From 7536608c597a52f6587b87bdb9aa83c3cf277383 Mon Sep 17 00:00:00 2001 From: doktornotor Date: Sun, 1 Nov 2015 15:41:58 +0100 Subject: Add privileges configuration to sshdcond package Do some cleanups while here. --- config/sshdcond/sshdcond.xml | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/config/sshdcond/sshdcond.xml b/config/sshdcond/sshdcond.xml index 11104e1d..f0e27c80 100644 --- a/config/sshdcond/sshdcond.xml +++ b/config/sshdcond/sshdcond.xml @@ -43,12 +43,10 @@ ]]> sshdcond - 1.0.2 - SSH Conditional - SSH Conditional blocks + 1.0.6 + Services: SSH Conditional Options Save /usr/local/pkg/sshdcond.inc - SSH Conditions Configure SSH conditional exceptions @@ -60,6 +58,10 @@ /usr/local/pkg/ https://packages.pfsense.org/packages/config/sshdcond/sshdcond.inc + + /etc/inc/priv/ + https://packages.pfsense.org/packages/config/sshdcond/sshdcond.priv.inc + /usr/local/pkg/ https://packages.pfsense.org/packages/config/sshdcond/sshdcond_sync.xml @@ -93,7 +95,6 @@ listtopic Conditional SSH Options - temp Enable @@ -187,7 +188,4 @@ sshdcond_custom_php_write_config(); - - unset($_POST['temp']); - -- cgit v1.2.3 From be990f44febf86a13b3092386a51bde88b83ff24 Mon Sep 17 00:00:00 2001 From: doktornotor Date: Sun, 1 Nov 2015 15:43:37 +0100 Subject: Add privileges configuration to sshdcond package --- config/sshdcond/sshdcond.priv.inc | 42 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 config/sshdcond/sshdcond.priv.inc diff --git a/config/sshdcond/sshdcond.priv.inc b/config/sshdcond/sshdcond.priv.inc new file mode 100644 index 00000000..fddb86c1 --- /dev/null +++ b/config/sshdcond/sshdcond.priv.inc @@ -0,0 +1,42 @@ + -- cgit v1.2.3 From b36519d761dcc9e432d4b95070ddf6ab821b32a1 Mon Sep 17 00:00:00 2001 From: doktornotor Date: Sun, 1 Nov 2015 15:57:05 +0100 Subject: Improve XMLRPC sync - Add CARP/HA sync option - Add enable/disable checkbox per replication target - Add protocol selection - Add timeout setting --- config/sshdcond/sshdcond_sync.xml | 84 +++++++++++++++++++++++++++++---------- 1 file changed, 64 insertions(+), 20 deletions(-) diff --git a/config/sshdcond/sshdcond_sync.xml b/config/sshdcond/sshdcond_sync.xml index 511df25b..f81f36b0 100755 --- a/config/sshdcond/sshdcond_sync.xml +++ b/config/sshdcond/sshdcond_sync.xml @@ -42,8 +42,8 @@ ]]> sshdcondsync - 1.0.2 - SSH Conditional - Sync + 1.0.6 + Services: SSH Conditional Options - Sync /usr/local/pkg/sshdcond.inc @@ -62,30 +62,74 @@ listtopic - Automatically sync configuration changes + Enable Sync synconchanges - Automatically sync changes to the hosts defined below. - checkbox + +
+ Important: While using "Sync to host(s) defined below", only sync from host A to B, A to C but do not enable XMLRPC sync to A. This will result in a loop! + ]]> + + select + + disabled + + + + + - Remote Server + XMLRPC Timeout + synctimeout + + input + 150 + 5 + + + Replication Targets none rowhelper - - IP Address - ipaddress - IP Address of remote server. - input - 20 - - - Password - password - Password for remote server. - password - 20 - + + Enable + syncdestinenable + + checkbox + + + Protocol + syncprotocol + + select + HTTP + + + + + + + IP Address/Hostname + ipaddress + + input + 40 + + + Port + syncport + + input + 3 + + + Admin Password + password + + password + 20 + -- cgit v1.2.3 From 46fadab060ea37f81100f728bd15421150129005 Mon Sep 17 00:00:00 2001 From: doktornotor Date: Sun, 1 Nov 2015 16:03:31 +0100 Subject: Improve XMLRPC sync - Add CARP/HA sync option - Add enable/disable checkbox per replication target - Add protocol selection - Add timeout setting - Fix literal IPv6 handling for sync targets - Do settings validation and only try to sync when configuration is valid --- config/sshdcond/sshdcond.inc | 176 ++++++++++++++++++++++++++----------------- 1 file changed, 105 insertions(+), 71 deletions(-) diff --git a/config/sshdcond/sshdcond.inc b/config/sshdcond/sshdcond.inc index 9c3a8bb9..7c1be614 100644 --- a/config/sshdcond/sshdcond.inc +++ b/config/sshdcond/sshdcond.inc @@ -37,8 +37,6 @@ function restart_sshd() { } function sshdcond_custom_php_install_command() { - global $g, $config; - /* We need to generate an outfile for our extra commands. The patched g_szSSHDFileGenerate php file then reads and appends that config. */ @@ -48,8 +46,6 @@ function sshdcond_custom_php_install_command() { } function sshdcond_custom_php_deinstall_command() { - global $g, $config; - /* Delete our config file. */ unlink_if_exists("/etc/ssh/sshd_extra"); @@ -59,7 +55,7 @@ function sshdcond_custom_php_deinstall_command() { } function sshdcond_custom_php_write_config() { - global $g, $config, $pkg_interface; + global $g, $config; /* Detect boot process, do nothing during boot. */ if (function_exists("platform_booting")) { @@ -113,71 +109,113 @@ function sshdcond_custom_php_write_config() { /* Uses XMLRPC to synchronize the changes to a remote node. */ function sshdcond_sync_on_changes() { - global $config, $g; - - /* Basically, this package was never configured */ - if (!is_array($config['installedpackages']['sshdcondsync'])) { - return; - } - /* Package is configured but XMLRPC sync is disabled */ - if (!isset($config['installedpackages']['sshdcondsync']['config'][0]['synconchanges'])) { - return; - } - /* Do XMLRPC sync */ - log_error("[sshdcond] xmlrpc sync is starting."); - foreach ($config['installedpackages']['sshdcondsync']['config'] as $rs) { - foreach($rs['row'] as $sh) { - $sync_to_ip = $sh['ipaddress']; - $password = $sh['password']; - if ($password && $sync_to_ip) { - sshdcond_do_xmlrpc_sync($sync_to_ip, $password); + global $config; + + if (is_array($config['installedpackages']['sshdcondsync']['config'])) { + $sshdcond_sync = $config['installedpackages']['sshdcondsync']['config'][0]; + $synconchanges = $sshdcond_sync['synconchanges']; + $synctimeout = $sshdcond_sync['synctimeout'] ?: '150'; + switch ($synconchanges) { + case "manual": + if (is_array($sshdcond_sync['row'])) { + $rs = $sshdcond_sync['row']; + } else { + log_error("[sshdcond] XMLRPC sync is enabled but there are no hosts configured as replication targets."); + return; + } + break; + case "auto": + if (is_array($config['hasync'])) { + $system_carp = $config['hasync']; + $rs[0]['ipaddress'] = $system_carp['synchronizetoip']; + $rs[0]['username'] = $system_carp['username']; + $rs[0]['password'] = $system_carp['password']; + $rs[0]['syncdestinenable'] = FALSE; + + // XMLRPC sync is currently only supported over connections using the same protocol and port as this system + if ($config['system']['webgui']['protocol'] == "http") { + $rs[0]['syncprotocol'] = "http"; + $rs[0]['syncport'] = $config['system']['webgui']['port'] ?: '80'; + } else { + $rs[0]['syncprotocol'] = "https"; + $rs[0]['syncport'] = $config['system']['webgui']['port'] ?: '443'; + } + if ($system_carp['synchronizetoip'] == "") { + log_error("[sshdcond] XMLRPC CARP/HA sync is enabled but there are no system backup hosts configured as replication targets."); + return; + } else { + $rs[0]['syncdestinenable'] = TRUE; + } + } else { + log_error("[sshdcond] XMLRPC CARP/HA sync is enabled but there are no system backup hosts configured as replication targets."); + return; + } + break; + default: + return; + break; + } + if (is_array($rs)) { + log_error("[sshdcond] XMLRPC sync is starting."); + foreach ($rs as $sh) { + // Only sync enabled replication targets + if ($sh['syncdestinenable']) { + $sync_to_ip = $sh['ipaddress']; + $port = $sh['syncport']; + $username = $sh['username'] ?: 'admin'; + $password = $sh['password']; + $protocol = $sh['syncprotocol']; + + $error = ''; + $valid = TRUE; + + if ($password == "") { + $error = "Password parameter is empty. "; + $valid = FALSE; + } + if (!is_ipaddr($sync_to_ip) && !is_hostname($sync_to_ip) && !is_domain($sync_to_ip)) { + $error .= "Misconfigured Replication Target IP Address or Hostname. "; + $valid = FALSE; + } + if (!is_port($port)) { + $error .= "Misconfigured Replication Target Port. "; + $valid = FALSE; + } + if ($valid) { + sshdcond_do_xmlrpc_sync($sync_to_ip, $port, $protocol, $username, $password, $synctimeout); + } else { + log_error("[sshdcond] XMLRPC sync with '{$sync_to_ip}' aborted due to the following error(s): {$error}"); + } + } } + log_error("[sshdcond] XMLRPC sync completed."); } - } - log_error("[sshdcond] xmlrpc sync is ending."); + } } /* Do the actual XMLRPC sync. */ -function sshdcond_do_xmlrpc_sync($sync_to_ip, $password) { +function sshdcond_do_xmlrpc_sync($sync_to_ip, $port, $protocol, $username, $password, $synctimeout) { global $config, $g; - if (!$password) { + if ($username == "" || $password == "" || $sync_to_ip == "" || $port == "" || $protocol == "") { + log_error("[sshdcond] A required XMLRPC sync parameter (username, password, replication target, port or protocol) is empty ... aborting pkg sync"); return; } - if (!$sync_to_ip) { - return; + // Take care of IPv6 literal address + if (is_ipaddrv6($sync_to_ip)) { + $sync_to_ip = "[{$sync_to_ip}]"; } - $username='admin'; - $xmlrpc_sync_neighbor = $sync_to_ip; - if ($config['system']['webgui']['protocol'] != "") { - $synchronizetoip = $config['system']['webgui']['protocol']; - $synchronizetoip .= "://"; - } - $port = $config['system']['webgui']['port']; - /* If port is empty, let's rely on the protocol selection. */ - if ($port == "") { - if ($config['system']['webgui']['protocol'] == "http") { - $port = "80"; - } else { - $port = "443"; - } - } - $synchronizetoip .= $sync_to_ip; + $url = "{$protocol}://{$sync_to_ip}"; - /* xml will hold the sections to sync. */ + /* XML will hold the sections to sync. */ $xml = array(); $xml['sshdcond'] = $config['installedpackages']['sshdcond']; /* Assemble XMLRPC payload. */ - $params = array( - XML_RPC_encode($password), - XML_RPC_encode($xml) - ); - - /* Set a few variables needed for sync code; borrowed from filter.inc. */ - $url = $synchronizetoip; - log_error("Beginning sshdcond XMLRPC sync to {$url}:{$port}."); + $params = array(XML_RPC_encode($password), XML_RPC_encode($xml)); + + /* Set a few variables needed for sync code */ $method = 'pfsense.merge_installedpackages_section_xmlrpc'; $msg = new XML_RPC_Message($method, $params); $cli = new XML_RPC_Client('/xmlrpc.php', $url, $port); @@ -185,20 +223,20 @@ function sshdcond_do_xmlrpc_sync($sync_to_ip, $password) { if ($g['debug']) { $cli->setDebug(1); } - /* Send our XMLRPC message and timeout after 250 seconds. */ - $resp = $cli->send($msg, "250"); + /* Send our XMLRPC message and timeout after defined sync timeout value */ + $resp = $cli->send($msg, $synctimeout); if (!$resp) { - $error = "A communications error occurred while attempting sshdcond XMLRPC sync with {$url}:{$port}."; - log_error($error); + $error = "A communications error occurred while attempting XMLRPC sync with {$url}:{$port}."; + log_error("[sshdcond] {$error}"); file_notice("sync_settings", $error, "sshdcond Settings Sync", ""); } elseif ($resp->faultCode()) { $cli->setDebug(1); - $resp = $cli->send($msg, "250"); + $resp = $cli->send($msg, $synctimeout); $error = "An error code was received while attempting sshdcond XMLRPC sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString(); - log_error($error); + log_error("[sshdcond] {$error}"); file_notice("sync_settings", $error, "sshdcond Settings Sync", ""); } else { - log_error("sshdcond XMLRPC sync successfully completed with {$url}:{$port}."); + log_error("[sshdcond] XMLRPC sync successfully completed with {$url}:{$port}."); } /* Tell sshdcond to reload our settings on the destination sync host. */ @@ -206,28 +244,24 @@ function sshdcond_do_xmlrpc_sync($sync_to_ip, $password) { $execcmd = "require_once('/usr/local/pkg/sshdcond.inc');\n"; $execcmd .= "sshdcond_custom_php_write_config();"; /* Assemble XMLRPC payload. */ - $params = array( - XML_RPC_encode($password), - XML_RPC_encode($execcmd) - ); + $params = array(XML_RPC_encode($password), XML_RPC_encode($execcmd)); - log_error("sshdcond XMLRPC reload data {$url}:{$port}."); $msg = new XML_RPC_Message($method, $params); $cli = new XML_RPC_Client('/xmlrpc.php', $url, $port); $cli->setCredentials($username, $password); - $resp = $cli->send($msg, "250"); + $resp = $cli->send($msg, $synctimeout); if (!$resp) { $error = "A communications error occurred while attempting sshdcond XMLRPC sync with {$url}:{$port} (pfsense.exec_php)."; - log_error($error); + log_error("[sshdcond] {$error}"); file_notice("sync_settings", $error, "sshdcond Settings Sync", ""); } elseif ($resp->faultCode()) { $cli->setDebug(1); - $resp = $cli->send($msg, "250"); + $resp = $cli->send($msg, $synctimeout); $error = "An error code was received while attempting sshdcond XMLRPC sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString(); - log_error($error); + log_error("[sshdcond] {$error}"); file_notice("sync_settings", $error, "sshdcond Settings Sync", ""); } else { - log_error("sshdcond XMLRPC reload data success with {$url}:{$port} (pfsense.exec_php)."); + log_error("[sshdcond] XMLRPC reload data success with {$url}:{$port} (pfsense.exec_php)."); } } ?> -- cgit v1.2.3 From 536d3b0b9f4b45b3b2e0996cac2a73734a625d75 Mon Sep 17 00:00:00 2001 From: doktornotor Date: Sun, 1 Nov 2015 16:04:05 +0100 Subject: Bump sshdcond package version --- pkg_config.10.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg_config.10.xml b/pkg_config.10.xml index 7775d4b1..b6fb72d8 100644 --- a/pkg_config.10.xml +++ b/pkg_config.10.xml @@ -1339,7 +1339,7 @@ ]]> Enhancements - 1.0.5 + 1.0.6 Beta 2.2 https://packages.pfsense.org/packages/config/sshdcond/sshdcond.xml -- cgit v1.2.3 From aa98fb4f0c4e32b7e1c04e59cd9734518c167d6a Mon Sep 17 00:00:00 2001 From: doktornotor Date: Sun, 1 Nov 2015 16:05:56 +0100 Subject: Bump sshdcond package version --- pkg_config.8.xml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkg_config.8.xml b/pkg_config.8.xml index 757738d7..eaa5fb3b 100644 --- a/pkg_config.8.xml +++ b/pkg_config.8.xml @@ -1503,10 +1503,10 @@ SSHDCond - - This package acts as an access list frontend for ssh connections]]> + + This package acts as an access list frontend for ssh connections.]]> Enhancements - 1.0.5 + 1.0.6 Beta 2.0 https://packages.pfsense.org/packages/config/sshdcond/sshdcond.xml -- cgit v1.2.3 From 32bb734475821b8cd2b519cb7b075afd27e8525a Mon Sep 17 00:00:00 2001 From: doktornotor Date: Sun, 1 Nov 2015 16:06:48 +0100 Subject: Bump sshdcond package version --- pkg_config.8.xml.amd64 | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkg_config.8.xml.amd64 b/pkg_config.8.xml.amd64 index 380225e2..adbcd30b 100644 --- a/pkg_config.8.xml.amd64 +++ b/pkg_config.8.xml.amd64 @@ -1490,10 +1490,10 @@ SSHDCond - - This package acts as an access list frontend for ssh connections]]> + + This package acts as an access list frontend for ssh connections.]]> Enhancements - 1.0.5 + 1.0.6 Beta 2.0 https://packages.pfsense.org/packages/config/sshdcond/sshdcond.xml -- cgit v1.2.3