new access option: --force-password <HASH>, to only try one specific password #256

madchrist · 2021-10-26T11:39:09Z

This is like --force-key, but for passwords

When this option is set, instead of autologin trying all the passwords until one works, only the one matching the hash is tried
If no password matches the hash then it aborts

This works for both personal accesses and group accesses

madchrist · 2021-10-26T11:43:13Z

I used a new test file (341-selfaccesses-force-password.sh) because I didn't want to put so much tests into one of the existing files
But I don't know if I should use ${capabilities[mfa]} / ${capabilities[pamtester]} or something similar

madchrist · 2021-10-27T11:36:12Z

Fixed a few perl-critic/tidy issues

madchrist · 2021-10-27T11:56:52Z

Fixed a couple wrong plugin names in the doc

speed47 · 2021-10-28T09:55:21Z

Hey @madchrist , thanks for this PR.

I used a new test file (341-selfaccesses-force-password.sh) because I didn't want to put so much tests into one of the existing files

Good move, this way you can test it easily without running all the other tests:

./tests/functional/docker/docker_build_and_run_tests.sh debian10 --module=341-selfaccesses-force-password.sh

FYI the options you can pass in addition to the OS are actually the same options than the ones that can be seen in ./tests/functional/launch_tests_on_instance.sh --help. I need to document the dev process, sorry you had to find all this out by yourself :/

But I don't know if I should use ${capabilities[mfa]} / ${capabilities[pamtester]} or something similar

That's exactly why the OpenSUSE tests are failing, as MFA is not supported on it, you have to skip these tests. You can add this on the bottom of 341-selfaccesses-force-password.sh:

if [ "${capabilities[mfa]}" = 1 ] || [ "${capabilities[mfa-password]}" = 1 ]; then
    testsuite_selfaccesses_force_password
fi

And the tests should pass!

madchrist · 2021-10-28T11:54:09Z

Ok, that makes sense, thanks for the tips

The new option doesn't need MFA, so it should work on opensuse
The test on the other hand uses MFA, so I think I will modify it to not need MFA anymore
That way everything will support opensuse (and other non-MFA systems)

speed47 · 2021-10-28T13:08:34Z

The new option doesn't need MFA, so it should work on opensuse The test on the other hand uses MFA, so I think I will modify it to not need MFA anymore That way everything will support opensuse (and other non-MFA systems)

Indeed, that would be perfect.

madchrist · 2021-11-02T12:30:13Z

I updated the test to handle non-mfa systems
(and rebased)

…password

madchrist · 2021-11-02T16:49:46Z

Small fix for opensuse15.2

speed47

Looks mostly ok, just a few suggestions before merging!

As a side note, we might want in a future version to support more parameters types to --force-password, instead of the raw hash (which we might not want to appear in logs, for example). We could support an index number (0 = main password, N>0 = Nth fallback password as you've done internally), or even an id representing the hash of a password, as we do for e.g. egress ssh keys (see the output of selfListEgressKeys). We can do this later in another PR though, this one is probably large enough!

speed47 · 2021-11-03T15:08:19Z

lib/perl/OVH/Bastion/password.inc

+    elsif ($hash =~ /^\$1\$[a-zA-Z0-9]+\$[a-zA-Z0-9\.\/]+$/) {
+        return R('OK', value => {type => 'md5crypt', hash => $hash});
+    }
+    elsif ($hash =~ /^\$5\$[a-zA-Z0-9]+\$[a-zA-Z0-9\.\/]+$/) {
+        return R('OK', value => {type => 'sha256crypt', hash => $hash});
+    }
+    elsif ($hash =~ /^\$6\$[a-zA-Z0-9]+\$[a-zA-Z0-9\.\/]+$/) {
+        return R('OK', value => {type => 'sha512crypt', hash => $hash});
+    }


as we've just verified the hash validity, we can now untaint it and pass it up so that our caller can get the untainted version:

Suggested change

elsif ($hash =~ /^\$1\$[a-zA-Z0-9]+\$[a-zA-Z0-9\.\/]+$/) {

return R('OK', value => {type => 'md5crypt', hash => $hash});

}

elsif ($hash =~ /^\$5\$[a-zA-Z0-9]+\$[a-zA-Z0-9\.\/]+$/) {

return R('OK', value => {type => 'sha256crypt', hash => $hash});

}

elsif ($hash =~ /^\$6\$[a-zA-Z0-9]+\$[a-zA-Z0-9\.\/]+$/) {

return R('OK', value => {type => 'sha512crypt', hash => $hash});

}

elsif ($hash =~ /^(\$1\$[a-zA-Z0-9]+\$[a-zA-Z0-9\.\/]+)$/) {

return R('OK', value => {type => 'md5crypt', hash => $1});

}

elsif ($hash =~ /^(\$5\$[a-zA-Z0-9]+\$[a-zA-Z0-9\.\/]+)$/) {

return R('OK', value => {type => 'sha256crypt', hash => $1});

}

elsif ($hash =~ /^(\$6\$[a-zA-Z0-9]+\$[a-zA-Z0-9\.\/]+)$/) {

return R('OK', value => {type => 'sha512crypt', hash => $1});

}

speed47 · 2021-11-03T15:33:15Z

tests/functional/tests.d/341-selfaccesses-force-password.sh

+        # fetch checksums for a1|g1's second and third egress passwords
+        success ${mode}_listpass $a0 --osh $list_pass_plugin $target
+        json .error_code OK .command $list_pass_plugin
+        password2_sha256=$(get_json |  jq '.value[1].hashes.sha256crypt' | sed -e 's/"//g')


you can just use jq -r here, to get the raw output, instead of sed'ing out the "

speed47 · 2021-11-03T15:35:48Z

bin/shell/osh.pl

+        if (
+            $grant->{'forcePassword'}
+            && (   ($userPasswordContext eq 'self' && $grant->{'type'} eq 'personal')
+                || ($userPasswordContext eq 'group' && $grant->{'type'} eq 'group-member' && $grant->{'group'} eq $userPasswordClue))


A user can also be a group guest (i.e. have access to the group credentials, such as egress keys and passwords, but not automatically be granted the whole servers/device list, just a subset of those), in which case we should also enter this if.
It can be checked with $grant->{'type'} eq 'group-guest'

While fixing this I noticed the guest grant does not contain the extra infos (the forced password)
To fix this, when fetching the guest grant, I replace it with the matching group grant

Hah, actually you can't do that, it'll have adverse effects, this is because a guest access can carry more information that the member access, for a given server, such as a TTL expiration. e.g. you can have an ACL in the group like this:
127.0.0.0/8 port-any user-any
And a guest group access for some account with:
127.1.2.3 port 22 user root TTL=1d

Access will be allowed for the guest (as long as the TTL has not expired) because this guest ACL matches at least one of the regular group ACL. This also means that if the 127.0.0.0/8 ACL is removed from the group, the guest account will no longer have access to 127.1.2.3 through it, because even if this ACL is declared for their guest access, it no longer matches any ACL of the group itself.

In other words, guest group accesses may be more specific that the group ACL.

What this means for the force-password feature is that this should also be declared (if needed) when declaring the group guest access. Side note: the force-key feature has the same issue, as you can't use --force-key with groupAddGuestAccess, there is no way to force a key in guest accesses. We should fix that by adding the --force-key and --force-password options to group{Add,Del}GuestAccess. As this PR has already a lot of changes, I suggest doing it in a later one to avoid working on this one for 6 months :)

So in the meantime, so we can go forward, can you revert your change to is_access_granted by restoring groupGuest and groupLegacy vars instead of groupMember?

Note to self: I'll also add a test case that ensure such code change can no longer pass all the tests!

… code cleanups

speed47 · 2021-12-02T09:49:43Z

lib/perl/OVH/Bastion/allowdeny.inc

@@ -780,14 +786,14 @@ sub is_access_granted {

            # the guy must have a guest access but the group itself must also still have access
            if ($grantedGuest && $grantedGroup) {
-                push @grants, {type => 'group-guest', group => $shortGroup, %{$grantedGuest->value}};
+                push @grants, {type => 'group-guest', group => $shortGroup, %{$grantedGroup->value}};


Suggested change

push @grants, {type => 'group-guest', group => $shortGroup, %{$grantedGroup->value}};

push @grants, {type => 'group-guest', group => $shortGroup, %{$grantedGuest->value}};

speed47 · 2021-12-02T09:49:56Z

lib/perl/OVH/Bastion/allowdeny.inc

                osh_debug("is_access_granted: adding grantedGuest to grants because is guest and group has access");
            }

            # special legacy case; we also check if account has a legacy access for ip AND that the group ALSO has access to this ip
            if ($grantedLegacy && $grantedGroup) {
                osh_debug("is_access_granted: adding grantedLegacy to grants because legacy not null and group has access");
-                push @grants, {type => 'group-guest-legacy', group => $shortGroup, %{$grantedLegacy->value}};
+                push @grants, {type => 'group-guest-legacy', group => $shortGroup, %{$grantedGroup->value}};


Suggested change

push @grants, {type => 'group-guest-legacy', group => $shortGroup, %{$grantedGroup->value}};

push @grants, {type => 'group-guest-legacy', group => $shortGroup, %{$grantedLegacy->value}};

speed47 · 2021-12-02T09:51:15Z

bin/shell/osh.pl

+          )
+        {
+
+            # fetch the hashes of the main password and all its fallbacks


Suggested change

# fetch the hashes of the main password and all its fallbacks

# FIXME: force-password and force-key don't work yet for guest accesses, see #256

# fetch the hashes of the main password and all its fallbacks

speed47 · 2021-12-02T09:53:02Z

Suggested changes above effectively revert the changes so that we have a working force-password without side effect, and a note that it's not implemented yet for group guests (see conversation above)

madchrist · 2021-12-07T13:19:39Z

Guest access works a little differently than I though, so I removed guest support for now as suggested
I'll make another PR for it once this one goes through

deathiop · 2021-12-08T14:53:56Z

bin/shell/osh.pl

+            # FIXME: force-password and force-key don't work yet for guest accesses, see #256
+            # fetch the hashes of the main password and all its fallbacks
+            my $fnrethashes;
+            if   ($userPasswordContext eq 'self') { $fnrethashes = OVH::Bastion::get_hashes_list(context => 'account', account => $userPasswordClue); }


May you please but these blocks using many lines to keep the style consistent?

Side note: perltidy doesn't seem to have a config option to force multi-statement one-liners to be split against multiple lines, unfortunately. That's why it went undetected/unmodified. However, if only one \n is added to such one-liner, between two statements, then perltidy will correctly do the job of re-arranging the whole block correctly, one statement per line.

In other words you can just add a \n on each of those lines after any semi-colon, run perltidy, and you should be good to go.

speed47 · 2021-12-09T15:51:29Z

OpenSUSE failure just happened also on another PR, they seem to have changed something around their fping binary, which doesn't seem to work well inside a Docker when not called from root. I'll go ahead and merge, this problem has nothing to do with this PR's code. It'll be investigated separately.

madchrist force-pushed the force-password branch 2 times, most recently from 6fc732c to 2f238d1 Compare October 27, 2021 11:32

madchrist force-pushed the force-password branch from 2f238d1 to a9d521c Compare October 27, 2021 11:54

speed47 added the tests:full Launch full tests through GitHub Actions label Oct 27, 2021

madchrist force-pushed the force-password branch from a9d521c to e657661 Compare November 2, 2021 12:14

new access option: --force-password <HASH>, to only try one specific …

042e55c

…password

madchrist force-pushed the force-password branch from e657661 to 042e55c Compare November 2, 2021 15:50

speed47 requested changes Nov 3, 2021

View reviewed changes

update of --force-password: guest support, autocompletion, new tests,…

59861ed

… code cleanups

speed47 reviewed Dec 2, 2021

View reviewed changes

update of --force-password: removed guest support

51cdaf4

speed47 previously approved these changes Dec 8, 2021

View reviewed changes

deathiop reviewed Dec 8, 2021

View reviewed changes

update of --force-password: code style cleanup

c87ee4c

madchrist dismissed speed47’s stale review via c87ee4c December 9, 2021 14:46

speed47 approved these changes Dec 9, 2021

View reviewed changes

deathiop approved these changes Dec 9, 2021

View reviewed changes

speed47 merged commit 98c1c79 into ovh:master Dec 9, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

new access option: --force-password <HASH>, to only try one specific password #256

new access option: --force-password <HASH>, to only try one specific password #256

madchrist commented Oct 26, 2021

madchrist commented Oct 26, 2021 •

edited

Loading

madchrist commented Oct 27, 2021

madchrist commented Oct 27, 2021

speed47 commented Oct 28, 2021

madchrist commented Oct 28, 2021

speed47 commented Oct 28, 2021

madchrist commented Nov 2, 2021 •

edited

Loading

madchrist commented Nov 2, 2021

speed47 left a comment

speed47 Nov 3, 2021

madchrist Nov 9, 2021

speed47 Nov 3, 2021

madchrist Nov 9, 2021

speed47 Nov 3, 2021

madchrist Nov 9, 2021

speed47 Dec 2, 2021

speed47 Dec 2, 2021

speed47 Dec 2, 2021

speed47 Dec 2, 2021

speed47 commented Dec 2, 2021

madchrist commented Dec 7, 2021

deathiop Dec 8, 2021

speed47 Dec 9, 2021

speed47 commented Dec 9, 2021

	push @grants, {type => 'group-guest', group => $shortGroup, %{$grantedGroup->value}};
	push @grants, {type => 'group-guest', group => $shortGroup, %{$grantedGuest->value}};

	push @grants, {type => 'group-guest-legacy', group => $shortGroup, %{$grantedGroup->value}};
	push @grants, {type => 'group-guest-legacy', group => $shortGroup, %{$grantedLegacy->value}};

	# fetch the hashes of the main password and all its fallbacks
	# FIXME: force-password and force-key don't work yet for guest accesses, see #256
	# fetch the hashes of the main password and all its fallbacks

new access option: --force-password <HASH>, to only try one specific password #256

new access option: --force-password <HASH>, to only try one specific password #256

Conversation

madchrist commented Oct 26, 2021

madchrist commented Oct 26, 2021 • edited Loading

madchrist commented Oct 27, 2021

madchrist commented Oct 27, 2021

speed47 commented Oct 28, 2021

madchrist commented Oct 28, 2021

speed47 commented Oct 28, 2021

madchrist commented Nov 2, 2021 • edited Loading

madchrist commented Nov 2, 2021

speed47 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

speed47 commented Dec 2, 2021

madchrist commented Dec 7, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

speed47 commented Dec 9, 2021

madchrist commented Oct 26, 2021 •

edited

Loading

madchrist commented Nov 2, 2021 •

edited

Loading