Compare commits
26 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 wmantly
|
4874544955 | ||
|
wmantly
|
256476268f | ||
|
wmantly
|
a57d579b0e | ||
|
wmantly
|
49bf0fa1d3 | ||
|
wmantly
|
1b4764e328 | ||
|
wmantly
|
db3333e26d | ||
|
wmantly
|
1092031a9f | ||
|
wmantly
|
f386a5f9c3 | ||
|
wmantly
|
82318da484 | ||
|
wmantly
|
14784266b3 | ||
|
wmantly
|
362e77f3dd | ||
|
wmantly
|
dfafffe154 | ||
|
wmantly
|
bd4464ed19 | ||
|
wmantly
|
061a044a70 | ||
|
wmantly
|
c6a4a3c841 | ||
|
wmantly
|
0ef451e15d | ||
|
wmantly
|
6771904932 | ||
|
wmantly
|
c002afe043 | ||
|
wmantly
|
0a2c25ae75 | ||
|
wmantly
|
a15decb6f7 | ||
|
wmantly
|
599136e4dc | ||
|
wmantly
|
a7d5efc764 | ||
|
wmantly
|
8a76f71edd | ||
|
wmantly
|
e482f52f10 | ||
|
wmantly
|
a6af160627 | ||
|
wmantly
|
8c9646b65c |
@@ -1,9 +1,82 @@
|
||||
## v1.16.0
|
||||
- Added OpenBao PKI SSH Certificate Support
|
||||
- Fallback to LDAP Key injection
|
||||
|
||||
# v1.15.0
|
||||
- feat: Rename SSO Manager to Jump in UI
|
||||
|
||||
# Changelog
|
||||
|
||||
All notable changes to this project are documented here. Format loosely
|
||||
follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions
|
||||
correspond to git tags (`vX.Y.Z`) and `nodejs/package.json`'s `version`.
|
||||
|
||||
## [1.14.1] - 2026-08-01
|
||||
|
||||
### Fixed
|
||||
- **Bumped `@simpleworkjs/bao-conf` to 1.0.1** so standalone/no-OpenBao boots
|
||||
don't crash. bao-conf 1.0.0's `init()` threw when `VAULT_TOKEN` was unset,
|
||||
which — combined with `bin/www`'s `.catch(() => process.exit(1))` — made the
|
||||
jump host exit at boot in any deployment without an OpenBao sidecar
|
||||
(standalone Docker, bare metal). 1.0.1 makes `init()` fail-soft on a missing
|
||||
token (warn + continue from `CONF_SECRETS`), matching the documented
|
||||
contract. The theta-env stack is unaffected (it always sets a scoped
|
||||
`VAULT_TOKEN`).
|
||||
|
||||
## [1.14.0] - 2026-08-01
|
||||
|
||||
### Changed
|
||||
- **Secrets now load from OpenBao at boot** via
|
||||
[@simpleworkjs/bao-conf](https://simpleworkjs.github.io/bao-conf/), which
|
||||
deep-merges `secret/jump-host/conf` over the file-loaded config. The jump
|
||||
host authenticates to OpenBao with a scoped `VAULT_TOKEN` (policy
|
||||
`jump-host` — read-only on its own path), never the root token. Because the
|
||||
OIDC `clientSecret` is captured at require time inside `createOidcClient`
|
||||
(during `require('../models')`), `bin/www` now runs `bao-conf.init()`
|
||||
**before** `require('../models')`. Fail-soft: if OpenBao is unreachable,
|
||||
boot continues from `CONF_SECRETS`. The `config/jump-secrets.js` file is now
|
||||
an operator-edit seed artifact (gitignored); OpenBao is authoritative. See
|
||||
theta-env's [Secrets docs](https://theta42.github.io/theta-env/secrets/).
|
||||
- Bumped package version to track the release tag.
|
||||
|
||||
## [1.11.0] - 2026-07-30
|
||||
|
||||
### Added
|
||||
- **`app_super_admin` (cross-app) and `app_jump_admin` groups**: super admins are full admins here same as `app_sso_admin`; jump admins get audit page/data access without other admin rights. The Audit page/API is now actually admin-gated server-side (previously the page shell rendered for any logged-in user, only its data was gated).
|
||||
- **Host list adds Last connection/Last failed connection columns** and highlights rows green (a session is live right now) or yellow (the most recent attempt failed), backed by new per-host last-success/last-fail timestamps in `models/metrics.js`. `services/ssh_server.js` now attributes grammar/TUI connect failures to the resolved host when one was found, not just aggregate counters.
|
||||
|
||||
### Changed
|
||||
- **Dashboard's stat boxes and Top hosts/Top users cards moved to the Audit page** (audit is now the admin-facing metrics home; dashboard stays focused on "hosts I can reach"). "All hosts" renamed to "My hosts".
|
||||
|
||||
## [1.10.2] - 2026-07-30
|
||||
|
||||
### Changed
|
||||
- **Dashboard, Sessions, and Audit pages now match sso-manager-node/proxy's page width**, wrapping content in a standard container instead of rendering full-bleed inside the fluid shell.
|
||||
- **Audit's nav entry is now admin-gated** (`groups: ['admin']` in `utils/ui.js`), reusing the existing synthetic-admin-group nav-gating convention — the API route was already server-side admin-gated; this hides the nav link for non-admins too.
|
||||
|
||||
## [1.10.1] - 2026-07-28
|
||||
|
||||
### Fixed
|
||||
- **The API-token reveal modal silently didn't show after creating a token** — `submitApiToken()` called `app.modal.close()` immediately before `showToken()`'s `app.modal.open()` in the same tick, colliding with Bootstrap's hide-transition guard on the singleton modal. Same root cause as the OAuth-secret-reveal race fixed in sso-manager-node (v1.8.2) and the create-token race fixed in proxy (v1.7.0).
|
||||
|
||||
## [1.10.0] - 2026-07-28
|
||||
|
||||
### Added
|
||||
- **API-token UI unified with sso-manager-node/proxy**: card grid replacing the bare table, a new Edit modal (footer shows real created-by/on data), and a Description field on both the create and edit flows — the model and API already fully supported all of this, it just wasn't exposed anywhere in the dashboard.
|
||||
|
||||
### Changed
|
||||
- `@simpleworkjs/frontend` bumped to `^0.2.6` (this app was still on `^0.2.5`).
|
||||
|
||||
## [1.9.0] - 2026-07-28
|
||||
|
||||
### Added
|
||||
- **"Quick Jump" copy-to-clipboard section on the dashboard** — the `uid_-_target` grammar-mode SSH command was documented in the README but nowhere in the UI. A new card gives a one-click-copy command for interactive-picker mode, and every row in "Hosts you can reach" has its own copy button for the exact grammar-mode command to that host, ready to paste and run as-is (uses the logged-in user's own uid).
|
||||
|
||||
## [1.8.2] - 2026-07-28
|
||||
|
||||
### Fixed
|
||||
- **Audit records for a failed upstream connection only ever said `upstream-unreachable`** — `resolveAndConnect` discarded the real error from `connectUpstream` (ECONNREFUSED, ETIMEDOUT, an ssh2 auth-failure message, etc.) and replaced it with that one generic string, so there was no way to tell a network-layer failure from an auth failure from the audit log alone. This is what blocked root-causing the "Could not reach 192.168.1.206" (emby host) report — the real error is now captured and surfaced as a new `failDetail` field on the audit record, shown as a tooltip on the fail badge in the admin audit table.
|
||||
|
||||
## [1.8.1] - 2026-07-28
|
||||
|
||||
### Fixed
|
||||
|
||||
@@ -1,83 +0,0 @@
|
||||
# Deployment
|
||||
|
||||
Three ways to run the jump host, in increasing manual effort.
|
||||
|
||||
## 1. Unified theta-env stack
|
||||
|
||||
Set in `theta-env/setup.env`:
|
||||
|
||||
```
|
||||
CFG_JUMP_HOST_ENABLED=true
|
||||
CFG_JUMP_HOST=jump.example.com
|
||||
JUMP_SSH_PORT=2222
|
||||
```
|
||||
|
||||
Re-run `./setup.sh`. It builds the submodule, writes `config/jump-secrets.js`,
|
||||
mints the SSO API token, grants the `sshPublicKey` write-ACL to the shared
|
||||
`cn=ldapclient` bind account, registers `jump.example.com` in the proxy, and
|
||||
seeds a directory entry.
|
||||
|
||||
Expose SSH: forward the public host's `:22` (or `:2222`) to the container's
|
||||
published `JUMP_SSH_PORT`.
|
||||
|
||||
## 2. Standalone Docker
|
||||
|
||||
```
|
||||
cp secrets.js.example config/jump-secrets.js
|
||||
$EDITOR config/jump-secrets.js # LDAP bind (+ sshPublicKey write ACL), SSO url + token
|
||||
docker compose up -d --build
|
||||
```
|
||||
|
||||
Host keys persist in the `jump-data` volume. The web UI is on `:3002`; front it
|
||||
with your own TLS/proxy.
|
||||
|
||||
## 3. Bare metal
|
||||
|
||||
```
|
||||
curl -fsSL https://raw.githubusercontent.com/theta42/jump-host/master/ops/install.sh | sudo bash
|
||||
sudo $EDITOR /etc/jump-host/secrets.js
|
||||
sudo systemctl restart jump-host
|
||||
journalctl -u jump-host -f
|
||||
```
|
||||
|
||||
`ops/install.sh` installs Node 22 + Redis, hard-resets the checkout at
|
||||
`/opt/theta42/jump-host` to the remote branch, symlinks the systemd unit, and
|
||||
runs `npm ci`. Idempotent — re-run to update. Overridable via `REPO_DIR=`,
|
||||
`BRANCH=`, `SECRETS_FILE=`.
|
||||
|
||||
## The LDAP write-ACL (required)
|
||||
|
||||
The bind account must be able to write the `sshPublicKey` attribute so the jump
|
||||
host can inject its key. In the bundled OpenLDAP (`slapd.conf` / `olc`):
|
||||
|
||||
```
|
||||
access to attrs=sshPublicKey
|
||||
by dn.exact="cn=ldapclient,ou=people,dc=example,dc=com" write
|
||||
by self write
|
||||
by * read
|
||||
```
|
||||
|
||||
Without it, key injection fails and every bridge attempt is audited
|
||||
`key-inject-failed`.
|
||||
|
||||
## Listening on port 22
|
||||
|
||||
Default is 2222 (unprivileged). For 22: set `ssh.listenPort: 22`, and either
|
||||
|
||||
- systemd: uncomment `AmbientCapabilities=CAP_NET_BIND_SERVICE` in the unit; or
|
||||
- Docker: publish `22:22`; or
|
||||
- firewall: DNAT `22 → 2222`.
|
||||
|
||||
## Verifying
|
||||
|
||||
```
|
||||
# from a client whose key is in your LDAP sshPublicKey
|
||||
ssh -p 2222 youruid@jump.example.com # TUI picker
|
||||
ssh -p 2222 youruid_-_somehost@jump.example.com
|
||||
sftp -P 2222 youruid_-_somehost@jump.example.com
|
||||
|
||||
curl -s http://localhost:3002/health
|
||||
```
|
||||
|
||||
Watch `journalctl -u jump-host -f` (or `docker logs -f jump-host`) and the
|
||||
audit log at `/audit` in the web UI.
|
||||
@@ -159,6 +159,22 @@ Config layers via [@simpleworkjs/conf](https://www.npmjs.com/package/@simplework
|
||||
`conf/base.js` < `conf/<NODE_ENV>.js` < the `CONF_SECRETS` file < `app_*` env.
|
||||
See `secrets.js.example` for every key.
|
||||
|
||||
## Secrets
|
||||
|
||||
At boot, [@simpleworkjs/bao-conf](https://simpleworkjs.github.io/bao-conf/)
|
||||
deep-merges `secret/jump-host/conf` from **OpenBao** over the file-loaded
|
||||
config. The jump host's OIDC `clientSecret` is captured at require time
|
||||
(inside `createOidcClient` during `require('../models')`), so `bin/www` runs
|
||||
`bao-conf.init()` **before** `require('../models')`. Fail-soft: if OpenBao is
|
||||
unreachable, boot continues from `CONF_SECRETS`. The jump host authenticates to
|
||||
OpenBao with the scoped `VAULT_TOKEN` (env, policy `jump-host` — read only
|
||||
`secret/jump-host/conf`), never the root token.
|
||||
|
||||
The `config/jump-secrets.js` file is an operator-edit seed artifact
|
||||
(gitignored); the bootstrap writes the generated API token + OAuth client
|
||||
into OpenBao, which is authoritative. For the full architecture see
|
||||
theta-env's **[Secrets docs](https://theta42.github.io/theta-env/secrets/)**.
|
||||
|
||||
## Development
|
||||
|
||||
```
|
||||
|
||||
@@ -1,24 +0,0 @@
|
||||
# Documentation
|
||||
|
||||
This directory is the GitHub Pages documentation site for the Jump Host project.
|
||||
|
||||
**Live site:** https://theta42.github.io/jump-host/
|
||||
|
||||
## Pages
|
||||
|
||||
- `index.md` — overview and quick start
|
||||
- `connecting.md` — usage: the username grammar, the TUI picker, SFTP/WinSCP
|
||||
- `architecture.md` — how auth, access resolution, key injection, and bridging work
|
||||
- `installation.md` — Docker, bare-metal, and theta-env install; the LDAP write-ACL
|
||||
|
||||
## Local preview
|
||||
|
||||
```bash
|
||||
gem install jekyll bundler
|
||||
cd docs && jekyll serve
|
||||
# http://localhost:4000/jump-host/
|
||||
```
|
||||
|
||||
## Updating
|
||||
|
||||
Edit the markdown, push to `master`, and GitHub Pages rebuilds automatically.
|
||||
@@ -1,41 +0,0 @@
|
||||
title: Jump Host
|
||||
description: An SSH jump host for the theta42 stack — directory-driven host bridging with audit and metrics; LDAP + SSO Manager by default, or fully standalone.
|
||||
url: "https://theta42.github.io"
|
||||
baseurl: "/jump-host"
|
||||
logo: /assets/img/theta42.svg
|
||||
lang: en_US
|
||||
|
||||
plugins:
|
||||
- jekyll-seo-tag
|
||||
- jekyll-sitemap
|
||||
|
||||
github:
|
||||
repository_url: https://github.com/theta42/jump-host
|
||||
zip_url: https://github.com/theta42/jump-host/archive/refs/heads/master.zip
|
||||
tar_url: https://github.com/theta42/jump-host/archive/refs/heads/master.tar.gz
|
||||
repository_name: theta42/jump-host
|
||||
|
||||
nav:
|
||||
- title: Home
|
||||
page: /
|
||||
icon: fa-house
|
||||
- title: Connecting
|
||||
page: /connecting.html
|
||||
icon: fa-terminal
|
||||
- title: Architecture
|
||||
page: /architecture.html
|
||||
icon: fa-sitemap
|
||||
- title: Installation
|
||||
page: /installation.html
|
||||
icon: fa-download
|
||||
- title: Changelog
|
||||
url: https://github.com/theta42/jump-host/blob/master/CHANGELOG.md
|
||||
icon: fa-list
|
||||
|
||||
defaults:
|
||||
- scope:
|
||||
path: ""
|
||||
type: "pages"
|
||||
values:
|
||||
layout: default
|
||||
image: /assets/img/theta42.svg
|
||||
@@ -1,82 +0,0 @@
|
||||
<!doctype html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
|
||||
<link rel="icon" type="image/svg+xml" href="{{ '/assets/img/favicon.svg' | relative_url }}">
|
||||
|
||||
{% seo title=false %}
|
||||
<title>{% if page.title %}{{ page.title }} · {% endif %}{{ site.title }}</title>
|
||||
|
||||
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css">
|
||||
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.2/css/all.min.css">
|
||||
<link rel="stylesheet" href="{{ '/assets/css/style.css' | relative_url }}">
|
||||
</head>
|
||||
<body class="d-flex flex-column min-vh-100">
|
||||
|
||||
<nav class="navbar navbar-expand-md navbar-dark bg-dark fixed-top">
|
||||
<div class="container-fluid px-3">
|
||||
<a class="navbar-brand d-flex align-items-center" href="{{ '/' | relative_url }}">
|
||||
<img src="{{ '/assets/img/theta42.svg' | relative_url }}" height="28" class="me-2" alt="">
|
||||
{{ site.title }}
|
||||
</a>
|
||||
<button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#navMain" aria-controls="navMain" aria-expanded="false" aria-label="Toggle navigation">
|
||||
<span class="navbar-toggler-icon"></span>
|
||||
</button>
|
||||
<div class="collapse navbar-collapse justify-content-end" id="navMain">
|
||||
<ul class="navbar-nav">
|
||||
{% for item in site.nav %}
|
||||
<li class="nav-item">
|
||||
{% if item.page %}
|
||||
<a class="nav-link{% if page.url == item.page %} active{% endif %}" href="{{ item.page | relative_url }}">
|
||||
{% if item.icon %}<i class="fa-solid {{ item.icon }}"></i>{% endif %} {{ item.title }}
|
||||
</a>
|
||||
{% else %}
|
||||
<a class="nav-link" href="{{ item.url }}" target="_blank" rel="noopener">
|
||||
{% if item.icon %}<i class="fa-solid {{ item.icon }}"></i>{% endif %} {{ item.title }}
|
||||
</a>
|
||||
{% endif %}
|
||||
</li>
|
||||
{% endfor %}
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
</nav>
|
||||
|
||||
<main class="flex-grow-1" style="margin-top: 4.5rem;">
|
||||
<div class="container-fluid py-4 py-md-5">
|
||||
<div class="row justify-content-center">
|
||||
<div class="col-12 col-lg-10 col-xl-8">
|
||||
<div class="card shadow-lg">
|
||||
<div class="card-body p-4 p-md-5 site-content">
|
||||
{{ content }}
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
|
||||
<footer class="py-3 bg-dark text-light mt-auto">
|
||||
<div class="container-fluid d-flex flex-wrap justify-content-between align-items-center small gap-2 px-3">
|
||||
<span class="d-flex align-items-center gap-2">
|
||||
<a href="https://theta42.com" target="_blank" rel="noopener">
|
||||
<img width="40" src="{{ '/assets/img/theta42.svg' | relative_url }}" alt="theta42">
|
||||
</a>
|
||||
© {{ 'now' | date: '%Y' }} theta42 ·
|
||||
<a href="{{ site.github.repository_url }}/blob/master/LICENSE" target="_blank" rel="noopener" class="text-light">MIT License</a>
|
||||
</span>
|
||||
<span class="d-flex align-items-center gap-3">
|
||||
<a href="{{ site.github.repository_url }}" target="_blank" rel="noopener" class="text-light text-decoration-none">
|
||||
<i class="fa-brands fa-github"></i> GitHub
|
||||
</a>
|
||||
<a href="{{ site.github.repository_url }}/blob/master/CHANGELOG.md" target="_blank" rel="noopener" class="text-light text-decoration-none">
|
||||
<i class="fa-solid fa-list"></i> Changelog
|
||||
</a>
|
||||
</span>
|
||||
</div>
|
||||
</footer>
|
||||
|
||||
<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -1,147 +0,0 @@
|
||||
---
|
||||
layout: default
|
||||
title: Architecture
|
||||
description: How the jump host authenticates users, resolves reachable hosts from the directory, injects per-user keys, and bridges SSH — plus the web UI and audit model.
|
||||
---
|
||||
|
||||
# Architecture
|
||||
|
||||
The jump host is a Node.js service (using [`ssh2`](https://github.com/mscdex/ssh2)
|
||||
as both an SSH **server** and **client**) with two faces: the SSH front door
|
||||
(default `:2222`) and a web UI/API (`:3002`). It holds no user database of its
|
||||
own — identity, authorization, and onward credentials all come from the shared
|
||||
directory.
|
||||
|
||||
```
|
||||
┌────────────────────── jump host ──────────────────────┐
|
||||
ssh │ ssh2 Server (:2222) │ ssh2 Client
|
||||
─────┼─▶ 1. authenticate user ──▶ LDAP (sshPublicKey / bind) │ ───────────▶ downstream
|
||||
user │ 2. resolve target ──▶ SSO /api/discovery │ sshd (as the
|
||||
│ 3. inject key ──▶ LDAP (add sshPublicKey) │ real user)
|
||||
│ 4. bridge channels ◀───────────────────────────────▶ │
|
||||
│ web UI/API (:3002) ──▶ audit + metrics (redis) │
|
||||
└───────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
## 1. Inbound authentication
|
||||
|
||||
When a user connects, the jump host authenticates them against LDAP:
|
||||
|
||||
- **Public key** — it looks up the user's `sshPublicKey` values in the directory
|
||||
and matches the offered key (handling ssh2's probe-then-sign two-phase
|
||||
publickey auth). The jump host's *own* injected key (identified by its comment
|
||||
marker) is deliberately excluded from this match — only the jump host may hold
|
||||
that private key, so accepting it inbound would be a bypass.
|
||||
- **Password** — an LDAP simple bind as the user's DN. Policy is configurable:
|
||||
`off` (keys only — recommended for a public host), `local` (passwords only
|
||||
from loopback/RFC1918 clients, keys-only from the internet), or `all`.
|
||||
|
||||
Every attempt — success or failure, with method and reason — is audited.
|
||||
|
||||
## 2. Access & target resolution
|
||||
|
||||
The hosts a user may reach are computed from the directory, not a local list:
|
||||
|
||||
1. The user's LDAP group memberships (`(&(objectClass=groupOfNames)(member=…))`).
|
||||
2. For each group, the SSO's
|
||||
`GET /api/discovery/resources?group=<cn>` (authenticated with an API token),
|
||||
unioned and filtered to `kind: host`.
|
||||
|
||||
Each host's dial address is `metadata.ip` (or the hostname from
|
||||
`metadata.address`) and port `metadata.sshPort` (default 22). Results are cached
|
||||
briefly per user and shared by both the grammar path and the TUI picker.
|
||||
|
||||
Target matching tries, in order: exact slug → `host_`-prefixed slug → display
|
||||
name → IP → address hostname. A raw IP that isn't an accessible directory host
|
||||
is refused unless explicitly allowed.
|
||||
|
||||
> The directory auto-creates `<slug>_access` / `<slug>_admin` groups for every
|
||||
> host and service (see the SSO's
|
||||
> [Directory & Inventory](https://theta42.github.io/sso-manager-node/directory.html)
|
||||
> docs), which is exactly what this authorization reads.
|
||||
|
||||
## 3. Per-user key injection {#per-user-key-injection}
|
||||
|
||||
The jump host holds **one** keypair. To connect downstream *as the user*
|
||||
without asking them for anything, it must present a key the downstream `sshd`
|
||||
will accept for that user. Downstream hosts (joined via
|
||||
[ldap-client](https://github.com/theta42/ldap-client)) serve authorized keys
|
||||
straight from LDAP via `AuthorizedKeysCommand`. So on a user's first connection,
|
||||
the jump host appends its own public key to that user's `sshPublicKey` attribute
|
||||
in LDAP — comment-marked so it's recognizable — then connects downstream with
|
||||
its private key.
|
||||
|
||||
- Idempotent: the key is added once; a redis flag skips the LDAP round-trip
|
||||
afterwards.
|
||||
- The jump host's bind account therefore needs **write access to the
|
||||
`sshPublicKey` attribute** on user entries (an OpenLDAP ACL — see the README).
|
||||
In the bundled theta-env deployment this is handled for you.
|
||||
- Because the marker key is excluded from inbound auth (step 1), it grants only
|
||||
the jump host's onward path, never inbound impersonation.
|
||||
|
||||
## 4. Bridging
|
||||
|
||||
Once the upstream connection is ready, the jump host splices SSH channels
|
||||
between the two connections:
|
||||
|
||||
- **shell / exec** — piped both ways, with window-change and exit-status
|
||||
forwarded.
|
||||
- **SFTP subsystem** — the two subsystem channels are raw-piped as opaque bytes;
|
||||
no SFTP protocol parsing is needed, which is why WinSCP and `sftp` work
|
||||
unchanged.
|
||||
- Channel requests that arrive before the upstream is ready are buffered and
|
||||
replayed, so nothing is dropped during the connect.
|
||||
- The downstream host key's SHA256 fingerprint is recorded in the audit event
|
||||
(trust-on-use in v1).
|
||||
|
||||
Byte counts per direction are tallied cheaply for the audit record.
|
||||
|
||||
## Web UI, API & audit
|
||||
|
||||
An Express + EJS + Bootstrap app on `:3002` — the same front-end stack and
|
||||
look/feel as the SSO Manager and Proxy. Login is OIDC against the SSO plus a
|
||||
local anti-lockout admin (`auth.adminUsers`), with admin access gated by
|
||||
`auth.adminGroups`. It exposes:
|
||||
|
||||
- `GET /health` — open; `{status, activeSessions, version}`
|
||||
- `GET /api/sessions` — active sessions
|
||||
- `GET /api/audit?page=&uid=&target=&status=` — the paged audit log
|
||||
- `GET /api/metrics` — counters (total, failures, top users/hosts)
|
||||
|
||||
Audit events and counters live in redis. Each event captures: user, auth method,
|
||||
mode (grammar/picker), target slug/address/port, channel type, client IP,
|
||||
success + failure reason, downstream host-key fingerprint, timing, and bytes in/out.
|
||||
|
||||
## Standalone mode
|
||||
|
||||
Everything above describes the default backend. Set `standalone.enabled: true`
|
||||
and two modules become conditional facades, swapping their entire
|
||||
implementation at `require` time based on that flag — nothing else in the
|
||||
codebase (`ssh_server.js`, `bridge.js`, `key_inject.js`, `tui_picker.js`, the
|
||||
web UI) changes or even knows which mode it's running in:
|
||||
|
||||
- **`models/user_ldap.js`** — LDAP client, or `models/user_file.js` (an
|
||||
[@simpleworkjs/orm](https://www.npmjs.com/package/@simpleworkjs/orm)-backed
|
||||
store implementing the same `getUser` / `getGroups` / `checkPassword` /
|
||||
`addSshKey` interface).
|
||||
- **`utils/access.js`** — LDAP groups + SSO `/api/discovery`, or
|
||||
`utils/hosts_file.js` (same ORM package, same `accessibleHosts()` interface).
|
||||
In standalone mode there's no group-based authorization: every stored host
|
||||
is accessible to every stored user.
|
||||
|
||||
The ORM is Sequelize underneath, defaulting to a local SQLite file but
|
||||
accepting any Sequelize-supported dialect via `conf.orm`. See
|
||||
[Installation](installation.html#standalone-mode) for config and how to add
|
||||
users/hosts (there's no admin UI for standalone data yet).
|
||||
|
||||
## Where it sits in the stack
|
||||
|
||||
- **[SSO Manager](https://theta42.github.io/sso-manager-node/)** — provides the
|
||||
OpenLDAP directory (users, groups, `sshPublicKey`) and the inventory API this
|
||||
jump host reads.
|
||||
- **[ldap-client](https://github.com/theta42/ldap-client)** — enrolls the
|
||||
downstream Linux hosts (SSSD/PAM + `AuthorizedKeysCommand`) that the jump host
|
||||
connects into.
|
||||
- **[Proxy](https://theta42.github.io/proxy/)** — fronts the jump host's web UI
|
||||
under TLS.
|
||||
- **[theta-env](https://theta42.github.io/theta-env/)** — wires it all together.
|
||||
@@ -1,116 +0,0 @@
|
||||
/* theta42 docs site — shares the in-app dark navbar/footer + card look
|
||||
(Bootstrap 5 + Font Awesome, same as the running apps) rather than a
|
||||
generic Jekyll theme. */
|
||||
|
||||
body {
|
||||
background-color: #f4f5f6;
|
||||
}
|
||||
|
||||
.navbar-brand img {
|
||||
filter: drop-shadow(0 0 2px rgba(0, 0, 0, .4));
|
||||
}
|
||||
|
||||
.navbar-nav .nav-link.active {
|
||||
color: #fff;
|
||||
font-weight: 600;
|
||||
}
|
||||
|
||||
/* Markdown content typography, scoped to the card body so it doesn't leak
|
||||
into the nav/footer. */
|
||||
.site-content h1:first-child {
|
||||
margin-top: 0;
|
||||
}
|
||||
|
||||
.site-content h1,
|
||||
.site-content h2,
|
||||
.site-content h3 {
|
||||
font-weight: 700;
|
||||
}
|
||||
|
||||
.site-content h2 {
|
||||
margin-top: 2.5rem;
|
||||
padding-bottom: .4rem;
|
||||
border-bottom: 1px solid #e9ecef;
|
||||
}
|
||||
|
||||
.site-content h3 {
|
||||
margin-top: 1.75rem;
|
||||
}
|
||||
|
||||
.site-content a {
|
||||
color: #a3671f;
|
||||
text-decoration-color: rgba(163, 103, 31, .35);
|
||||
}
|
||||
|
||||
.site-content a:hover {
|
||||
color: #8a5a16;
|
||||
}
|
||||
|
||||
.site-content pre {
|
||||
background-color: #212529;
|
||||
color: #f8f9fa;
|
||||
padding: 1rem 1.25rem;
|
||||
border-radius: .375rem;
|
||||
overflow-x: auto;
|
||||
}
|
||||
|
||||
.site-content code {
|
||||
color: #a3671f;
|
||||
background-color: #f4f0e8;
|
||||
padding: .15em .4em;
|
||||
border-radius: .25rem;
|
||||
font-size: .875em;
|
||||
}
|
||||
|
||||
.site-content pre code {
|
||||
color: inherit;
|
||||
background: none;
|
||||
padding: 0;
|
||||
}
|
||||
|
||||
.site-content table {
|
||||
display: block;
|
||||
overflow-x: auto;
|
||||
width: 100%;
|
||||
border-collapse: collapse;
|
||||
margin: 1.25rem 0;
|
||||
}
|
||||
|
||||
.site-content table th,
|
||||
.site-content table td {
|
||||
border: 1px solid #dee2e6;
|
||||
padding: .5rem .75rem;
|
||||
text-align: left;
|
||||
}
|
||||
|
||||
.site-content table th {
|
||||
background-color: #f8f9fa;
|
||||
}
|
||||
|
||||
.site-content blockquote {
|
||||
border-left: 4px solid #C59341;
|
||||
padding: .5rem 1rem;
|
||||
margin: 1.25rem 0;
|
||||
background-color: #f8f6f1;
|
||||
color: #495057;
|
||||
}
|
||||
|
||||
.site-content img {
|
||||
max-width: 100%;
|
||||
height: auto;
|
||||
}
|
||||
|
||||
/* Screenshot grids in the markdown use width="49%" inline attrs for a
|
||||
two-up desktop layout -- stack them on narrow screens instead of
|
||||
squeezing to illegibility. */
|
||||
@media (max-width: 576px) {
|
||||
.site-content img[width] {
|
||||
width: 100% !important;
|
||||
margin-bottom: .75rem;
|
||||
}
|
||||
}
|
||||
|
||||
.site-content hr {
|
||||
margin: 2rem 0;
|
||||
border-top: 1px solid #e9ecef;
|
||||
}
|
||||
@@ -1,17 +0,0 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">
|
||||
<!-- Background circle -->
|
||||
<circle cx="50" cy="50" r="48" fill="#1a1a1a" stroke="#4a9eff" stroke-width="3"/>
|
||||
|
||||
<!-- Network nodes -->
|
||||
<circle cx="30" cy="30" r="8" fill="#4a9eff"/>
|
||||
<circle cx="70" cy="30" r="8" fill="#4a9eff"/>
|
||||
<circle cx="50" cy="50" r="10" fill="#66b3ff"/>
|
||||
<circle cx="30" cy="70" r="8" fill="#4a9eff"/>
|
||||
<circle cx="70" cy="70" r="8" fill="#4a9eff"/>
|
||||
|
||||
<!-- Connection lines -->
|
||||
<line x1="30" y1="30" x2="50" y2="50" stroke="#4a9eff" stroke-width="2"/>
|
||||
<line x1="70" y1="30" x2="50" y2="50" stroke="#4a9eff" stroke-width="2"/>
|
||||
<line x1="30" y1="70" x2="50" y2="50" stroke="#4a9eff" stroke-width="2"/>
|
||||
<line x1="70" y1="70" x2="50" y2="50" stroke="#4a9eff" stroke-width="2"/>
|
||||
</svg>
|
||||
|
Before Width: | Height: | Size: 788 B |
@@ -1,51 +0,0 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 400 400" width="100%" height="100%">
|
||||
<defs>
|
||||
<linearGradient id="gold-grad" x1="0%" y1="0%" x2="100%" y2="100%">
|
||||
<stop offset="0%" stop-color="#C59341" />
|
||||
<stop offset="20%" stop-color="#E4B869" />
|
||||
<stop offset="40%" stop-color="#FBF0B9" />
|
||||
<stop offset="60%" stop-color="#DFB260" />
|
||||
<stop offset="80%" stop-color="#BC8837" />
|
||||
<stop offset="100%" stop-color="#A36F28" />
|
||||
</linearGradient>
|
||||
|
||||
<linearGradient id="text-grad" x1="0%" y1="100%" x2="100%" y2="0%">
|
||||
<stop offset="0%" stop-color="#FFFFFF" />
|
||||
<stop offset="40%" stop-color="#F5E3B5" />
|
||||
<stop offset="70%" stop-color="#D4A343" />
|
||||
<stop offset="100%" stop-color="#8A5A16" />
|
||||
</linearGradient>
|
||||
|
||||
<filter id="drop-shadow" x="-20%" y="-20%" width="140%" height="140%">
|
||||
<feDropShadow dx="0" dy="8" stdDeviation="6" flood-color="#000000" flood-opacity="0.4"/>
|
||||
</filter>
|
||||
</defs>
|
||||
|
||||
<g filter="url(#drop-shadow)">
|
||||
<g fill="url(#gold-grad)">
|
||||
<path d="M 200,40
|
||||
C 290,40 350,110 350,200
|
||||
C 350,290 290,360 200,360
|
||||
C 110,360 50,290 50,200
|
||||
C 50,110 110,40 200,40 Z
|
||||
M 200,75
|
||||
C 130,75 88,130 88,200
|
||||
C 88,270 130,325 200,325
|
||||
C 270,325 312,270 312,200
|
||||
C 312,130 270,75 200,75 Z"
|
||||
fill-rule="evenodd" />
|
||||
|
||||
<path d="M 88,190 L 140,190 C 140,190 142,210 140,210 L 88,210 Z" />
|
||||
|
||||
<path d="M 260,190 L 312,190 C 312,190 310,210 260,210 Z" />
|
||||
</g>
|
||||
|
||||
<text x="200" y="222"
|
||||
font-family="system-ui, -apple-system, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif"
|
||||
font-size="78"
|
||||
font-weight="900"
|
||||
fill="url(#text-grad)"
|
||||
text-anchor="middle"
|
||||
letter-spacing="-2">42</text>
|
||||
</g>
|
||||
</svg>
|
||||
|
Before Width: | Height: | Size: 1.9 KiB |
@@ -1,105 +0,0 @@
|
||||
---
|
||||
layout: default
|
||||
title: Connecting
|
||||
description: How to reach downstream hosts through the jump host — the username grammar, the interactive picker, SFTP/WinSCP, and what access you get.
|
||||
---
|
||||
|
||||
# Connecting
|
||||
|
||||
You reach a downstream host two ways: name the target in your username, or log
|
||||
in plain and pick it from a menu. Either way you authenticate **once**, to the
|
||||
jump host, with your directory credentials.
|
||||
|
||||
## The username grammar
|
||||
|
||||
```
|
||||
{uid}_-_{target}
|
||||
```
|
||||
|
||||
- `{uid}` — your directory username.
|
||||
- `_-_` — the separator (legal in an SSH username everywhere, including WinSCP).
|
||||
- `{target}` — the host to reach: a directory **slug** (`host_web01` or just
|
||||
`web01`), the host's **display name**, its **IP**, or the hostname in its
|
||||
directory `address`.
|
||||
|
||||
```bash
|
||||
ssh alice_-_web01@jump.example.com # by slug (host_ prefix optional)
|
||||
ssh alice_-_10.0.0.10@jump.example.com # by IP (must be a host you can reach)
|
||||
```
|
||||
|
||||
If the target matches a host your directory groups grant, you're bridged
|
||||
straight to its `sshd` — same as if you'd SSH'd directly, but through the
|
||||
audited jump host.
|
||||
|
||||
## SFTP / WinSCP / scp
|
||||
|
||||
Because the whole route is encoded in the username, file transfer tools that
|
||||
only take one connection string work with no extra configuration:
|
||||
|
||||
```bash
|
||||
sftp -P 2222 alice_-_web01@jump.example.com
|
||||
scp -P 2222 file.txt alice_-_web01@jump.example.com:/tmp/
|
||||
```
|
||||
|
||||
**WinSCP:** set Host name to `jump.example.com`, Port to `2222`, and User name
|
||||
to `alice_-_web01`. SFTP is bridged as an opaque byte stream, so all operations
|
||||
(browse, upload, download, rename) work normally.
|
||||
|
||||
## The interactive picker
|
||||
|
||||
Log in with just your username and you get a TUI list of every host you can
|
||||
reach:
|
||||
|
||||
```bash
|
||||
ssh alice@jump.example.com
|
||||
```
|
||||
|
||||
- **↑ / ↓** move the selection
|
||||
- **type** to filter the list incrementally
|
||||
- **Enter** connect to the highlighted host
|
||||
- **number keys** jump straight to that row
|
||||
- **q** or **Ctrl-C** to quit
|
||||
|
||||
Pick a host and you're bridged into it. The picker only ever lists hosts your
|
||||
directory access allows — it doubles as "what can I reach from here?"
|
||||
|
||||
## What you can reach
|
||||
|
||||
The set of hosts is computed per login: your LDAP group memberships intersected
|
||||
with the SSO directory's hosts (via the `host_<name>_access` groups the
|
||||
directory auto-creates for each machine). To get access to a new host, an admin
|
||||
adds you to that host's access group in the SSO — nothing on the jump host
|
||||
changes.
|
||||
|
||||
Targets that don't resolve to a host you're allowed to reach are refused (and
|
||||
audited). Raw IPs that aren't a known directory host are denied by default.
|
||||
|
||||
> On a [standalone](architecture.html#standalone-mode) jump host (no LDAP/SSO),
|
||||
> every registered host is reachable by every registered user — there's no
|
||||
> group-based restriction to ask an admin about.
|
||||
|
||||
## Authentication
|
||||
|
||||
The jump host authenticates **you** against the directory:
|
||||
|
||||
- **Public key** — matched against your `sshPublicKey` entries in LDAP. Use your
|
||||
normal SSH key; the client picks it automatically.
|
||||
- **Password** — your directory password (LDAP bind). Password auth is often
|
||||
restricted to local networks or disabled entirely on a public jump host
|
||||
(keys-only) — check with your operator.
|
||||
|
||||
You never manage a separate credential for the downstream host: the jump host
|
||||
handles onward authentication for you (see
|
||||
[Architecture](architecture.html#per-user-key-injection)).
|
||||
|
||||
## First connection to a host
|
||||
|
||||
The very first time you reach a given downstream host, the jump host provisions
|
||||
its access key for you behind the scenes. If that first attempt races the
|
||||
directory's key-cache refresh you may see a brief
|
||||
|
||||
```
|
||||
jump-host: first-time key propagation, retrying…
|
||||
```
|
||||
|
||||
and it reconnects automatically. Subsequent connections are immediate.
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 90 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 83 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 78 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 72 KiB |
-121
@@ -1,121 +0,0 @@
|
||||
---
|
||||
layout: default
|
||||
title: Home
|
||||
description: An SSH jump host for the theta42 stack — one public host and directory-driven access to every downstream machine you're entitled to; LDAP by default, or fully standalone.
|
||||
---
|
||||
|
||||
# Jump Host
|
||||
|
||||
An SSH jump host for the [theta42](https://github.com/theta42) self-hosted
|
||||
stack. Users SSH into **one** public host and land on any downstream host
|
||||
they're entitled to — authenticated against the shared LDAP directory,
|
||||
authorized from the [SSO Manager](https://theta42.github.io/sso-manager-node/)'s
|
||||
inventory graph, and audited end to end.
|
||||
|
||||
No per-host accounts, no distributing keys, no VPN. The same people who log in
|
||||
to your SSO are the people who can reach your machines — and only the machines
|
||||
their directory groups grant.
|
||||
|
||||
Part of the theta42 self-hosted identity stack, alongside
|
||||
[SSO Manager](https://theta42.github.io/sso-manager-node/) and
|
||||
[Proxy](https://theta42.github.io/proxy/), composable with one command via
|
||||
[theta-env](https://theta42.github.io/theta-env/).
|
||||
|
||||
## Screenshots
|
||||
|
||||
<a href="images/login.png" target="_blank"><img src="images/login.png" alt="Login" width="49%"></a>
|
||||
<a href="images/dashboard.png" target="_blank"><img src="images/dashboard.png" alt="Dashboard" width="49%"></a>
|
||||
<a href="images/sessions.png" target="_blank"><img src="images/sessions.png" alt="Active sessions" width="49%"></a>
|
||||
<a href="images/audit.png" target="_blank"><img src="images/audit.png" alt="Audit log" width="49%"></a>
|
||||
|
||||
*(click any screenshot to view full size)*
|
||||
|
||||
Don't want to run LDAP or the SSO Manager? **Standalone mode** stores users
|
||||
and hosts in a local SQL database instead (SQLite by default, any
|
||||
Sequelize-supported dialect if you want something else) — same SSH front door,
|
||||
key injection, and audit trail. See
|
||||
[Installation](installation.html#standalone-mode) to get started.
|
||||
|
||||
## Two ways to connect
|
||||
|
||||
**Direct (WinSCP/SFTP-friendly):**
|
||||
|
||||
```bash
|
||||
ssh alice_-_web01@jump.example.com
|
||||
sftp -P 2222 alice_-_web01@jump.example.com
|
||||
```
|
||||
|
||||
The username grammar is `{uid}_-_{target}` — `target` is a directory host slug
|
||||
(with or without the `host_` prefix), a bare hostname, or an IP. One username
|
||||
string, no interactive step, so it works cleanly in WinSCP and scripts.
|
||||
|
||||
**Interactive picker:**
|
||||
|
||||
```bash
|
||||
ssh alice@jump.example.com
|
||||
```
|
||||
|
||||
A plain login shows a TUI list of the hosts you can reach; arrow-key or type to
|
||||
filter, Enter to connect.
|
||||
|
||||
See **[Connecting](connecting.html)** for the full usage guide.
|
||||
|
||||
## Why a jump host (and why this one)
|
||||
|
||||
A bastion/jump host is the standard way to give SSH access to internal machines
|
||||
through a single audited entry point. What's usually painful is *authorization*
|
||||
and *credentials*: who may reach which host, and how the bastion authenticates
|
||||
onward without you copying keys everywhere.
|
||||
|
||||
This jump host answers both from your directory:
|
||||
|
||||
- **Authorization is your directory graph.** The hosts you can reach are the
|
||||
union of your LDAP groups × the SSO's inventory (the `host_<name>_access`
|
||||
groups the directory already auto-creates). Add someone to a group; they can
|
||||
reach the host. No bastion-side allow-list to maintain.
|
||||
- **Onward auth is automatic.** The jump host holds one key and injects its
|
||||
public half into your `sshPublicKey` on first use, then connects downstream
|
||||
**as you**. Downstream hosts already serve keys from LDAP (via
|
||||
[ldap-client](https://github.com/theta42/ldap-client)'s
|
||||
`AuthorizedKeysCommand`), so nothing downstream needs configuring.
|
||||
|
||||
## Features
|
||||
|
||||
- **Username-grammar routing** (`uid_-_target`) — straight-through to the host,
|
||||
SFTP included (WinSCP works)
|
||||
- **Interactive TUI host picker** on plain login, scoped to your access
|
||||
- **LDAP inbound auth** — public key or password (keys-only policy recommended
|
||||
for a public host)
|
||||
- **Directory-driven access** — reachable hosts come from the SSO inventory, not
|
||||
a static list
|
||||
- **Per-user key injection** — no downstream changes, no key distribution
|
||||
- **Shell, exec, and SFTP** bridging
|
||||
- **Web UI + HTTP API** for auditing and metrics — active sessions, a searchable
|
||||
audit log, per-user/per-host counters
|
||||
- **Full audit trail** — who, target, method, result, bytes, duration, and the
|
||||
downstream host-key fingerprint
|
||||
- **Standalone mode** — no LDAP, no SSO Manager; users and hosts live in a
|
||||
local SQL database (Sequelize, any dialect — SQLite by default)
|
||||
- Packaged like the rest of the stack: one-command Docker, idempotent bare-metal
|
||||
installer, or bundled in theta-env
|
||||
|
||||
## Get it
|
||||
|
||||
```bash
|
||||
git clone https://github.com/theta42/jump-host.git
|
||||
cd jump-host
|
||||
cp secrets.js.example config/jump-secrets.js # then edit it
|
||||
docker compose up -d --build
|
||||
```
|
||||
|
||||
That's the standalone quick start. For bare-metal and the bundled theta-env
|
||||
option, see **[Installation](installation.html)**.
|
||||
|
||||
## Related projects
|
||||
|
||||
- **[SSO Manager](https://theta42.github.io/sso-manager-node/)** — the OpenLDAP
|
||||
directory + OIDC provider + the inventory graph this jump host reads.
|
||||
- **[Proxy](https://theta42.github.io/proxy/)** — puts your web apps behind the
|
||||
same identity; fronts this jump host's web UI.
|
||||
- **[theta-env](https://theta42.github.io/theta-env/)** — runs the whole stack,
|
||||
jump host included, with one command.
|
||||
@@ -1,155 +0,0 @@
|
||||
---
|
||||
layout: default
|
||||
title: Installation
|
||||
description: Install the jump host three ways — bundled in the theta-env stack, standalone Docker, or bare metal — plus standalone mode (no LDAP/SSO), the LDAP write-ACL, and port-22 options.
|
||||
---
|
||||
|
||||
# Installation
|
||||
|
||||
Three ways to run the jump host, in increasing manual effort. All read their
|
||||
config through [@simpleworkjs/conf](https://www.npmjs.com/package/@simpleworkjs/conf)
|
||||
(`conf/base.js` < `conf/<NODE_ENV>.js` < the `CONF_SECRETS` file < `app_*` env).
|
||||
|
||||
## Standalone mode (no LDAP/SSO) {#standalone-mode}
|
||||
|
||||
Skip LDAP and the SSO Manager entirely. Not to be confused with "Standalone
|
||||
Docker" below, which is still LDAP + SSO, just run outside theta-env. Set in your secrets/config:
|
||||
|
||||
```js
|
||||
standalone: { enabled: true },
|
||||
orm: { dialect: 'sqlite', storage: './data/standalone.sqlite', logging: false },
|
||||
```
|
||||
|
||||
`orm` is passed straight to Sequelize, so any supported dialect works — SQLite
|
||||
is just the zero-dependency default. Everything downstream of auth (bridging,
|
||||
key injection, the web UI, audit) is unchanged.
|
||||
|
||||
There's no admin UI for standalone users/hosts yet, so add them directly with
|
||||
the ORM models:
|
||||
|
||||
```js
|
||||
const StandaloneUser = require('./models/standalone_user');
|
||||
const StandaloneHost = require('./models/standalone_host');
|
||||
const bcrypt = require('bcrypt');
|
||||
|
||||
await StandaloneUser.create({
|
||||
uid: 'alice',
|
||||
passwordHash: await bcrypt.hash('a real password', 10),
|
||||
sshPublicKeys: ['ssh-ed25519 AAAA... alice@laptop'],
|
||||
groups: [],
|
||||
});
|
||||
|
||||
await StandaloneHost.create({
|
||||
slug: 'host_web01',
|
||||
displayName: 'web01',
|
||||
kind: 'host',
|
||||
metadata: { ip: '10.0.0.5', sshPort: 22 },
|
||||
});
|
||||
```
|
||||
|
||||
Every host in the standalone inventory is reachable by every standalone user —
|
||||
there's no group-based authorization yet (`groups` on `StandaloneUser` is
|
||||
accepted for interface parity with the LDAP path, not enforced).
|
||||
|
||||
The rest of this page (requirements, the LDAP write-ACL, the three install
|
||||
paths) describes the default LDAP + SSO mode — skip it if you're running
|
||||
standalone.
|
||||
|
||||
## Requirements
|
||||
|
||||
- The [SSO Manager](https://theta42.github.io/sso-manager-node/) (OpenLDAP
|
||||
directory + `/api/discovery`), v1.3.0 or newer.
|
||||
- Downstream hosts joined via
|
||||
[ldap-client](https://github.com/theta42/ldap-client) (SSSD +
|
||||
`AuthorizedKeysCommand`).
|
||||
- An LDAP bind account with **write access to the `sshPublicKey` attribute** on
|
||||
user entries (see below).
|
||||
- An SSO API token (`sso_…`) for the directory queries.
|
||||
|
||||
## 1. Unified theta-env stack (recommended)
|
||||
|
||||
Enable it in `theta-env/setup.env`:
|
||||
|
||||
```bash
|
||||
CFG_JUMP_HOST_ENABLED=true
|
||||
CFG_JUMP_HOST=jump.example.com
|
||||
JUMP_SSH_PORT=2222
|
||||
```
|
||||
|
||||
Re-run `./setup.sh`. The stack builds the submodule (behind the `jump-host`
|
||||
compose profile), mints the directory API token, writes
|
||||
`./config/jump-secrets.js`, grants the `sshPublicKey` write-ACL, registers the
|
||||
jump host in the proxy, and seeds a directory entry. Forward the public host's
|
||||
`:22` (or `:2222`) to the container's published `JUMP_SSH_PORT`.
|
||||
|
||||
## 2. Standalone Docker
|
||||
|
||||
```bash
|
||||
cp secrets.js.example config/jump-secrets.js
|
||||
$EDITOR config/jump-secrets.js # LDAP bind (+ sshPublicKey write ACL), SSO url + token
|
||||
docker compose up -d --build
|
||||
```
|
||||
|
||||
Host keys persist in the `jump-data` volume. The web UI is on `:3002`; front it
|
||||
with your own TLS/proxy.
|
||||
|
||||
## 3. Bare metal
|
||||
|
||||
```bash
|
||||
curl -fsSL https://raw.githubusercontent.com/theta42/jump-host/master/ops/install.sh | sudo bash
|
||||
sudo $EDITOR /etc/jump-host/secrets.js
|
||||
sudo systemctl restart jump-host
|
||||
journalctl -u jump-host -f
|
||||
```
|
||||
|
||||
`ops/install.sh` installs Node 22 + Redis, hard-resets the checkout at
|
||||
`/opt/theta42/jump-host` to the remote branch, symlinks the systemd unit, and
|
||||
runs `npm ci`. Idempotent — re-run to update. Overridable via `REPO_DIR=`,
|
||||
`BRANCH=`, `SECRETS_FILE=`.
|
||||
|
||||
## The LDAP write-ACL (required)
|
||||
|
||||
The jump host injects its public key into each user's `sshPublicKey`, so its
|
||||
bind account must be able to **write** that attribute. In the bundled OpenLDAP:
|
||||
|
||||
```
|
||||
access to attrs=sshPublicKey
|
||||
by dn.exact="cn=ldapclient,ou=people,dc=example,dc=com" write
|
||||
by self write
|
||||
by * read
|
||||
```
|
||||
|
||||
In the theta-env bundle this is handled for you (the jump host binds as the LDAP
|
||||
admin). For a hardened standalone deployment, use a dedicated bind account with
|
||||
exactly this attribute-scoped ACL. Without write access, key injection fails and
|
||||
every bridge attempt is audited `key-inject-failed`.
|
||||
|
||||
## Listening on port 22
|
||||
|
||||
The default SSH port is **2222** so the service needs no privilege. To listen on
|
||||
22, set `ssh.listenPort: 22` and either:
|
||||
|
||||
- **systemd:** uncomment `AmbientCapabilities=CAP_NET_BIND_SERVICE` in the unit;
|
||||
- **Docker:** publish `22:22`; or
|
||||
- **firewall:** DNAT `22 → 2222`.
|
||||
|
||||
## Configuration reference
|
||||
|
||||
Every key is documented in
|
||||
[`secrets.js.example`](https://github.com/theta42/jump-host/blob/master/secrets.js.example):
|
||||
`ldap` (bind + bases + TLS), `sso` (url + apiToken), `ssh`
|
||||
(`listenPort`, `passwordAuth`, `allowRawIPs`, `keyComment`, timeouts,
|
||||
`maxSessions`), `web.port`, `oidc` (web-UI SSO login), `auth`
|
||||
(`adminGroups` / `adminUsers` / `localAdminPass`), and `redis`.
|
||||
|
||||
## Verifying
|
||||
|
||||
```bash
|
||||
ssh -p 2222 youruid@jump.example.com # TUI picker
|
||||
ssh -p 2222 youruid_-_somehost@jump.example.com # direct
|
||||
sftp -P 2222 youruid_-_somehost@jump.example.com # WinSCP path
|
||||
curl -s http://localhost:3002/health
|
||||
```
|
||||
|
||||
Watch `journalctl -u jump-host -f` (or `docker logs -f jump-host`) and the audit
|
||||
log at `/audit` in the web UI.
|
||||
@@ -1,4 +0,0 @@
|
||||
User-agent: *
|
||||
Allow: /
|
||||
|
||||
Sitemap: https://theta42.github.io/proxy/sitemap.xml
|
||||
+34
-23
@@ -9,32 +9,43 @@ const http = require('http');
|
||||
const conf = require('@simpleworkjs/conf');
|
||||
const { Server } = require('socket.io');
|
||||
|
||||
require('../models');
|
||||
// @simpleworkjs/conf loads ./config/jump-secrets.js synchronously, then
|
||||
// @simpleworkjs/bao-conf deep-merges secret/jump-host/conf from OpenBao over
|
||||
// it. The OIDC clientSecret is captured at require time inside models (via
|
||||
// createOidcClient), so the fetch MUST resolve before require('../models').
|
||||
// Fail-soft: if OpenBao is unreachable, init() leaves conf as the file-loaded
|
||||
// fallback and boot continues from ./config/jump-secrets.js.
|
||||
require('@simpleworkjs/bao-conf').init({ path: 'jump-host', conf }).then(() => {
|
||||
require('../models');
|
||||
|
||||
const app = require('../app');
|
||||
const middleware = require('../middleware/auth');
|
||||
const sshServer = require('../services/ssh_server');
|
||||
const app = require('../app');
|
||||
const middleware = require('../middleware/auth');
|
||||
const sshServer = require('../services/ssh_server');
|
||||
|
||||
const webPort = (conf.web && conf.web.port) || 3002;
|
||||
const server = http.createServer(app);
|
||||
const webPort = (conf.web && conf.web.port) || 3002;
|
||||
const server = http.createServer(app);
|
||||
|
||||
// Socket.IO — the client framework (app-base.js) opens an authenticated socket.
|
||||
// We don't push anything yet, but serving /socket.io keeps the shared front-end
|
||||
// working exactly as it does in the sibling apps.
|
||||
const io = new Server(server);
|
||||
io.use(middleware.authIO);
|
||||
app.io = io;
|
||||
// Socket.IO — the client framework (app-base.js) opens an authenticated socket.
|
||||
// We don't push anything yet, but serving /socket.io keeps the shared front-end
|
||||
// working exactly as it does in the sibling apps.
|
||||
const io = new Server(server);
|
||||
io.use(middleware.authIO);
|
||||
app.io = io;
|
||||
|
||||
server.listen(webPort, () => {
|
||||
console.log(`[web] jump-host UI/API on :${server.address().port}`);
|
||||
});
|
||||
server.listen(webPort, () => {
|
||||
console.log(`[web] jump-host UI/API on :${server.address().port}`);
|
||||
});
|
||||
|
||||
sshServer.start();
|
||||
sshServer.start();
|
||||
|
||||
function shutdown() {
|
||||
console.log('[jump-host] shutting down');
|
||||
server.close();
|
||||
process.exit(0);
|
||||
}
|
||||
process.on('SIGTERM', shutdown);
|
||||
process.on('SIGINT', shutdown);
|
||||
function shutdown() {
|
||||
console.log('[jump-host] shutting down');
|
||||
server.close();
|
||||
process.exit(0);
|
||||
}
|
||||
process.on('SIGTERM', shutdown);
|
||||
process.on('SIGINT', shutdown);
|
||||
}).catch(err => {
|
||||
console.error('boot failed:', err);
|
||||
process.exit(1);
|
||||
});
|
||||
+7
-2
@@ -6,7 +6,7 @@
|
||||
// values (LDAP creds, SSO API token) belong in the secrets file.
|
||||
|
||||
module.exports = {
|
||||
name: 'Jump Host',
|
||||
name: 'Jump',
|
||||
logo: '/static/img/theta42.svg',
|
||||
|
||||
// LDAP directory the users live in (same directory the SSO manages).
|
||||
@@ -80,7 +80,12 @@ module.exports = {
|
||||
|
||||
auth: {
|
||||
// OIDC group memberships that grant web UI/API admin access.
|
||||
adminGroups: ['app_sso_admin'],
|
||||
// app_super_admin is the cross-app super admin group (sso, proxy, jump-host).
|
||||
adminGroups: ['app_sso_admin', 'app_super_admin'],
|
||||
// OIDC group memberships that grant jump admin access (the audit page
|
||||
// and its data), without granting other admin-only rights. Full admins
|
||||
// (adminGroups/adminUsers) always have jump admin access too.
|
||||
jumpAdminGroups: ['app_jump_admin'],
|
||||
// Local anti-lockout admin: the first name here is bootstrapped as a
|
||||
// redis-backed user on first boot (password from localAdminPass, or a
|
||||
// random one printed to the log once). Lets you in even with OIDC down.
|
||||
|
||||
@@ -56,6 +56,25 @@ async function requireAdmin(req, res, next){
|
||||
next(error);
|
||||
}
|
||||
|
||||
// Jump admin = access to the audit page/data. A narrower grant than full
|
||||
// jump-host admin: full admins (isAdmin) always qualify, plus anyone in
|
||||
// conf.auth.jumpAdminGroups (e.g. a dedicated app_jump_admin LDAP group) can
|
||||
// be granted audit access without also getting other admin-only rights.
|
||||
function isJumpAdmin(req){
|
||||
if(isAdmin(req)) return true;
|
||||
const jumpAdminGroups = (conf.auth && conf.auth.jumpAdminGroups) || [];
|
||||
return (req.groups || []).some(g => jumpAdminGroups.includes(g));
|
||||
}
|
||||
|
||||
async function requireJumpAdmin(req, res, next){
|
||||
if(isJumpAdmin(req)) return next();
|
||||
const error = new Error('Forbidden');
|
||||
error.name = 'Forbidden';
|
||||
error.status = 403;
|
||||
error.message = 'Jump admin access required.';
|
||||
next(error);
|
||||
}
|
||||
|
||||
// Socket.IO handshake auth (app-base.js connects with the session token).
|
||||
async function authIO(socket, next){
|
||||
try{
|
||||
@@ -69,4 +88,4 @@ async function authIO(socket, next){
|
||||
}
|
||||
}
|
||||
|
||||
module.exports = { auth, requireAdmin, authIO, isAdmin };
|
||||
module.exports = { auth, requireAdmin, authIO, isAdmin, isJumpAdmin, requireJumpAdmin };
|
||||
|
||||
@@ -13,10 +13,34 @@ async function bump({ uid, hostSlug, success }) {
|
||||
const ops = [redis.incr(`${P()}total`), redis.incr(`${P()}day_${day}`)];
|
||||
if (!success) ops.push(redis.incr(`${P()}fail`));
|
||||
if (uid) ops.push(redis.incr(`${P()}user_${uid}`));
|
||||
if (hostSlug) ops.push(redis.incr(`${P()}host_${hostSlug}`));
|
||||
if (hostSlug) {
|
||||
ops.push(redis.incr(`${P()}host_${hostSlug}`));
|
||||
// Last-attempt timestamp per host, split by outcome -- drives the
|
||||
// dashboard's "Last connection"/"Last failed connection" columns and
|
||||
// row highlighting (see lastForHosts below).
|
||||
ops.push(redis.set(`${P()}host_last_${success ? 'success' : 'fail'}_${hostSlug}`, Date.now()));
|
||||
}
|
||||
await Promise.all(ops);
|
||||
}
|
||||
|
||||
// Per-host last-success/last-fail timestamps for a given list of slugs (e.g.
|
||||
// the hosts a session can reach), for the dashboard's host list.
|
||||
async function lastForHosts(slugs) {
|
||||
const redis = await getRedis();
|
||||
const result = {};
|
||||
await Promise.all((slugs || []).map(async (slug) => {
|
||||
const [lastSuccess, lastFail] = await Promise.all([
|
||||
redis.get(`${P()}host_last_success_${slug}`),
|
||||
redis.get(`${P()}host_last_fail_${slug}`),
|
||||
]);
|
||||
result[slug] = {
|
||||
lastConnected: lastSuccess ? Number(lastSuccess) : null,
|
||||
lastFailed: lastFail ? Number(lastFail) : null,
|
||||
};
|
||||
}));
|
||||
return result;
|
||||
}
|
||||
|
||||
async function summary() {
|
||||
const redis = await getRedis();
|
||||
const [total, fail] = await Promise.all([
|
||||
@@ -37,4 +61,4 @@ async function summary() {
|
||||
};
|
||||
}
|
||||
|
||||
module.exports = { bump, summary };
|
||||
module.exports = { bump, summary, lastForHosts };
|
||||
|
||||
Generated
+19
-6
@@ -1,19 +1,20 @@
|
||||
{
|
||||
"name": "t42-jump-host",
|
||||
"version": "1.5.0",
|
||||
"version": "1.16.0",
|
||||
"lockfileVersion": 3,
|
||||
"requires": true,
|
||||
"packages": {
|
||||
"": {
|
||||
"name": "t42-jump-host",
|
||||
"version": "1.5.0",
|
||||
"version": "1.16.0",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"@fortawesome/fontawesome-free": "^7.3.0",
|
||||
"@simpleworkjs/app-stack": "^1.0.0",
|
||||
"@simpleworkjs/bao-conf": "^1.0.0",
|
||||
"@simpleworkjs/conf": "^1.2.0",
|
||||
"@simpleworkjs/directory-schema": "^1.0.0",
|
||||
"@simpleworkjs/frontend": "^0.2.5",
|
||||
"@simpleworkjs/frontend": "^0.2.6",
|
||||
"@simpleworkjs/ldap": "^1.0.1",
|
||||
"@simpleworkjs/oidc-client": "^1.0.0",
|
||||
"@simpleworkjs/orm": "^0.2.8",
|
||||
@@ -156,6 +157,18 @@
|
||||
"node": ">=18.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@simpleworkjs/bao-conf": {
|
||||
"version": "1.0.1",
|
||||
"resolved": "https://registry.npmjs.org/@simpleworkjs/bao-conf/-/bao-conf-1.0.1.tgz",
|
||||
"integrity": "sha512-mcay5NQ/w9ShpIAolMP/3f9TfXSLE+d5jrA4dTPOUHDjTkdsP7pe4hMmQUmwnniR59U1bGoRIVdXjvDbX3I5nw==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"extend": "^3.0.2"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=18.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@simpleworkjs/conf": {
|
||||
"version": "1.2.0",
|
||||
"resolved": "https://registry.npmjs.org/@simpleworkjs/conf/-/conf-1.2.0.tgz",
|
||||
@@ -178,9 +191,9 @@
|
||||
}
|
||||
},
|
||||
"node_modules/@simpleworkjs/frontend": {
|
||||
"version": "0.2.5",
|
||||
"resolved": "https://registry.npmjs.org/@simpleworkjs/frontend/-/frontend-0.2.5.tgz",
|
||||
"integrity": "sha512-PxR7UVPv3gRpdF0WsuAZplF1vYvKsEJQevVPhz9d72U+69vP/OH3tlaAXjtO/apMHfhT1viOPw2gMVOrPSxYZw==",
|
||||
"version": "0.2.6",
|
||||
"resolved": "https://registry.npmjs.org/@simpleworkjs/frontend/-/frontend-0.2.6.tgz",
|
||||
"integrity": "sha512-2uqvEjxyZ2LE+sfhP6rJcEMmqdViazJ3ZkitWJXInPMWF6DiEZuP5MYqBqJvfDko63CCHEt1/ChFQd7Ry85Pzg==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">=18.0.0"
|
||||
|
||||
+3
-2
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"name": "t42-jump-host",
|
||||
"version": "1.8.1",
|
||||
"version": "1.16.0",
|
||||
"description": "SSH jump host for the theta42 stack — LDAP-authenticated, directory-driven host bridging with audit and metrics",
|
||||
"author": [
|
||||
{
|
||||
@@ -21,9 +21,10 @@
|
||||
"dependencies": {
|
||||
"@fortawesome/fontawesome-free": "^7.3.0",
|
||||
"@simpleworkjs/app-stack": "^1.0.0",
|
||||
"@simpleworkjs/bao-conf": "^1.0.0",
|
||||
"@simpleworkjs/conf": "^1.2.0",
|
||||
"@simpleworkjs/directory-schema": "^1.0.0",
|
||||
"@simpleworkjs/frontend": "^0.2.5",
|
||||
"@simpleworkjs/frontend": "^0.2.6",
|
||||
"@simpleworkjs/ldap": "^1.0.1",
|
||||
"@simpleworkjs/oidc-client": "^1.0.0",
|
||||
"@simpleworkjs/orm": "^0.2.8",
|
||||
|
||||
@@ -7,6 +7,12 @@ body {
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
min-height: 100vh;
|
||||
/* Height of the fixed navbar (plus the update banner, while shown --
|
||||
see top.ejs's showUpdateBanner/dismissUpdateBanner). Lets an in-page
|
||||
sticky element offset itself below both fixed elements via
|
||||
`top: var(--sw-content-offset)` instead of colliding with them at the
|
||||
viewport's true top:0. */
|
||||
--sw-content-offset: 4.5rem;
|
||||
}
|
||||
|
||||
#spa-shell {
|
||||
|
||||
@@ -19,13 +19,15 @@ app.jump = (function(app){
|
||||
app.apiToken = (function(app){
|
||||
function list(cb){ app.api.get('api-token/', cb); }
|
||||
function add(args, cb){ app.api.post('api-token/', args, cb); }
|
||||
function update(args, cb){ app.api.put('api-token/' + args.id, args, cb); }
|
||||
function remove(id, cb){ app.api.delete('api-token/' + id, cb); }
|
||||
function rotate(id, cb){ app.api.post('api-token/' + id + '/rotate', {}, cb); }
|
||||
return {list: list, add: add, remove: remove, rotate: rotate};
|
||||
return {list: list, add: add, update: update, remove: remove, rotate: rotate};
|
||||
})(app);
|
||||
|
||||
// Shared render helpers.
|
||||
app.jump.fmtTime = function(ts){ return ts ? moment(Number(ts)).format('YYYY-MM-DD HH:mm:ss') : '—'; };
|
||||
app.jump.esc = function(s){ return $('<div>').text(s == null ? '' : String(s)).html(); };
|
||||
app.jump.result = function(e){ return e.success ? '<span class="badge bg-success">ok</span>'
|
||||
: '<span class="badge bg-danger">' + app.jump.esc(e.failReason || 'fail') + '</span>'; };
|
||||
app.jump.result = function(e){ if (e.success) return '<span class="badge bg-success">ok</span>';
|
||||
var title = e.failDetail ? ' title="' + app.jump.esc(e.failDetail) + '"' : '';
|
||||
return '<span class="badge bg-danger"' + title + '>' + app.jump.esc(e.failReason || 'fail') + '</span>'; };
|
||||
|
||||
@@ -584,10 +584,31 @@ app.util = (function(app){
|
||||
document.body.removeChild(element);
|
||||
}
|
||||
|
||||
// Scroll a just-added/-edited element into view and flash its
|
||||
// background, so the user's eye lands on the row that changed instead of
|
||||
// it silently appearing/updating somewhere off-screen. Takes a jQuery
|
||||
// object or a raw DOM node (e.g. jq-repeat's `item.__jq_$el`).
|
||||
function revealItem(el){
|
||||
var node = el && el.jquery ? el[0] : el;
|
||||
if (!node) return;
|
||||
if (typeof node.scrollIntoView === 'function') {
|
||||
node.scrollIntoView({behavior: 'smooth', block: 'center'});
|
||||
}
|
||||
var prevTransition = node.style.transition;
|
||||
var prevBg = node.style.backgroundColor;
|
||||
node.style.transition = 'background-color 1.5s ease';
|
||||
node.style.backgroundColor = 'var(--bs-success-bg-subtle, #d1e7dd)';
|
||||
setTimeout(function(){
|
||||
node.style.backgroundColor = prevBg;
|
||||
setTimeout(function(){ node.style.transition = prevTransition; }, 1500);
|
||||
}, 300);
|
||||
}
|
||||
|
||||
return {
|
||||
downloadFile: downloadFile,
|
||||
getUrlParameter: getUrlParameter,
|
||||
escapeHtml: escapeHtml,
|
||||
revealItem: revealItem,
|
||||
}
|
||||
})(app);
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@ router.use('/user', middleware.auth, require('./user'));
|
||||
// admin gate (see routes/api_token.js for why a token can't reach admin routes).
|
||||
router.use('/api-token', middleware.auth, require('./api_token'));
|
||||
|
||||
// Jump-host data — admin only (audit log, active sessions, metrics).
|
||||
router.use('/', middleware.auth, middleware.requireAdmin, require('./jump'));
|
||||
// Jump-host data — jump admin only (audit log, active sessions, metrics).
|
||||
router.use('/', middleware.auth, middleware.requireJumpAdmin, require('./jump'));
|
||||
|
||||
module.exports = router;
|
||||
|
||||
@@ -14,6 +14,10 @@ const values = {
|
||||
titleIcon: conf.environment !== 'production' ? '<i class="fa-brands fa-dev"></i>' : '',
|
||||
name: conf.name,
|
||||
logo: conf.logo,
|
||||
// The SSH front door's port -- the dashboard's "quick jump" copy buttons
|
||||
// need this to build a real, working `ssh ...` command (the web UI and
|
||||
// SSH front door share a hostname but not a port).
|
||||
sshPort: (conf.ssh && conf.ssh.listenPort) || 22,
|
||||
...buildInfo,
|
||||
};
|
||||
|
||||
|
||||
+18
-2
@@ -4,14 +4,17 @@
|
||||
// browser who it is and whether it's an admin (drives login state + nav).
|
||||
|
||||
const router = require('express').Router();
|
||||
const { isAdmin } = require('../middleware/auth');
|
||||
const { isAdmin, isJumpAdmin } = require('../middleware/auth');
|
||||
const access = require('../utils/access');
|
||||
const metrics = require('../models/metrics');
|
||||
const registry = require('../services/session_registry');
|
||||
|
||||
router.get('/me', (req, res) => {
|
||||
res.json({
|
||||
username: req.user && req.user.username,
|
||||
groups: req.groups || [],
|
||||
isAdmin: isAdmin(req),
|
||||
isJumpAdmin: isJumpAdmin(req),
|
||||
});
|
||||
});
|
||||
|
||||
@@ -23,7 +26,20 @@ router.get('/hosts', async (req, res, next) => {
|
||||
const hosts = isAdmin(req)
|
||||
? await access.allHosts()
|
||||
: await access.accessibleHosts({ uid: req.user && req.user.username, groups: req.groups || [] });
|
||||
res.json({ results: hosts });
|
||||
|
||||
// Enrich with connection state for the dashboard's host list: whether a
|
||||
// session is live right now (active bridges, session_registry), plus the
|
||||
// last successful/failed connection times (models/metrics).
|
||||
const connectedSlugs = new Set(registry.list().map((s) => s.slug));
|
||||
const last = await metrics.lastForHosts(hosts.map((h) => h.slug));
|
||||
const enriched = hosts.map((h) => ({
|
||||
...h,
|
||||
connected: connectedSlugs.has(h.slug),
|
||||
lastConnected: (last[h.slug] && last[h.slug].lastConnected) || null,
|
||||
lastFailed: (last[h.slug] && last[h.slug].lastFailed) || null,
|
||||
}));
|
||||
|
||||
res.json({ results: enriched });
|
||||
} catch (err) { next(err); }
|
||||
});
|
||||
|
||||
|
||||
@@ -23,7 +23,7 @@ function counter(onBytes) {
|
||||
// Connect the upstream ssh2.Client, retrying once after a short pause if the
|
||||
// first attempt fails auth (SSSD/AuthorizedKeysCommand cache lag right after a
|
||||
// first-time key injection).
|
||||
function connectUpstream({ host, port, username, privateKey, onHostKey, uid, justInjected }) {
|
||||
function connectUpstream({ host, port, username, privateKey, cert, onHostKey, uid, justInjected }) {
|
||||
return new Promise((resolve, reject) => {
|
||||
let attempted = false;
|
||||
const dial = (allowRetry) => {
|
||||
@@ -42,6 +42,7 @@ function connectUpstream({ host, port, username, privateKey, onHostKey, uid, jus
|
||||
})
|
||||
.connect({
|
||||
host, port, username, privateKey,
|
||||
certificates: cert ? [cert] : undefined,
|
||||
readyTimeout: (conf.ssh && conf.ssh.connectTimeoutMs) || 10000,
|
||||
keepaliveInterval: 15000,
|
||||
hostVerifier: (key) => {
|
||||
|
||||
@@ -129,22 +129,40 @@ async function resolveAndConnect(state, record, { onHostKey } = {}) {
|
||||
await record.patch({ targetSlug: host ? host.slug : 'raw-ip', targetAddr: endpoint.address, targetPort: endpoint.port });
|
||||
|
||||
let justInjected = false;
|
||||
try { justInjected = await ensureKeyInjected(state.user, JUMP_KEYS.publicLine); }
|
||||
catch (_) { throw fail('key-inject-failed'); }
|
||||
let cert;
|
||||
const usePki = conf.ssh && conf.ssh.pki && conf.ssh.pki.enabled;
|
||||
|
||||
try {
|
||||
if (usePki) {
|
||||
const { getSignedCert } = require('../utils/vault_cert');
|
||||
cert = await getSignedCert(JUMP_KEYS.publicLine, state.uid);
|
||||
} else {
|
||||
justInjected = await ensureKeyInjected(state.user, JUMP_KEYS.publicLine);
|
||||
}
|
||||
} catch (err) {
|
||||
const failType = usePki ? 'pki-cert-failed' : 'key-inject-failed';
|
||||
throw fail(failType, err.message, host ? host.slug : undefined);
|
||||
}
|
||||
|
||||
let upstream;
|
||||
try {
|
||||
upstream = await connectUpstream({
|
||||
host: endpoint.address, port: endpoint.port,
|
||||
username: state.uid, privateKey: JUMP_KEYS.clientKey,
|
||||
username: state.uid, privateKey: JUMP_KEYS.clientKey, cert,
|
||||
uid: state.uid, justInjected, onHostKey,
|
||||
});
|
||||
} catch (_) { throw fail('upstream-unreachable'); }
|
||||
} catch (err) { throw fail('upstream-unreachable', err.message, host ? host.slug : undefined); }
|
||||
|
||||
return { upstream, host, endpoint };
|
||||
}
|
||||
|
||||
function fail(reason) { const e = new Error(reason); e.reason = reason; return e; }
|
||||
// detail carries the real underlying error message (e.g. ECONNREFUSED,
|
||||
// ETIMEDOUT, an ssh2 auth-failure string) so audit records aren't reduced to
|
||||
// just the generic reason code -- without it, a network-layer failure and an
|
||||
// SSH auth failure both looked identical in the audit log. hostSlug (when the
|
||||
// target was already resolved to a known host) lets callers attribute the
|
||||
// failure to that host for per-host "last failed connection" tracking.
|
||||
function fail(reason, detail, hostSlug) { const e = new Error(reason); e.reason = reason; e.detail = detail; e.hostSlug = hostSlug; return e; }
|
||||
|
||||
async function runGrammar(session, client, state) {
|
||||
// Register session listeners IMMEDIATELY — before any async work.
|
||||
@@ -174,8 +192,8 @@ async function runGrammar(session, client, state) {
|
||||
} catch (err) {
|
||||
const reason = err.reason || 'error';
|
||||
rejectUp(new Error(reasonMessage(reason)));
|
||||
await record.finish({ success: false, failReason: reason });
|
||||
await metrics.bump({ uid: state.uid, success: false });
|
||||
await record.finish({ success: false, failReason: reason, failDetail: err.detail });
|
||||
await metrics.bump({ uid: state.uid, hostSlug: err.hostSlug, success: false });
|
||||
}
|
||||
}
|
||||
|
||||
@@ -199,9 +217,9 @@ async function runTuiSession(session, client, state) {
|
||||
|
||||
const record = await audit.create({ uid: state.uid, authMethod: state.authMethod, clientIp: state.clientIp, mode: 'tui' });
|
||||
|
||||
const finishFail = async (reason) => {
|
||||
await record.finish({ success: false, failReason: reason });
|
||||
await metrics.bump({ uid: state.uid, success: false });
|
||||
const finishFail = async (reason, detail, hostSlug) => {
|
||||
await record.finish({ success: false, failReason: reason, failDetail: detail });
|
||||
await metrics.bump({ uid: state.uid, hostSlug, success: false });
|
||||
try { client.end(); } catch (_) {}
|
||||
};
|
||||
|
||||
@@ -222,19 +240,31 @@ async function runTuiSession(session, client, state) {
|
||||
await record.patch({ targetSlug: tui.host.slug, targetAddr: endpoint.address, targetPort: endpoint.port });
|
||||
|
||||
let justInjected = false;
|
||||
try { justInjected = await ensureKeyInjected(state.user, JUMP_KEYS.publicLine); }
|
||||
catch (_) { return finishFail('key-inject-failed'); }
|
||||
let cert;
|
||||
const usePki = conf.ssh && conf.ssh.pki && conf.ssh.pki.enabled;
|
||||
|
||||
try {
|
||||
if (usePki) {
|
||||
const { getSignedCert } = require('../utils/vault_cert');
|
||||
cert = await getSignedCert(JUMP_KEYS.publicLine, state.uid);
|
||||
} else {
|
||||
justInjected = await ensureKeyInjected(state.user, JUMP_KEYS.publicLine);
|
||||
}
|
||||
} catch (err) {
|
||||
const failType = usePki ? 'pki-cert-failed' : 'key-inject-failed';
|
||||
return finishFail(failType, err.message, tui.host.slug);
|
||||
}
|
||||
|
||||
let upstream;
|
||||
try {
|
||||
upstream = await connectUpstream({
|
||||
host: endpoint.address, port: endpoint.port,
|
||||
username: state.uid, privateKey: JUMP_KEYS.clientKey,
|
||||
username: state.uid, privateKey: JUMP_KEYS.clientKey, cert,
|
||||
uid: state.uid, justInjected, onHostKey: (fp) => record.patch({ hostKeyFp: fp }),
|
||||
});
|
||||
} catch (_) {
|
||||
} catch (err) {
|
||||
try { tui.channel.write(`\r\n Could not reach ${endpoint.address}.\r\n`); tui.channel.close(); } catch (_) {}
|
||||
return finishFail('upstream-unreachable');
|
||||
return finishFail('upstream-unreachable', err.message, tui.host.slug);
|
||||
}
|
||||
|
||||
registry.add(record.id, { uid: state.uid, target: endpoint.address, slug: tui.host.slug });
|
||||
|
||||
@@ -9,10 +9,29 @@ const ESC = '\x1b';
|
||||
const CLEAR = `${ESC}[2J${ESC}[H`;
|
||||
const HIDE_CUR = `${ESC}[?25l`;
|
||||
const SHOW_CUR = `${ESC}[?25h`;
|
||||
const INV = `${ESC}[7m`;
|
||||
|
||||
// Basic styles
|
||||
const RST = `${ESC}[0m`;
|
||||
const DIM = `${ESC}[2m`;
|
||||
const BOLD = `${ESC}[1m`;
|
||||
const DIM = `${ESC}[2m`;
|
||||
|
||||
// Colors (30-37: standard, 90-97: bright)
|
||||
const RED = `${ESC}[31m`;
|
||||
const BRIGHT_RED = `${ESC}[91m`;
|
||||
const CYAN = `${ESC}[36m`;
|
||||
const BRIGHT_CYAN = `${ESC}[96m`;
|
||||
const GREEN = `${ESC}[32m`;
|
||||
const BRIGHT_GREEN = `${ESC}[92m`;
|
||||
const YELLOW = `${ESC}[33m`;
|
||||
const BRIGHT_YELLOW = `${ESC}[93m`;
|
||||
const MAGENTA = `${ESC}[35m`;
|
||||
const BRIGHT_MAGENTA = `${ESC}[95m`;
|
||||
const BLUE = `${ESC}[34m`;
|
||||
const BRIGHT_BLUE = `${ESC}[94m`;
|
||||
|
||||
// Inverted selection with color
|
||||
const INV_GREEN = `${ESC}[42m${ESC}[30m`; // Green bg, black text
|
||||
const INV = `${ESC}[7m`;
|
||||
|
||||
function pickHost(channel, uid, hosts) {
|
||||
return new Promise((resolve) => {
|
||||
@@ -35,18 +54,43 @@ function pickHost(channel, uid, hosts) {
|
||||
const list = visible();
|
||||
if (selected >= list.length) selected = Math.max(0, list.length - 1);
|
||||
let out = CLEAR + HIDE_CUR;
|
||||
out += `${BOLD} Theta42 Jump — hosts for ${uid}${RST}\r\n`;
|
||||
out += `${DIM} ↑/↓ move · Enter connect · type to filter · q quit${RST}\r\n\r\n`;
|
||||
|
||||
// Header with gradient-style color
|
||||
out += `\r\n ${BOLD}${BRIGHT_CYAN}╔════════════════════════════════════════════════════════╗${RST}\r\n`;
|
||||
out += ` ${BOLD}${BRIGHT_CYAN}║${RST} ${BOLD}${BRIGHT_MAGENTA}Theta42 Jump${RST} ${DIM}·${RST} ${BRIGHT_GREEN}hosts for ${uid}${RST} ${BOLD}${BRIGHT_CYAN}║${RST}\r\n`;
|
||||
out += ` ${BOLD}${BRIGHT_CYAN}╚════════════════════════════════════════════════════════╝${RST}\r\n`;
|
||||
out += `\r\n`;
|
||||
out += ` ${DIM}↑/↓ move · Enter connect · type to filter · q quit${RST}\r\n`;
|
||||
out += `\r\n`;
|
||||
|
||||
if (!list.length) {
|
||||
out += ` ${DIM}(no match for "${filter}")${RST}\r\n`;
|
||||
out += ` ${YELLOW}⚠${RST} ${DIM}(no match for "${filter}")${RST}\r\n`;
|
||||
} else {
|
||||
list.forEach((h, i) => {
|
||||
const ip = (h.metadata && h.metadata.ip) || (h.metadata && h.metadata.address) || '';
|
||||
const row = ` ${h.name} ${DIM}(${h.slug})${RST}${ip ? ` ${ip}` : ''}`;
|
||||
out += (i === selected ? `${INV}> ${h.name} (${h.slug})${ip ? ` ${ip}` : ''}${RST}` : row) + '\r\n';
|
||||
const isProd = h.metadata && h.metadata.isProduction;
|
||||
const envBadge = isProd ? `${BOLD}${RED}PROD${RST} ` : `${DIM}DEV${RST} `;
|
||||
|
||||
if (i === selected) {
|
||||
// Selected row with green inverse background
|
||||
const selRow = `${INV_GREEN} ${h.name} ${DIM}(${h.slug})${RST}${ip ? ` ${CYAN}${ip}${RST}` : ''} ${envBadge} ${BOLD}${BRIGHT_GREEN}◄ SELECTED ►${RST}${INV_GREEN}${RST}`;
|
||||
out += selRow + '\r\n';
|
||||
} else {
|
||||
// Normal row with subtle coloring
|
||||
const nameColor = i % 2 === 0 ? BRIGHT_CYAN : CYAN;
|
||||
out += ` ${nameColor}${h.name}${RST} ${DIM}(${h.slug})${RST}${ip ? ` ${BLUE}${ip}${RST}` : ''} ${envBadge}\r\n`;
|
||||
}
|
||||
});
|
||||
}
|
||||
if (filter) out += `\r\n ${DIM}filter:${RST} ${filter}`;
|
||||
|
||||
if (filter) {
|
||||
out += `\r\n ${DIM}filter: ${BRIGHT_YELLOW}${filter}${RST}`;
|
||||
}
|
||||
|
||||
// Footer
|
||||
out += `\r\n\r\n ${DIM}────────────────────────────────────────────────────────${RST}\r\n`;
|
||||
out += ` ${DIM}Press${RST} ${BOLD}1-9${RST} ${DIM}to quick-select · ${BOLD}q${RST} ${DIM}to quit${RST}\r\n`;
|
||||
|
||||
channel.write(out);
|
||||
};
|
||||
|
||||
|
||||
@@ -156,6 +156,29 @@ test('shell bridges and echoes', async () => {
|
||||
assert.match(out, /echo:ping/);
|
||||
});
|
||||
|
||||
test('connectUpstream rejects with a specific, non-generic error when the target refuses the connection', async () => {
|
||||
// Regression coverage for ssh_server.js's resolveAndConnect: it used to
|
||||
// discard this error entirely (catch (_) { throw fail('upstream-unreachable') }),
|
||||
// so the audit log recorded the same generic reason for a refused port, a
|
||||
// timeout, or a bad key alike. Now the real message is threaded through as
|
||||
// failDetail, so this must stay meaningful.
|
||||
// Bind a server just to reserve a free port, then close it immediately so
|
||||
// nothing is listening there — guarantees ECONNREFUSED rather than relying
|
||||
// on a hardcoded port number that might be in use.
|
||||
const closedPort = await new Promise((resolve) => {
|
||||
const probe = require('net').createServer();
|
||||
probe.listen(0, '127.0.0.1', () => { const p = probe.address().port; probe.close(() => resolve(p)); });
|
||||
});
|
||||
await assert.rejects(
|
||||
connectUpstream({ host: '127.0.0.1', port: closedPort, username: 'test', privateKey: jumpKey, uid: 'test', justInjected: false }),
|
||||
(err) => {
|
||||
assert.ok(err.message && err.message.length > 0);
|
||||
assert.notStrictEqual(err.message, 'upstream-unreachable');
|
||||
return true;
|
||||
},
|
||||
);
|
||||
});
|
||||
|
||||
test('sftp subsystem bytes pass through', async () => {
|
||||
const { conn, ready } = connectJump();
|
||||
await ready;
|
||||
|
||||
+1
-1
@@ -37,6 +37,6 @@ module.exports = {
|
||||
nav: [
|
||||
{href: '/dashboard', icon: 'fa-solid fa-gauge-high', label: 'Dashboard', groups: []},
|
||||
{href: '/sessions', icon: 'fa-solid fa-plug-circle-bolt', label: 'Sessions', groups: []},
|
||||
{href: '/audit', icon: 'fa-solid fa-clipboard-list', label: 'Audit', groups: []},
|
||||
{href: '/audit', icon: 'fa-solid fa-clipboard-list', label: 'Audit', groups: ['admin', 'app_jump_admin']},
|
||||
],
|
||||
};
|
||||
|
||||
@@ -0,0 +1,44 @@
|
||||
'use strict';
|
||||
|
||||
const conf = require('@simpleworkjs/conf');
|
||||
|
||||
/**
|
||||
* Requests a signed SSH certificate from the SSO Manager's OpenBao/Vault proxy.
|
||||
*
|
||||
* @param {string} publicKey - The jump host's public key (e.g. 'ssh-rsa AAAAB3...')
|
||||
* @param {string} targetUid - The username the cert should be valid for
|
||||
* @returns {Promise<string>} - The signed SSH certificate
|
||||
*/
|
||||
async function getSignedCert(publicKey, targetUid) {
|
||||
const sso = conf.sso || {};
|
||||
const pkiConfig = conf.ssh?.pki || {};
|
||||
|
||||
const vaultRole = pkiConfig.role || 'jump-host-role';
|
||||
const endpoint = `${sso.url}/api/vault/ssh/sign/${vaultRole}`;
|
||||
|
||||
const response = await fetch(endpoint, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'Authorization': `Bearer ${sso.apiToken}`,
|
||||
'Content-Type': 'application/json'
|
||||
},
|
||||
body: JSON.stringify({
|
||||
public_key: publicKey,
|
||||
valid_principals: targetUid
|
||||
})
|
||||
});
|
||||
|
||||
if (!response.ok) {
|
||||
const errText = await response.text().catch(() => '');
|
||||
throw new Error(`Failed to sign SSH cert (status ${response.status}): ${errText}`);
|
||||
}
|
||||
|
||||
const data = await response.json();
|
||||
if (!data.data || !data.data.signed_key) {
|
||||
throw new Error('Vault response missing signed_key');
|
||||
}
|
||||
|
||||
return data.data.signed_key;
|
||||
}
|
||||
|
||||
module.exports = { getSignedCert };
|
||||
+66
-2
@@ -1,5 +1,46 @@
|
||||
<%- include('top') %>
|
||||
<script type="text/javascript">app.auth.forceLogin();</script>
|
||||
<script type="text/javascript">app.auth.forceLogin(['admin', 'app_jump_admin']);</script>
|
||||
|
||||
<div class="container mt-4">
|
||||
<div class="row g-3 mb-4">
|
||||
<div class="col-6 col-md-3">
|
||||
<div class="card shadow-sm text-center"><div class="card-body">
|
||||
<div class="display-6" id="stat-active">–</div>
|
||||
<div class="text-muted small text-uppercase">Active sessions</div>
|
||||
</div></div>
|
||||
</div>
|
||||
<div class="col-6 col-md-3">
|
||||
<div class="card shadow-sm text-center"><div class="card-body">
|
||||
<div class="display-6" id="stat-total">–</div>
|
||||
<div class="text-muted small text-uppercase">Total connections</div>
|
||||
</div></div>
|
||||
</div>
|
||||
<div class="col-6 col-md-3">
|
||||
<div class="card shadow-sm text-center"><div class="card-body">
|
||||
<div class="display-6 text-danger" id="stat-fail">–</div>
|
||||
<div class="text-muted small text-uppercase">Failed</div>
|
||||
</div></div>
|
||||
</div>
|
||||
<div class="col-6 col-md-3">
|
||||
<div class="card shadow-sm text-center"><div class="card-body">
|
||||
<div class="display-6" id="stat-users">–</div>
|
||||
<div class="text-muted small text-uppercase">Users seen</div>
|
||||
</div></div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="row g-3 mb-4">
|
||||
<div class="col-md-6">
|
||||
<div class="card shadow-sm"><div class="card-header"><i class="fa-solid fa-server me-1"></i> Top hosts</div>
|
||||
<table class="table table-sm mb-0"><tbody id="top-hosts"></tbody></table>
|
||||
</div>
|
||||
</div>
|
||||
<div class="col-md-6">
|
||||
<div class="card shadow-sm"><div class="card-header"><i class="fa-solid fa-user me-1"></i> Top users</div>
|
||||
<table class="table table-sm mb-0"><tbody id="top-users"></tbody></table>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="card shadow-sm">
|
||||
<div class="card-header"><i class="fa-solid fa-clipboard-list me-1"></i> Audit log</div>
|
||||
@@ -29,8 +70,28 @@
|
||||
<button class="btn btn-sm btn-outline-secondary" id="next" onclick="changePage(1)">next →</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<script type="text/javascript">
|
||||
function rows(sel, list){
|
||||
var $b = $(sel).empty();
|
||||
if(!list || !list.length){ $b.append('<tr><td class="text-muted">No data.</td></tr>'); return; }
|
||||
list.forEach(function(x){
|
||||
$b.append('<tr><td>' + app.jump.esc(x.name) + '</td><td class="text-end">' + x.count + '</td></tr>');
|
||||
});
|
||||
}
|
||||
function loadMetrics(){
|
||||
app.jump.metrics(function(error, data){
|
||||
if(error || !data) return;
|
||||
$('#stat-active').text(data.active);
|
||||
$('#stat-total').text(data.total);
|
||||
$('#stat-fail').text(data.fail);
|
||||
$('#stat-users').text((data.topUsers || []).length);
|
||||
rows('#top-hosts', data.topHosts);
|
||||
rows('#top-users', data.topUsers);
|
||||
});
|
||||
}
|
||||
|
||||
var page = 0;
|
||||
function filters(){ return {page: page, uid: $('#f-uid').val(), target: $('#f-target').val(), status: $('#f-status').val()}; }
|
||||
function applyFilters(){ page = 0; load(); }
|
||||
@@ -57,6 +118,9 @@
|
||||
$('#next').prop('disabled', (page + 1) * size >= total);
|
||||
});
|
||||
}
|
||||
$(document).ready(load);
|
||||
$(document).ready(function(){
|
||||
loadMetrics();
|
||||
load();
|
||||
});
|
||||
</script>
|
||||
<%- include('bottom') %>
|
||||
|
||||
+172
-85
@@ -1,30 +1,25 @@
|
||||
<%- include('top') %>
|
||||
<script type="text/javascript">app.auth.forceLogin();</script>
|
||||
|
||||
<div class="container mt-4">
|
||||
<div class="row g-3 mb-4">
|
||||
<div class="col-6 col-md-3">
|
||||
<div class="card shadow-sm text-center"><div class="card-body">
|
||||
<div class="display-6" id="stat-active">–</div>
|
||||
<div class="text-muted small text-uppercase">Active sessions</div>
|
||||
</div></div>
|
||||
</div>
|
||||
<div class="col-6 col-md-3">
|
||||
<div class="card shadow-sm text-center"><div class="card-body">
|
||||
<div class="display-6" id="stat-total">–</div>
|
||||
<div class="text-muted small text-uppercase">Total connections</div>
|
||||
</div></div>
|
||||
</div>
|
||||
<div class="col-6 col-md-3">
|
||||
<div class="card shadow-sm text-center"><div class="card-body">
|
||||
<div class="display-6 text-danger" id="stat-fail">–</div>
|
||||
<div class="text-muted small text-uppercase">Failed</div>
|
||||
</div></div>
|
||||
</div>
|
||||
<div class="col-6 col-md-3">
|
||||
<div class="card shadow-sm text-center"><div class="card-body">
|
||||
<div class="display-6" id="stat-users">–</div>
|
||||
<div class="text-muted small text-uppercase">Users seen</div>
|
||||
</div></div>
|
||||
<div class="col-12">
|
||||
<div class="card shadow-sm">
|
||||
<div class="card-header"><i class="fa-solid fa-terminal me-1"></i> Quick Jump</div>
|
||||
<div class="card-body">
|
||||
<p class="text-muted small mb-2">
|
||||
Skip the picker: <code>ssh <your-username>_-_<host-slug>@<this-jump-host></code>
|
||||
connects straight to a host. Or just <code>ssh <your-username>@<this-jump-host></code>
|
||||
for the interactive picker.
|
||||
</p>
|
||||
<div class="input-group">
|
||||
<input type="text" class="form-control font-monospace" id="quick-jump-cmd" readonly>
|
||||
<button class="btn btn-outline-secondary" onclick="copyFieldValue('#quick-jump-cmd')" title="Copy">
|
||||
<i class="fa-solid fa-copy"></i>
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
@@ -32,20 +27,12 @@
|
||||
<div class="col-12">
|
||||
<div class="card shadow-sm">
|
||||
<div class="card-header"><i class="fa-solid fa-network-wired me-1"></i> <span id="my-hosts-title">Hosts you can reach</span></div>
|
||||
<table class="table table-sm mb-0"><tbody id="my-hosts"></tbody></table>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="row g-3 mb-4">
|
||||
<div class="col-md-6">
|
||||
<div class="card shadow-sm"><div class="card-header"><i class="fa-solid fa-server me-1"></i> Top hosts</div>
|
||||
<table class="table table-sm mb-0"><tbody id="top-hosts"></tbody></table>
|
||||
</div>
|
||||
</div>
|
||||
<div class="col-md-6">
|
||||
<div class="card shadow-sm"><div class="card-header"><i class="fa-solid fa-user me-1"></i> Top users</div>
|
||||
<table class="table table-sm mb-0"><tbody id="top-users"></tbody></table>
|
||||
<div class="table-responsive">
|
||||
<table class="table table-sm mb-0">
|
||||
<thead><tr><th>Host</th><th>Slug</th><th class="text-end">Address</th><th>Last connection</th><th>Last failed connection</th><th></th></tr></thead>
|
||||
<tbody id="my-hosts"></tbody>
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
@@ -63,64 +50,122 @@
|
||||
(e.g. <code>GET /api/user/hosts</code>) — not for SSH login. A token carries
|
||||
no group claims, so it can't reach admin-only endpoints.
|
||||
</p>
|
||||
<table class="table table-sm mb-0">
|
||||
<thead><tr><th>Name</th><th>Created</th><th>Last used</th><th>Expires</th><th></th></tr></thead>
|
||||
<tbody id="api-tokens"></tbody>
|
||||
</table>
|
||||
<div class="card-body">
|
||||
<p id="api-tokens-empty" class="text-muted mb-0" style="display:none">No API tokens.</p>
|
||||
<div id="api-tokens">
|
||||
<div jq-repeat="apiTokenCard" jq-index-key="id" id="apitoken-card-{{id}}" class="card shadow-sm mb-3">
|
||||
<div class="card-header">
|
||||
<h6 class="mb-0"><i class="fa-solid fa-key"></i> {{name}}</h6>
|
||||
<small class="text-muted font-monospace">{{id_short}}</small>
|
||||
</div>
|
||||
<div class="card-header actionMessage" style="display:none"></div>
|
||||
<div class="card-body">
|
||||
{{#description}}<p>{{description}}</p>{{/description}}
|
||||
<dl class="row mb-0 small">
|
||||
<dt class="col-sm-3">Token ID</dt>
|
||||
<dd class="col-sm-9"><code>{{id_short}}</code></dd>
|
||||
<dt class="col-sm-3">Created</dt>
|
||||
<dd class="col-sm-9">{{{created_display}}}</dd>
|
||||
<dt class="col-sm-3">Last used</dt>
|
||||
<dd class="col-sm-9">{{{last_used_display}}}</dd>
|
||||
<dt class="col-sm-3">Expires</dt>
|
||||
<dd class="col-sm-9">{{{expires_display}}}</dd>
|
||||
</dl>
|
||||
</div>
|
||||
<div class="card-footer">
|
||||
<button type="button" onclick="editToken('{{id}}')" class="btn btn-primary btn-sm"><i class="fa-solid fa-pen-to-square"></i> Edit</button>
|
||||
<button type="button" onclick="rotateApiToken('{{id}}', this)" class="btn btn-warning btn-sm"><i class="fa-solid fa-arrows-rotate"></i> Rotate</button>
|
||||
<button type="button" onclick="revokeApiToken('{{id}}', this)" class="btn btn-danger btn-sm float-end"><i class="fa-solid fa-trash"></i> Revoke</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<script type="text/javascript">
|
||||
function rows(sel, list){
|
||||
var $b = $(sel).empty();
|
||||
if(!list || !list.length){ $b.append('<tr><td class="text-muted">No data.</td></tr>'); return; }
|
||||
list.forEach(function(x){
|
||||
$b.append('<tr><td>' + app.jump.esc(x.name) + '</td><td class="text-end">' + x.count + '</td></tr>');
|
||||
// The web UI and the SSH front door share a hostname, just not a port.
|
||||
var SSH_PORT = <%- JSON.stringify(sshPort) %>;
|
||||
function sshCommand(target){
|
||||
var uid = app.auth.user && app.auth.user.username;
|
||||
if(!uid) return '';
|
||||
var portFlag = SSH_PORT === 22 ? '' : ' -p ' + SSH_PORT;
|
||||
return 'ssh ' + uid + (target ? '_-_' + target : '') + '@' + location.hostname + portFlag;
|
||||
}
|
||||
function copyFieldValue(sel){
|
||||
var $el = $(sel);
|
||||
var text = $el.val();
|
||||
if(!text) return;
|
||||
navigator.clipboard.writeText(text).then(function(){
|
||||
app.messages.toast('Copied to clipboard', 'success');
|
||||
}, function(){
|
||||
app.messages.toast('Could not copy — select and copy manually', 'danger');
|
||||
});
|
||||
}
|
||||
|
||||
function hostRows(sel, hosts){
|
||||
var $b = $(sel).empty();
|
||||
if(!hosts || !hosts.length){ $b.append('<tr><td class="text-muted">No hosts reachable.</td></tr>'); return; }
|
||||
hosts.forEach(function(h){
|
||||
var addr = (h.metadata && (h.metadata.ip || h.metadata.address)) || '';
|
||||
$b.append('<tr><td>' + app.jump.esc(h.displayName || h.name || h.slug) + '</td>'
|
||||
var rowId = 'host-cmd-' + h.slug.replace(/[^a-zA-Z0-9_-]/g, '');
|
||||
// Green: a session to this host is live right now. Yellow: the most
|
||||
// recent attempt to this host failed (and none is currently live).
|
||||
var rowClass = h.connected ? 'table-success'
|
||||
: (h.lastFailed && (!h.lastConnected || h.lastFailed > h.lastConnected)) ? 'table-warning'
|
||||
: '';
|
||||
$b.append('<tr class="' + rowClass + '"><td>' + app.jump.esc(h.displayName || h.name || h.slug) + '</td>'
|
||||
+ '<td class="text-muted small">' + app.jump.esc(h.slug) + '</td>'
|
||||
+ '<td class="text-end text-muted small">' + app.jump.esc(addr) + '</td></tr>');
|
||||
+ '<td class="text-end text-muted small">' + app.jump.esc(addr) + '</td>'
|
||||
+ '<td class="small">' + (h.lastConnected ? app.jump.fmtTime(h.lastConnected) : '—') + '</td>'
|
||||
+ '<td class="small">' + (h.lastFailed ? app.jump.fmtTime(h.lastFailed) : '—') + '</td>'
|
||||
+ '<td class="text-end">'
|
||||
+ '<input type="hidden" id="' + rowId + '" value="' + app.jump.esc(sshCommand(h.slug)) + '">'
|
||||
+ '<button class="btn btn-sm btn-outline-secondary" onclick="copyFieldValue(\'#' + rowId + '\')" title="Copy quick-jump command"><i class="fa-solid fa-copy"></i></button>'
|
||||
+ '</td></tr>');
|
||||
});
|
||||
}
|
||||
function tokenRows(tokens){
|
||||
var $b = $('#api-tokens').empty();
|
||||
if(!tokens || !tokens.length){ $b.append('<tr><td colspan="5" class="text-muted">No API tokens.</td></tr>'); return; }
|
||||
tokens.forEach(function(t){
|
||||
var expires = t.expires_at ? app.jump.fmtTime(t.expires_at) : 'Never';
|
||||
var lastUsed = t.last_used_on ? app.jump.fmtTime(t.last_used_on) : 'Never';
|
||||
$b.append(
|
||||
'<tr>'
|
||||
+ '<td>' + app.jump.esc(t.name) + '</td>'
|
||||
+ '<td class="text-muted small">' + app.jump.fmtTime(t.created_on) + '</td>'
|
||||
+ '<td class="text-muted small">' + lastUsed + '</td>'
|
||||
+ '<td class="text-muted small">' + expires + '</td>'
|
||||
+ '<td class="text-end">'
|
||||
+ '<button class="btn btn-sm btn-outline-secondary" onclick="rotateApiToken(\'' + t.id + '\', this)" title="Rotate"><i class="fa-solid fa-rotate"></i></button> '
|
||||
+ '<button class="btn btn-sm btn-outline-danger" onclick="revokeApiToken(\'' + t.id + '\', this)" title="Revoke"><i class="fa-solid fa-trash"></i></button>'
|
||||
+ '</td>'
|
||||
+ '</tr>'
|
||||
);
|
||||
});
|
||||
// expires_at/created_on/last_used_on come back as redis-hash strings for
|
||||
// some fields and real numbers for others depending on the model's field
|
||||
// type -- fmtTime already handles both via moment(ms, 'x').
|
||||
function fmtExpiry(token){
|
||||
var exp = Number(token.expires_at);
|
||||
if(!exp) return '<span class="badge text-bg-secondary">never</span>';
|
||||
if(Date.now() > exp) return '<span class="badge text-bg-danger">expired</span>';
|
||||
return '<span class="badge text-bg-warning">' + moment(exp).fromNow() + '</span>';
|
||||
}
|
||||
|
||||
var tokensById = {};
|
||||
function processToken(token){
|
||||
tokensById[token.id] = token;
|
||||
token.id_short = token.id.slice(0, 12) + '…';
|
||||
token.expires_display = fmtExpiry(token);
|
||||
token.created_display = app.jump.fmtTime(token.created_on);
|
||||
token.last_used_display = token.last_used_on ? app.jump.fmtTime(token.last_used_on) : 'Never';
|
||||
return token;
|
||||
}
|
||||
|
||||
function loadApiTokens(){
|
||||
app.apiToken.list(function(error, data){
|
||||
if(error) return tokenRows([]);
|
||||
tokenRows(data && data.results);
|
||||
var tokens = (!error && data && data.results) || [];
|
||||
$.scope.apiTokenCard.empty();
|
||||
tokens.forEach(function(t){ $.scope.apiTokenCard.push(processToken(t)); });
|
||||
$('#api-tokens-empty').toggle(tokens.length === 0);
|
||||
});
|
||||
}
|
||||
|
||||
// Shared "reveal secret once" display -- also used by proxy/sso-manager-node.
|
||||
function showToken(title, token){
|
||||
app.modal.open({title: title, bodyHtml:
|
||||
'<p class="text-danger"><i class="fa-solid fa-triangle-exclamation"></i> Save this token now — it will <strong>not</strong> be shown again.</p>'
|
||||
+ '<div class="input-group"><input type="text" class="form-control font-monospace" readonly value="' + app.jump.esc(token) + '"></div>'
|
||||
+ '<div class="input-group"><input type="text" class="form-control font-monospace" id="revealed-token" readonly value="' + app.jump.esc(token) + '">'
|
||||
// Reuses the same copy-to-clipboard helper as the Quick Jump card
|
||||
// above (toast feedback -- FontAwesome replaces <i> icons with
|
||||
// inline <svg>, so a checkmark-flash-the-icon approach silently
|
||||
// no-ops; the toast doesn't have that problem).
|
||||
+ '<button class="btn btn-outline-secondary" onclick="copyFieldValue(\'#revealed-token\')" title="Copy"><i class="fa-solid fa-copy"></i></button></div>'
|
||||
+ '<p class="mt-3 mb-0 text-muted small">Use it as a bearer token:<br><code>Authorization: Bearer ' + app.jump.esc(token) + '</code></p>'
|
||||
});
|
||||
}
|
||||
@@ -132,27 +177,77 @@
|
||||
+ '<input type="text" class="form-control" id="new-token-name" placeholder="e.g. laptop-cron">'
|
||||
+ '</div>'
|
||||
+ '<div class="mb-3">'
|
||||
+ '<label class="form-label">Description</label>'
|
||||
+ '<input type="text" class="form-control" id="new-token-description" placeholder="optional">'
|
||||
+ '</div>'
|
||||
+ '<div class="mb-3">'
|
||||
+ '<label class="form-label">Expires in (days, blank = never)</label>'
|
||||
+ '<input type="number" class="form-control" id="new-token-days" min="1">'
|
||||
+ '</div>'
|
||||
+ '<button class="btn btn-primary" onclick="submitApiToken()"><i class="fa-solid fa-check"></i> Create</button>'
|
||||
+ '</div>',
|
||||
footer: {buttonsHtml: app.modal.footerButtons({onSave: 'submitApiToken()', saveLabel: 'Create'})},
|
||||
});
|
||||
$body.find('#new-token-name').focus();
|
||||
}
|
||||
|
||||
function submitApiToken(){
|
||||
var name = $('#new-token-name').val().trim();
|
||||
var $card = $('#api-tokens').closest('.card');
|
||||
if(!name) return app.messages.action('Name is required', $card, 'danger');
|
||||
if(!name) return app.messages.action('Name is required', app.modal.body(), 'danger');
|
||||
app.apiToken.add({
|
||||
name: name,
|
||||
description: $('#new-token-description').val(),
|
||||
expires_in_days: $('#new-token-days').val(),
|
||||
}, function(error, data){
|
||||
if(error) return app.messages.action((data && data.message) || 'Failed to create token', $card, 'danger');
|
||||
if(error) return app.messages.action((data && data.message) || 'Failed to create token', app.modal.body(), 'danger');
|
||||
// Deliberately no app.modal.close() here -- app.modal is a
|
||||
// singleton, and close() immediately followed by open() (inside
|
||||
// showToken) in the same tick collides with Bootstrap's
|
||||
// hide-transition guard, so the reveal modal silently never
|
||||
// shows. open() alone already overwrites the (already-visible)
|
||||
// modal's content in place.
|
||||
showToken('API Token Created', data.token);
|
||||
loadApiTokens();
|
||||
});
|
||||
}
|
||||
|
||||
function editToken(id){
|
||||
var t = tokensById[id]; if(!t) return;
|
||||
app.modal.open({
|
||||
title: 'Edit Token',
|
||||
bodyHtml:
|
||||
'<input type="hidden" id="edit-token-id" value="' + app.jump.esc(id) + '">'
|
||||
+ '<div class="mb-3">'
|
||||
+ '<label class="form-label">Name</label>'
|
||||
+ '<input type="text" class="form-control" id="edit-token-name" value="' + app.jump.esc(t.name || '') + '">'
|
||||
+ '</div>'
|
||||
+ '<div class="mb-3">'
|
||||
+ '<label class="form-label">Description</label>'
|
||||
+ '<input type="text" class="form-control" id="edit-token-description" value="' + app.jump.esc(t.description || '') + '">'
|
||||
+ '</div>'
|
||||
+ '<div class="mb-3">'
|
||||
+ '<label class="form-label">Expires in (days, blank = keep as-is, 0 = never)</label>'
|
||||
+ '<input type="number" class="form-control" id="edit-token-days" min="0">'
|
||||
+ '</div>',
|
||||
footer: {
|
||||
metaHtml: 'Created by ' + app.jump.esc(t.created_by || '—') + ' on ' + app.jump.fmtTime(t.created_on),
|
||||
buttonsHtml: app.modal.footerButtons({onSave: 'saveEditToken()', saveLabel: 'Save'}),
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
function saveEditToken(){
|
||||
var payload = {
|
||||
id: $('#edit-token-id').val(),
|
||||
name: $('#edit-token-name').val(),
|
||||
description: $('#edit-token-description').val(),
|
||||
expires_in_days: $('#edit-token-days').val(),
|
||||
};
|
||||
app.apiToken.update(payload, function(error, data){
|
||||
if(error) return app.messages.action((data && data.message) || 'Failed to update token', app.modal.body(), 'danger');
|
||||
app.modal.close();
|
||||
loadApiTokens();
|
||||
});
|
||||
}
|
||||
|
||||
async function revokeApiToken(id, btn){
|
||||
var $card = $(btn).closest('.card');
|
||||
var ok = await app.messages.confirm('Revoke this API token? It stops working immediately.', $card, 'danger');
|
||||
@@ -174,17 +269,9 @@
|
||||
}
|
||||
|
||||
$(document).ready(async function(){
|
||||
app.jump.metrics(function(error, data){
|
||||
if(error || !data) return;
|
||||
$('#stat-active').text(data.active);
|
||||
$('#stat-total').text(data.total);
|
||||
$('#stat-fail').text(data.fail);
|
||||
$('#stat-users').text((data.topUsers || []).length);
|
||||
rows('#top-hosts', data.topHosts);
|
||||
rows('#top-users', data.topUsers);
|
||||
});
|
||||
await app.auth.loadUser();
|
||||
if(app.auth.isAdmin()) $('#my-hosts-title').text('All hosts');
|
||||
if(app.auth.isAdmin()) $('#my-hosts-title').text('My hosts');
|
||||
$('#quick-jump-cmd').val(sshCommand());
|
||||
app.jump.hosts(function(error, data){
|
||||
if(error) return hostRows('#my-hosts', []);
|
||||
hostRows('#my-hosts', data && data.results);
|
||||
|
||||
@@ -90,7 +90,7 @@
|
||||
<hr />
|
||||
<div class="d-grid">
|
||||
<a href="/api/auth/oidc/start" class="btn btn-outline-primary">
|
||||
<i class="fa-solid fa-id-badge"></i> Log in with SSO
|
||||
<i class="fa-solid fa-id-badge"></i> Log in with Jump
|
||||
</a>
|
||||
</div>
|
||||
<% } %>
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
<%- include('top') %>
|
||||
<script type="text/javascript">app.auth.forceLogin();</script>
|
||||
|
||||
<div class="container mt-4">
|
||||
<div class="card shadow-sm">
|
||||
<div class="card-header d-flex justify-content-between align-items-center">
|
||||
<span><i class="fa-solid fa-plug-circle-bolt me-1"></i> Active sessions</span>
|
||||
@@ -13,6 +14,7 @@
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<script type="text/javascript">
|
||||
function loadSessions(){
|
||||
|
||||
@@ -82,16 +82,24 @@
|
||||
</div>
|
||||
|
||||
<script type="text/javascript">
|
||||
// --sw-content-offset tracks the same height as #spa-shell's margin-top
|
||||
// (fixed navbar, plus the update banner while it's shown), so any
|
||||
// in-page sticky element (e.g. a sticky search/sort bar) can offset
|
||||
// itself below both fixed elements via `top: var(--sw-content-offset)`
|
||||
// instead of colliding with them at the viewport's true top:0.
|
||||
function showUpdateBanner(){
|
||||
let $nav = $('nav.fixed-top');
|
||||
let $banner = $('#update-banner');
|
||||
$banner.css('top', $nav.outerHeight() + 'px').show();
|
||||
$('#spa-shell').css('margin-top', ($nav.outerHeight() + $banner.outerHeight()) + 'px');
|
||||
let offset = $nav.outerHeight() + $banner.outerHeight();
|
||||
$('#spa-shell').css('margin-top', offset + 'px');
|
||||
document.documentElement.style.setProperty('--sw-content-offset', offset + 'px');
|
||||
}
|
||||
|
||||
function dismissUpdateBanner(){
|
||||
$('#update-banner').hide();
|
||||
$('#spa-shell').css('margin-top', '');
|
||||
document.documentElement.style.setProperty('--sw-content-offset', $('nav.fixed-top').outerHeight() + 'px');
|
||||
sessionStorage.setItem('update-banner-dismissed', '1');
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user