mirror of
https://github.com/wavetermdev/waveterm.git
synced 2025-01-08 19:38:51 +01:00
018bb14b6a
* create proof of concept ssh library integration This is a first attempt to integrate the golang crypto/ssh library for handling remote connections. As it stands, this features is limited to identity files without passphrases. It needs to be expanded to include key+passphrase and password verifications as well. * add password and keyboard-interactive ssh auth This adds several new ssh auth methods. In addition to the PublicKey method used previously, this adds password authentication, keyboard-interactive authentication, and PublicKey+Passphrase authentication. Furthermore, it refactores the ssh connection code into its own wavesrv file rather than storing int in waveshell's shexec file. * clean up old mshell launch methods In the debugging the addition of the ssh library, i had several versions of the MShellProc Launch function. Since this seems mostly stable, I have removed the old version and the experimental version in favor of the combined version. * allow switching between new and old ssh for dev It is inconvenient to create milestones without being able to merge into the main branch. But due to the experimental nature of the ssh changes, it is not desired to use these changes in the main branch yet. This change disables the new ssh launcher by default. It can be used by changing the UseSshLibrary constant to true in remote.go. With this, it becomes possible to merge these changes into the main branch without them being used in production. * fix: allow retry after ssh auth failure Previously, the error status was not set when an ssh connection failed. Because of this, an ssh connection failure would lock the failed remote until waveterm was rebooted. This fix properly sets the error status so this cannot happen.
109 lines
3.1 KiB
Go
109 lines
3.1 KiB
Go
// Copyright 2024, Command Line Inc.
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
package remote
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"os"
|
|
"os/user"
|
|
"strconv"
|
|
"strings"
|
|
|
|
"github.com/kevinburke/ssh_config"
|
|
"github.com/wavetermdev/waveterm/waveshell/pkg/base"
|
|
"github.com/wavetermdev/waveterm/wavesrv/pkg/sstore"
|
|
"golang.org/x/crypto/ssh"
|
|
)
|
|
|
|
func createPublicKeyAuth(identityFile string, passphrase string) (ssh.AuthMethod, error) {
|
|
privateKey, err := os.ReadFile(base.ExpandHomeDir(identityFile))
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to read ssh key file. err: %+v", err)
|
|
}
|
|
signer, err := ssh.ParsePrivateKey(privateKey)
|
|
if err != nil {
|
|
if errors.Is(err, &ssh.PassphraseMissingError{}) {
|
|
signer, err = ssh.ParsePrivateKeyWithPassphrase(privateKey, []byte(passphrase))
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to parse private ssh key with passphrase. err: %+v", err)
|
|
}
|
|
} else {
|
|
return nil, fmt.Errorf("failed to parse private ssh key. err: %+v", err)
|
|
}
|
|
}
|
|
return ssh.PublicKeys(signer), nil
|
|
}
|
|
|
|
func createKeyboardInteractiveAuth(password string) ssh.AuthMethod {
|
|
challenge := func(name, instruction string, questions []string, echos []bool) (answers []string, err error) {
|
|
for _, q := range questions {
|
|
if strings.Contains(strings.ToLower(q), "password") {
|
|
answers = append(answers, password)
|
|
} else {
|
|
answers = append(answers, "")
|
|
}
|
|
}
|
|
return answers, nil
|
|
}
|
|
return ssh.KeyboardInteractive(challenge)
|
|
}
|
|
|
|
func ConnectToClient(opts *sstore.SSHOpts) (*ssh.Client, error) {
|
|
ssh_config.ReloadConfigs()
|
|
configIdentity, _ := ssh_config.GetStrict(opts.SSHHost, "IdentityFile")
|
|
var identityFile string
|
|
if opts.SSHIdentity != "" {
|
|
identityFile = opts.SSHIdentity
|
|
} else {
|
|
identityFile = configIdentity
|
|
}
|
|
|
|
hostKeyCallback := ssh.InsecureIgnoreHostKey()
|
|
var authMethods []ssh.AuthMethod
|
|
publicKeyAuth, err := createPublicKeyAuth(identityFile, opts.SSHPassword)
|
|
if err == nil {
|
|
authMethods = append(authMethods, publicKeyAuth)
|
|
}
|
|
authMethods = append(authMethods, createKeyboardInteractiveAuth(opts.SSHPassword))
|
|
authMethods = append(authMethods, ssh.Password(opts.SSHPassword))
|
|
|
|
configUser, _ := ssh_config.GetStrict(opts.SSHHost, "User")
|
|
configHostName, _ := ssh_config.GetStrict(opts.SSHHost, "HostName")
|
|
configPort, _ := ssh_config.GetStrict(opts.SSHHost, "Port")
|
|
var username string
|
|
if opts.SSHUser != "" {
|
|
username = opts.SSHUser
|
|
} else if configUser != "" {
|
|
username = configUser
|
|
} else {
|
|
user, err := user.Current()
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to get user for ssh: %+v", err)
|
|
}
|
|
username = user.Username
|
|
}
|
|
var hostName string
|
|
if configHostName != "" {
|
|
hostName = configHostName
|
|
} else {
|
|
hostName = opts.SSHHost
|
|
}
|
|
clientConfig := &ssh.ClientConfig{
|
|
User: username,
|
|
Auth: authMethods,
|
|
HostKeyCallback: hostKeyCallback,
|
|
}
|
|
var port string
|
|
if opts.SSHPort != 0 && opts.SSHPort != 22 {
|
|
port = strconv.Itoa(opts.SSHPort)
|
|
} else if configPort != "" && configPort != "22" {
|
|
port = configPort
|
|
} else {
|
|
port = "22"
|
|
}
|
|
networkAddr := hostName + ":" + port
|
|
return ssh.Dial("tcp", networkAddr, clientConfig)
|
|
}
|