解決 Jumpserver coco 使用登錄用戶(ldap)進行SSH連接目標主機，忽略系統用戶

前言

　　Jumpserver 作為國內流行的開源堡壘機，很多公司都在嘗試使用，同時 Jumpserver 為了契合眾多公司的用戶認證，也提供了 LDAP 的用戶認證方式，作為 Jumpserver 的用戶，大家可能知道了 Jumpserver 的 LDAP 認證方式，僅是作為 登錄Jumpserver Web UI、登錄 Jumpserver 終端(COCO) 的用戶認證，進入 Jumpserver 終端（COCO）后，再而跳到目標主機，卻需要使用Jumpserver 創建的系統用戶，也就是 登錄Jumpserver 和 Jumpserver登錄目標主機 是需要兩個完全沒有關系的用戶，對於很多基於LDAP用戶登錄主機的場景，Jumpserver 這種雙用戶認證概念顯得有點雞肋，既然接入了 LDAP, 我們希望做到 登錄Jumpserver 和 Jumpserver跳轉主機都使用 LDAP 完成認證登錄，帶着這一想法，便開始了對 Jumpserver 終端核心 COCO 進行了部分修改。

 

COCO前后對比

 

注：LDAP 用戶登錄Jumpserver coco、選擇登錄主機后，直接使用登錄coco 的用戶進行登錄主機，取消了選擇系統用戶的步驟。

 

詳細流程

 

注1：用戶名密碼登錄 Jumpserver 時，COCO 處理線程存儲用戶名密碼，用於SSH 連接目標主機；

注2：公鑰登錄 Jumpserver 時，COCO 處理線程存儲用戶名和空密碼，SSH 連接目標主機時，根據用戶名從COCO本地查找密碼，有則使用，無則提示輸出密碼；

注3：SSH 連接認證失敗可嘗試輸入密碼嘗試三次，認證成功則向本地存儲最近一次連接成功的加密密碼。

 

代碼實現

修改 coco/models.py，添加 password 參數

class Request:
    def __init__(self, addr):
        self.type = []
        self.meta = {"width": 80, "height": 24}
        self.user = None
        self.password = ''     # @ 周旺
        self.addr = addr
        self.remote_ip = self.addr[0]
        self.change_size_event = threading.Event()
        self.date_start = datetime.datetime.now()
    

class Client:
    def __init__(self, chan, request):
        self.chan = chan
        self.request = request
        self.user = request.user
        self.password = request.password    # @ 周旺
        self.addr = request.addr

 

修改 coco/interface.py， 賦值 request.password 

class SSHInterface(paramiko.ServerInterface):
    def validate_auth(self, username, password="", public_key=""):
        info = app_service.authenticate(
            username, password=password, public_key=public_key,
            remote_addr=self.request.remote_ip
        )
        user = info.get('user', None)
        if user:
            self.request.user = user
            self.request.password = password   # request password 賦值 @ 周旺
            self.info = info

        seed = info.get('seed', None)
        token = info.get('token', None)
        if seed and not token:
            self.otp_auth = True

        return user

 

修改 coco/interactive.py 

class InteractiveServer:
    def display_search_result(self):
        sort_by = current_app.config["ASSET_LIST_SORT_BY"]
        self.search_result = sort_assets(self.search_result, sort_by)
        fake_data = [_("ID"), _("Hostname"), _("IP"), _("LoginAs")]
        id_length = max(len(str(len(self.search_result))), 4)
        hostname_length = item_max_length(self.search_result, 15,
                                          key=lambda x: x.hostname)
        sysuser_length = item_max_length(self.search_result,
                                         key=lambda x: x.system_users_name_list)
        size_list = [id_length, hostname_length, 16, sysuser_length]
        header_without_comment = format_with_zh(size_list, *fake_data)
        comment_length = max(
            self.request.meta["width"] -
            size_of_str_with_zh(header_without_comment) - 1,
            2
        )
        size_list.append(comment_length)
        fake_data.append(_("Comment"))
        self.client.send(wr(title(format_with_zh(size_list, *fake_data))))
        for index, asset in enumerate(self.search_result, 1):
            # data = [ # 注釋主機顯示列表 @ 周旺
            # index, asset.hostname, asset.ip,
            # asset.system_users_name_list, asset.comment
            # ]

            data = [                                        # 主機顯示列表 @ 周旺
 index, asset.hostname, asset.ip, 29  self.client.user.username, asset.comment 30  ] 31 
            self.client.send(wr(format_with_zh(size_list, *data)))
        self.client.send(wr(_("總共: {} 匹配: {}").format(
            len(self.assets), len(self.search_result)), before=1)
        )

    def proxy(self, asset):
        # system_user = self.choose_system_user(asset.system_users_granted) # 注釋 @ 周旺
        # if system_user is None:
        # self.client.send(_("沒有系統用戶"))
        # return
        system_user = self.client.user      # 修改系統用戶為登錄用戶 @ 周旺 注： 仍保持system_user 變量名，后面所有 system_user 皆是登錄用戶
        password = self.client.password     # 密碼 @ 周旺 --> by client -> by request
        forwarder = ProxyServer(self.client)
        forwarder.proxy(asset, system_user, password)  # password @ 周旺

 

修改 coco/proxy.py

class ProxyServer:
    def proxy(self, asset, system_user, password=''):  # 添加 password 參數 @ 周旺
        #self.get_system_user_auth(system_user) # 注釋 @ 周旺

        if not password:                                # 添加46-74行 @ 周旺
            with open('/opt/pwd/%s.pwd' % system_user.username, 'ab+') as pwd:    # 查找本地緩存密碼
 pwd.seek(0)  8                 try:  9                     password = base64.b64decode(pwd.read().strip()).decode().strip() 10                     # password = pwd.read().strip()
                except: 12                     password = ''

            if not password: 15                 prompt = "{}@{} password: ".format(system_user.username, asset.ip) 16                 password = net_input(self.client, prompt=prompt, sensitive=True) 17 
        for n in range(4): 19             self.connecting = True 20  self.send_connecting_message(asset, system_user) 21             self.server = self.get_server_conn(asset, system_user, password) 22             if self.server: 23                 with open('/opt/pwd/%s.pwd' % system_user.username, 'wb') as pwd:    # 保存最后一次的正確密碼
                    pwd.write(base64.b64encode(password.encode(encoding='utf-8'))) 25                     #pwd.write(password)
                break

            if n < 3: 29                 prompt = "{}@{} password({}/3): ".format(system_user.username, asset.ip, n+1) 30                 password = net_input(self.client, prompt=prompt, sensitive=True) 31         else: 32             return False 33 

        # self.send_connecting_message(asset, system_user) # 注釋 @ 周旺
        # self.server = self.get_server_conn(asset, system_user, password)

        command_recorder = current_app.new_command_recorder()
        replay_recorder = current_app.new_replay_recorder()
        session = Session(
            self.client, self.server,
            command_recorder=command_recorder,
            replay_recorder=replay_recorder,
        )
        current_app.add_session(session)
        self.watch_win_size_change_async()
        session.bridge()
        self.stop_event.set()
        self.end_watch_win_size_change()
        current_app.remove_session(session)

    def get_server_conn(self, asset, system_user, password=''):  # 添加 password 參數 @ 周旺
        logger.info("Connect to {}".format(asset.hostname))
        # if not self.validate_permission(asset, system_user): # 注釋 @ 周旺
        # self.client.send(warning('No permission'))
        # return None
        # if True:
        # server = self.get_ssh_server_conn(asset, system_user)
        # else:
        # server = self.get_ssh_server_conn(asset, system_user)

        server = self.get_ssh_server_conn(asset, system_user, password) # password @ 周旺 63         return server

    def get_ssh_server_conn(self, asset, system_user, password=''): # 添加 password 參數 @ 周旺
        request = self.client.request
        term = request.meta.get('term', 'xterm')
        width = request.meta.get('width', 80)
        height = request.meta.get('height', 24)
        ssh = SSHConnection()
        chan, sock, msg = ssh.get_channel(
            asset, system_user, term=term, width=width, height=height, password=password)   # password @ 周旺
        if not chan:
            self.client.send(warning(wr(msg, before=1, after=0)))
            server = None
        else:
            server = Server(chan, sock, asset, system_user)
        self.connecting = False
        self.client.send(b'\r\n')
        return server

    def send_connecting_message(self, asset, system_user):
        def func():
            delay = 0.0
            self.client.send('Connecting to {}@{} {:.1f}'.format(
                system_user.username, asset.ip, delay)          # 修改為 用戶名，ip地址 @ 周旺
            )
            while self.connecting and delay < TIMEOUT:
                self.client.send('\x08\x08\x08{:.1f}'.format(delay).encode())
                time.sleep(0.1)
                delay += 0.1
        thread = threading.Thread(target=func)
        thread.start()

 

 修改 coco/connection.py

class SSHConnection:
    def get_ssh_client(self, asset, system_user, password=''):  # 添加 password 參數 @ 周旺
        ssh = paramiko.SSHClient()
        ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
        sock = None

        # if not system_user.password and not system_user.private_key: # 注釋 @ 周旺
        # self.get_system_user_auth(system_user)

        if asset.domain:
            sock = self.get_proxy_sock_v2(asset)
        try:
            ssh.connect(
                asset.ip, port=asset.port, username=system_user.username,
                #password=system_user.password, pkey=system_user.private_key, # 注釋 @ 周旺
                password=password,                                             # password @ 周旺
                timeout=TIMEOUT, compress=True, auth_timeout=TIMEOUT,
                look_for_keys=False, sock=sock
            )
        except (paramiko.AuthenticationException,
                paramiko.BadAuthenticationType,
                SSHException) as e:
            # password_short = "None" # 注釋 @ 周旺 注：感覺沒啥用
            # key_fingerprint = "None"
            # if system_user.password:
            # password_short = system_user.password[:5] + \
            # (len(system_user.password) - 5) * '*'
            # if system_user.private_key:
            # key_fingerprint = get_private_key_fingerprint(
            # system_user.private_key
            # )
            # 33             # logger.error("Connect {}@{}:{} auth failed, password: \
            # {}, key: {}".format(
            # system_user.username, asset.ip, asset.port,
            # password_short, key_fingerprint,
            # ))
            return None, None, str(e)
        except (socket.error, TimeoutError) as e:
            return None, None, str(e)
        return ssh, sock, None

    def get_channel(self, asset, system_user, term="xterm", width=80, height=24, password=''):  # password 參數 @ 周旺
        ssh, sock, msg = self.get_ssh_client(asset, system_user, password) # password @ 周旺
        if ssh:
            chan = ssh.invoke_shell(term, width=width, height=height)
            return chan, sock, None
        else:
            return None, sock, msg

 

效果展示

 

 后記

　　以上僅適用 jumpserver 終端命令行，沒有涉及對jumpserver web 終端及SFTP的修改。

      謝 jumpserver 團隊：http://www.jumpserver.org/