('./models/standalone_host');
|
||||
const bcrypt = require('bcrypt');
|
||||
|
||||
await StandaloneUser.create({
|
||||
uid: 'alice',
|
||||
passwordHash: await bcrypt.hash('a real password', 10),
|
||||
sshPublicKeys: ['ssh-ed25519 AAAA... alice@laptop'],
|
||||
groups: [],
|
||||
});
|
||||
|
||||
await StandaloneHost.create({
|
||||
slug: 'host_web01',
|
||||
displayName: 'web01',
|
||||
kind: 'host',
|
||||
metadata: { ip: '10.0.0.5', sshPort: 22 },
|
||||
});
|
||||
```
|
||||
|
||||
Every host in the standalone inventory is reachable by every standalone user —
|
||||
there's no group-based authorization yet (`groups` on `StandaloneUser` is
|
||||
accepted for interface parity with the LDAP path, not enforced).
|
||||
|
||||
The rest of this page (requirements, the LDAP write-ACL, the three install
|
||||
paths) describes the default LDAP + SSO mode — skip it if you're running
|
||||
standalone.
|
||||
|
||||
## Requirements
|
||||
|
||||
- The [SSO Manager](https://theta42.github.io/sso-manager-node/) (OpenLDAP
|
||||
directory + `/api/discovery`), v1.3.0 or newer.
|
||||
- Downstream hosts joined via
|
||||
[ldap-client](https://github.com/theta42/ldap-client) (SSSD +
|
||||
`AuthorizedKeysCommand`).
|
||||
- An LDAP bind account with **write access to the `sshPublicKey` attribute** on
|
||||
user entries (see below).
|
||||
- An SSO API token (`sso_…`) for the directory queries.
|
||||
|
||||
## 1. Unified theta-env stack (recommended)
|
||||
|
||||
Enable it in `theta-env/setup.env`:
|
||||
|
||||
```bash
|
||||
CFG_JUMP_HOST_ENABLED=true
|
||||
CFG_JUMP_HOST=jump.example.com
|
||||
JUMP_SSH_PORT=2222
|
||||
```
|
||||
|
||||
Re-run `./setup.sh`. The stack builds the submodule (behind the `jump-host`
|
||||
compose profile), mints the directory API token, writes
|
||||
`./config/jump-secrets.js`, grants the `sshPublicKey` write-ACL, registers the
|
||||
jump host in the proxy, and seeds a directory entry. Forward the public host's
|
||||
`:22` (or `:2222`) to the container's published `JUMP_SSH_PORT`.
|
||||
|
||||
## 2. Standalone Docker
|
||||
|
||||
```bash
|
||||
cp secrets.js.example config/jump-secrets.js
|
||||
$EDITOR config/jump-secrets.js # LDAP bind (+ sshPublicKey write ACL), SSO url + token
|
||||
docker compose up -d --build
|
||||
```
|
||||
|
||||
Host keys persist in the `jump-data` volume. The web UI is on `:3002`; front it
|
||||
with your own TLS/proxy.
|
||||
|
||||
## 3. Bare metal
|
||||
|
||||
```bash
|
||||
curl -fsSL https://raw.githubusercontent.com/theta42/jump-host/master/ops/install.sh | sudo bash
|
||||
sudo $EDITOR /etc/jump-host/secrets.js
|
||||
sudo systemctl restart jump-host
|
||||
journalctl -u jump-host -f
|
||||
```
|
||||
|
||||
`ops/install.sh` installs Node 22 + Redis, hard-resets the checkout at
|
||||
`/opt/theta42/jump-host` to the remote branch, symlinks the systemd unit, and
|
||||
runs `npm ci`. Idempotent — re-run to update. Overridable via `REPO_DIR=`,
|
||||
`BRANCH=`, `SECRETS_FILE=`.
|
||||
|
||||
## The LDAP write-ACL (required)
|
||||
|
||||
The jump host injects its public key into each user's `sshPublicKey`, so its
|
||||
bind account must be able to **write** that attribute. In the bundled OpenLDAP:
|
||||
|
||||
```
|
||||
access to attrs=sshPublicKey
|
||||
by dn.exact="cn=ldapclient,ou=people,dc=example,dc=com" write
|
||||
by self write
|
||||
by * read
|
||||
```
|
||||
|
||||
In the theta-env bundle this is handled for you (the jump host binds as the LDAP
|
||||
admin). For a hardened standalone deployment, use a dedicated bind account with
|
||||
exactly this attribute-scoped ACL. Without write access, key injection fails and
|
||||
every bridge attempt is audited `key-inject-failed`.
|
||||
|
||||
## Listening on port 22
|
||||
|
||||
The default SSH port is **2222** so the service needs no privilege. To listen on
|
||||
22, set `ssh.listenPort: 22` and either:
|
||||
|
||||
- **systemd:** uncomment `AmbientCapabilities=CAP_NET_BIND_SERVICE` in the unit;
|
||||
- **Docker:** publish `22:22`; or
|
||||
- **firewall:** DNAT `22 → 2222`.
|
||||
|
||||
## Configuration reference
|
||||
|
||||
Every key is documented in
|
||||
[`secrets.js.example`](https://github.com/theta42/jump-host/blob/master/secrets.js.example):
|
||||
`ldap` (bind + bases + TLS), `sso` (url + apiToken), `ssh`
|
||||
(`listenPort`, `passwordAuth`, `allowRawIPs`, `keyComment`, timeouts,
|
||||
`maxSessions`), `web.port`, `oidc` (web-UI SSO login), `auth`
|
||||
(`adminGroups` / `adminUsers` / `localAdminPass`), and `redis`.
|
||||
|
||||
## Verifying
|
||||
|
||||
```bash
|
||||
ssh -p 2222 youruid@jump.example.com # TUI picker
|
||||
ssh -p 2222 youruid_-_somehost@jump.example.com # direct
|
||||
sftp -P 2222 youruid_-_somehost@jump.example.com # WinSCP path
|
||||
curl -s http://localhost:3002/health
|
||||
```
|
||||
|
||||
Watch `journalctl -u jump-host -f` (or `docker logs -f jump-host`) and the audit
|
||||
log at `/audit` in the web UI.
|
||||
@@ -0,0 +1,4 @@
|
||||
User-agent: *
|
||||
Allow: /
|
||||
|
||||
Sitemap: https://theta42.github.io/proxy/sitemap.xml
|
||||
+11
-1
@@ -4,6 +4,8 @@ const express = require('express');
|
||||
const compression = require('compression');
|
||||
|
||||
require('./models'); // wire model-redis + register models
|
||||
const conf = require('@simpleworkjs/conf');
|
||||
const buildInfo = require('./utils/build_info');
|
||||
|
||||
const app = express();
|
||||
|
||||
@@ -41,7 +43,15 @@ app.use((err, req, res, next) => {
|
||||
if(req.path.startsWith('/api/')){
|
||||
return res.status(status).json({name: err.name || 'Error', message: err.message || 'Error'});
|
||||
}
|
||||
res.status(status).send(err.message || 'Error');
|
||||
// Browser navigation gets the HTML error page (shared with SSO).
|
||||
res.status(status).render('error', {
|
||||
title: conf.environment !== 'production' ? 'dev' : '',
|
||||
titleIcon: conf.environment !== 'production' ? '<i class="fa-brands fa-dev"></i>' : '',
|
||||
name: conf.name,
|
||||
logo: conf.logo,
|
||||
...buildInfo,
|
||||
error: err,
|
||||
});
|
||||
});
|
||||
|
||||
module.exports = app;
|
||||
|
||||
Generated
+2
-2
@@ -1,12 +1,12 @@
|
||||
{
|
||||
"name": "t42-jump-host",
|
||||
"version": "1.16.1",
|
||||
"version": "1.19.0",
|
||||
"lockfileVersion": 3,
|
||||
"requires": true,
|
||||
"packages": {
|
||||
"": {
|
||||
"name": "t42-jump-host",
|
||||
"version": "1.16.1",
|
||||
"version": "1.19.0",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"@fortawesome/fontawesome-free": "^7.3.0",
|
||||
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"name": "t42-jump-host",
|
||||
"version": "1.16.1",
|
||||
"version": "1.19.0",
|
||||
"description": "SSH jump host for the theta42 stack — LDAP-authenticated, directory-driven host bridging with audit and metrics",
|
||||
"author": [
|
||||
{
|
||||
|
||||
@@ -3,6 +3,12 @@ nav.navbar{
|
||||
padding-right: 1em;
|
||||
}
|
||||
|
||||
/* Only the active top-nav link is bold + underlined; the username is plain. */
|
||||
.top-nav a.active{
|
||||
font-weight: bold;
|
||||
text-decoration: underline;
|
||||
}
|
||||
|
||||
body {
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
|
||||
@@ -23,7 +23,7 @@ function counter(onBytes) {
|
||||
// Connect the upstream ssh2.Client, retrying once after a short pause if the
|
||||
// first attempt fails auth (SSSD/AuthorizedKeysCommand cache lag right after a
|
||||
// first-time key injection).
|
||||
function connectUpstream({ host, port, username, privateKey, cert, onHostKey, uid, justInjected }) {
|
||||
function connectUpstream({ host, port, username, privateKey, cert, onHostKey, uid, justInjected, expectedHostKeyFp }) {
|
||||
return new Promise((resolve, reject) => {
|
||||
let attempted = false;
|
||||
const dial = (allowRetry) => {
|
||||
@@ -48,7 +48,10 @@ function connectUpstream({ host, port, username, privateKey, cert, onHostKey, ui
|
||||
hostVerifier: (key) => {
|
||||
const fp = 'SHA256:' + crypto.createHash('sha256').update(key).digest('base64').replace(/=+$/, '');
|
||||
if (onHostKey) onHostKey(fp);
|
||||
return true; // v1: trust-on-use, fingerprint audited. Pinning = follow-up.
|
||||
if (expectedHostKeyFp && expectedHostKeyFp !== fp) {
|
||||
return false;
|
||||
}
|
||||
return true; // v1: trust-on-use if not pinned, fingerprint audited.
|
||||
},
|
||||
});
|
||||
};
|
||||
|
||||
@@ -150,6 +150,7 @@ async function resolveAndConnect(state, record, { onHostKey } = {}) {
|
||||
host: endpoint.address, port: endpoint.port,
|
||||
username: state.uid, privateKey: JUMP_KEYS.clientKey, cert,
|
||||
uid: state.uid, justInjected, onHostKey,
|
||||
expectedHostKeyFp: host && host.metadata && host.metadata.sshHostKeyFp,
|
||||
});
|
||||
} catch (err) { throw fail('upstream-unreachable', err.message, host ? host.slug : undefined); }
|
||||
|
||||
@@ -261,6 +262,7 @@ async function runTuiSession(session, client, state) {
|
||||
host: endpoint.address, port: endpoint.port,
|
||||
username: state.uid, privateKey: JUMP_KEYS.clientKey, cert,
|
||||
uid: state.uid, justInjected, onHostKey: (fp) => record.patch({ hostKeyFp: fp }),
|
||||
expectedHostKeyFp: tui.host && tui.host.metadata && tui.host.metadata.sshHostKeyFp,
|
||||
});
|
||||
} catch (err) {
|
||||
try { tui.channel.write(`\r\n Could not reach ${endpoint.address}.\r\n`); tui.channel.close(); } catch (_) {}
|
||||
|
||||
@@ -8,39 +8,33 @@ function stubLdap(groups) {
|
||||
return { getGroups: async () => groups };
|
||||
}
|
||||
|
||||
function stubFetch(byGroup) {
|
||||
function stubFetch(byUid) {
|
||||
return async (url) => {
|
||||
const cn = decodeURIComponent(url.split('group=')[1]);
|
||||
return { ok: true, json: async () => ({ results: byGroup[cn] || [] }) };
|
||||
const uid = url.split('/access/')[1];
|
||||
return { ok: true, json: async () => ({ results: byUid[uid] || [] }) };
|
||||
};
|
||||
}
|
||||
|
||||
test('unions hosts across groups, dedupes, drops non-hosts', async () => {
|
||||
test('drops non-hosts from access projection', async () => {
|
||||
clearCache();
|
||||
const user = { uid: 'alice', dn: 'uid=alice,ou=people,dc=x' };
|
||||
const fetchImpl = stubFetch({
|
||||
host_web01_access: [
|
||||
alice: [
|
||||
{ id: '1', kind: 'host', slug: 'host_web01' },
|
||||
{ id: '2', kind: 'host', slug: 'host_db' },
|
||||
{ id: '9', kind: 'service', slug: 'app_gitea' }, // dropped: not a host
|
||||
],
|
||||
host_db_access: [
|
||||
{ id: '1', kind: 'host', slug: 'host_web01' }, // dupe by id
|
||||
{ id: '2', kind: 'host', slug: 'host_db' },
|
||||
],
|
||||
});
|
||||
const hosts = await accessibleHosts(user, { fetchImpl, ldap: stubLdap(['host_web01_access', 'host_db_access']) });
|
||||
const hosts = await accessibleHosts(user, { fetchImpl });
|
||||
assert.deepStrictEqual(hosts.map((h) => h.id).sort(), ['1', '2']);
|
||||
});
|
||||
|
||||
test('a failing group query does not sink the rest', async () => {
|
||||
test('a failing access query returns empty list without throwing', async () => {
|
||||
clearCache();
|
||||
const user = { uid: 'bob', dn: 'uid=bob,ou=people,dc=x' };
|
||||
const fetchImpl = async (url) => {
|
||||
if (url.includes('bad')) return { ok: false, status: 500 };
|
||||
return { ok: true, json: async () => ({ results: [{ id: '3', kind: 'host', slug: 'host_ok' }] }) };
|
||||
};
|
||||
const hosts = await accessibleHosts(user, { fetchImpl, ldap: stubLdap(['bad_access', 'good_access']) });
|
||||
assert.deepStrictEqual(hosts.map((h) => h.id), ['3']);
|
||||
const fetchImpl = async () => ({ ok: false, status: 500 });
|
||||
const hosts = await accessibleHosts(user, { fetchImpl });
|
||||
assert.deepStrictEqual(hosts, []);
|
||||
});
|
||||
|
||||
test('caches per uid', async () => {
|
||||
@@ -48,23 +42,19 @@ test('caches per uid', async () => {
|
||||
let calls = 0;
|
||||
const user = { uid: 'cara', dn: 'd' };
|
||||
const fetchImpl = async () => { calls++; return { ok: true, json: async () => ({ results: [] }) }; };
|
||||
const ldap = { getGroups: async () => ['g1'] };
|
||||
await accessibleHosts(user, { fetchImpl, ldap });
|
||||
await accessibleHosts(user, { fetchImpl, ldap });
|
||||
await accessibleHosts(user, { fetchImpl });
|
||||
await accessibleHosts(user, { fetchImpl });
|
||||
assert.strictEqual(calls, 1);
|
||||
});
|
||||
|
||||
test('accepts pre-resolved groups (web UI/OIDC session) without calling ldap.getGroups', async () => {
|
||||
test('does not depend on user.groups or ldap.getGroups', async () => {
|
||||
clearCache();
|
||||
let ldapCalled = false;
|
||||
const user = { uid: 'erin', groups: ['host_web01_access'] };
|
||||
const user = { uid: 'erin' }; // no dn, no groups
|
||||
const fetchImpl = stubFetch({
|
||||
host_web01_access: [{ id: '5', kind: 'host', slug: 'host_web01' }],
|
||||
erin: [{ id: '5', kind: 'host', slug: 'host_web01' }],
|
||||
});
|
||||
const ldap = { getGroups: async () => { ldapCalled = true; return []; } };
|
||||
const hosts = await accessibleHosts(user, { fetchImpl, ldap });
|
||||
const hosts = await accessibleHosts(user, { fetchImpl });
|
||||
assert.deepStrictEqual(hosts.map((h) => h.id), ['5']);
|
||||
assert.strictEqual(ldapCalled, false);
|
||||
});
|
||||
|
||||
test('allHosts fetches the whole host inventory with no group filter', async () => {
|
||||
@@ -80,16 +70,33 @@ test('allHosts fetches the whole host inventory with no group filter', async ()
|
||||
assert.deepStrictEqual(hosts.map((h) => h.id).sort(), ['1', '2']);
|
||||
});
|
||||
|
||||
test('a bare-array response (envelope drift) is treated as a failed group, not silently []', async () => {
|
||||
// Only catalog content is a jump target. Discovery writes `discovery_sources`;
|
||||
// promoting to the catalog sets `managed: true`. An unpromoted Proxmox VM was
|
||||
// reaching the picker because the filter defaulted `managed`-less hosts to true.
|
||||
test('drops auto-discovered hosts that were never promoted', async () => {
|
||||
clearCache();
|
||||
const user = { uid: 'frank', dn: 'd' };
|
||||
const fetchImpl = stubFetch({
|
||||
frank: [
|
||||
{ id: '1', kind: 'host', slug: 'host_web01' }, // hand-made: no discovery_sources
|
||||
{ id: '2', kind: 'host', slug: 'vm-101', metadata: { discovery_sources: ['proxmox'] } }, // discovered, unpromoted
|
||||
{ id: '3', kind: 'host', slug: 'vm-102', metadata: { discovery_sources: ['proxmox'], managed: true } }, // promoted
|
||||
{ id: '4', kind: 'host', slug: 'host_db', metadata: { discovery_sources: ['manual'] } }, // manual source counts as catalog
|
||||
{ id: '5', kind: 'host', slug: 'host_off', metadata: { managed: false } }, // explicitly out
|
||||
],
|
||||
});
|
||||
const hosts = await accessibleHosts(user, { fetchImpl });
|
||||
assert.deepStrictEqual(hosts.map((h) => h.id).sort(), ['1', '3', '4']);
|
||||
});
|
||||
|
||||
test('a bare-array response (envelope drift) returns empty list', async () => {
|
||||
clearCache();
|
||||
const user = { uid: 'dave', dn: 'd' };
|
||||
// drift shape: a bare array instead of { results: [...] }. The shared client
|
||||
// throws DirectoryEnvelopeViolation; access.js must catch + continue, so a
|
||||
// good group alongside still yields its hosts.
|
||||
const fetchImpl = async (url) => {
|
||||
if (url.includes('drift')) return { ok: true, json: async () => [{ id: '7', kind: 'host' }] };
|
||||
return { ok: true, json: async () => ({ results: [{ id: '8', kind: 'host' }] }) };
|
||||
// throws DirectoryEnvelopeViolation; access.js must catch + continue.
|
||||
const fetchImpl = async () => {
|
||||
return { ok: true, json: async () => [{ id: '7', kind: 'host' }] };
|
||||
};
|
||||
const hosts = await accessibleHosts(user, { fetchImpl, ldap: stubLdap(['drift_access', 'good_access']) });
|
||||
assert.deepStrictEqual(hosts.map((h) => h.id), ['8']);
|
||||
const hosts = await accessibleHosts(user, { fetchImpl });
|
||||
assert.deepStrictEqual(hosts, []);
|
||||
});
|
||||
|
||||
+34
-32
@@ -17,14 +17,9 @@ if (conf.standalone && conf.standalone.enabled) {
|
||||
|
||||
// Which directory hosts may a user reach, and how do we dial them?
|
||||
//
|
||||
// v1 resolution (see directory_spec.md §9.2 in sso-manager-node): the SSO's
|
||||
// /api/discovery/me only answers for the API token's own user, and /graph
|
||||
// omits ResourceGroup links — so we combine the user's LDAP groups (queried
|
||||
// directly) with per-group resource lookups:
|
||||
//
|
||||
// 1. LDAP: groups the user's DN is a member of
|
||||
// 2. SSO: GET /api/discovery/resources?group=<cn> per group (ApiToken)
|
||||
// 3. union, keep kind === 'host'
|
||||
// We use the SSO's machine-aware /api/discovery/access/:uid endpoint,
|
||||
// which evaluates the user's groups server-side and returns their complete
|
||||
// access projection in one call.
|
||||
//
|
||||
// Results are cached per-uid for a short TTL — the TUI picker and the
|
||||
// username-grammar path share the cache. Dependency-injected fetch/ldap for
|
||||
@@ -51,37 +46,44 @@ if (conf.standalone && conf.standalone.enabled) {
|
||||
|
||||
// Every host in the inventory, unfiltered — for admins (the web UI's own
|
||||
// account is already gated by requireAdmin before this is ever called).
|
||||
async function allHosts({ fetchImpl = fetch } = {}) {
|
||||
const resources = await directoryClient({ fetchImpl }).getResourcesByGroup(undefined, { kind: 'host' });
|
||||
return resources.filter(r => r.kind === 'host');
|
||||
//
|
||||
// "In the catalog" is the same predicate the SSO's own Directory listing
|
||||
// applies (sso-manager-node routes/api_directory_admin.js GET /resources):
|
||||
// a resource that was auto-discovered and never promoted is NOT catalog
|
||||
// content and must never be offered as a jump target. Discovery writes
|
||||
// `metadata.discovery_sources`; promoting sets `metadata.managed = true`.
|
||||
// Hosts created by hand carry no discovery_sources at all and stay in.
|
||||
//
|
||||
// The two copies of this rule have already drifted apart once (unpromoted
|
||||
// Proxmox VMs showing up in the picker); if a third consumer needs it,
|
||||
// hoist it into @simpleworkjs/directory-schema rather than copying again.
|
||||
function isCatalogHost(r) {
|
||||
if (!r || r.kind !== 'host') return false;
|
||||
const meta = r.metadata || {};
|
||||
if (meta.managed === true || meta.managed === 'true') return true;
|
||||
if (meta.managed === false || meta.managed === 'false') return false;
|
||||
const sources = meta.discovery_sources || [];
|
||||
const autoDiscovered = sources.length > 0 && !sources.includes('manual');
|
||||
return !autoDiscovered;
|
||||
}
|
||||
|
||||
async function accessibleHosts(user, { fetchImpl = fetch, ldap = userLdap } = {}) {
|
||||
async function allHosts({ fetchImpl = fetch } = {}) {
|
||||
const resources = await directoryClient({ fetchImpl }).getResourcesByGroup(undefined, { kind: 'host' });
|
||||
return resources.filter(isCatalogHost);
|
||||
}
|
||||
|
||||
async function accessibleHosts(user, { fetchImpl = fetch } = {}) {
|
||||
const hit = cache.get(user.uid);
|
||||
if (hit && Date.now() - hit.at < CACHE_TTL_MS) return hit.hosts;
|
||||
|
||||
// The SSH path passes an LDAP user ({dn, uid, ...}) with no .groups, so we
|
||||
// look them up; the web UI already has the session's OIDC groups claim
|
||||
// and passes it directly, skipping a redundant LDAP round-trip.
|
||||
const groups = user.groups || await ldap.getGroups(user.dn);
|
||||
|
||||
const seen = new Map();
|
||||
for (const cn of groups) {
|
||||
let resources;
|
||||
try {
|
||||
resources = await fetchResourcesByGroup(cn, { fetchImpl });
|
||||
} catch (error) {
|
||||
// One bad group must not hide the rest; the SSO being down
|
||||
// surfaces as an empty list + log line, not a crash.
|
||||
console.error(`[access] ${error.message}`);
|
||||
continue;
|
||||
}
|
||||
for (const r of resources) {
|
||||
if (r.kind === 'host' && !seen.has(r.id)) seen.set(r.id, r);
|
||||
}
|
||||
let resources = [];
|
||||
try {
|
||||
resources = await directoryClient({ fetchImpl }).getAccess(user.uid);
|
||||
} catch (error) {
|
||||
console.error(`[access] ${error.message}`);
|
||||
}
|
||||
|
||||
const hosts = [...seen.values()];
|
||||
const hosts = resources.filter(isCatalogHost);
|
||||
cache.set(user.uid, { at: Date.now(), hosts });
|
||||
return hosts;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,25 @@
|
||||
<%- include('top') %>
|
||||
|
||||
<div class="container mt-5">
|
||||
<div class="row justify-content-center">
|
||||
<div class="col-md-6 text-center">
|
||||
<div class="mb-4">
|
||||
<i class="fa-solid fa-triangle-exclamation text-warning" style="font-size: 4rem;"></i>
|
||||
</div>
|
||||
<h1 class="display-4 fw-bold text-dark"><%= error.status || 500 %></h1>
|
||||
<h3 class="mb-3 text-secondary"><%= error.message || 'Something went wrong' %></h3>
|
||||
<p class="text-muted mb-4">
|
||||
<% if (error.status === 404) { %>
|
||||
The page you are looking for doesn't exist or has been moved.
|
||||
<% } else { %>
|
||||
An unexpected error occurred. Please try again later.
|
||||
<% } %>
|
||||
</p>
|
||||
<a href="/" class="btn btn-primary shadow-sm px-4 py-2">
|
||||
<i class="fa-solid fa-house me-2"></i>Return to Home
|
||||
</a>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<%- include('bottom') %>
|
||||
@@ -49,7 +49,7 @@
|
||||
</ul>
|
||||
<div class="form-inline mt-2 mt-md-0">
|
||||
<% if(ui.profileUrl){ %>
|
||||
<a id="cl-username" class="navbar-text text-light me-3" href="<%- ui.profileUrl %>" style="display: none;">
|
||||
<a id="cl-username" class="navbar-text text-light me-3 text-decoration-none" href="<%- ui.profileUrl %>" style="display: none;">
|
||||
<i class="fa-solid fa-user me-1"></i><span id="cl-username-text"></span>
|
||||
</a>
|
||||
<% } else { %>
|
||||
|
||||
Reference in New Issue
Block a user