add etcd.mandatory and max_connections_per_user options

Author: cyrilst

cmd/sshproxy/sshproxy.go

@@ -167,7 +167,6 @@ func setEnvironment(environment map[string]string) {
 	}
 }
 
-//
 func usage() {
 	fmt.Fprintf(os.Stderr, "usage: sshproxy [config]\n")
 	flag.PrintDefaults()
@@ -318,6 +317,7 @@ func mainExitCode() int {
 	for k, v := range config.Routes {
 		log.Debugf("config.routes.%s = %+v", k, v)
 	}
+	log.Debugf("config.max_connections_per_user = %d", config.MaxConnectionsPerUser)
 	log.Debugf("config.ssh.exe = %s", config.SSH.Exe)
 	log.Debugf("config.ssh.args = %v", config.SSH.Args)
 
@@ -329,6 +329,24 @@ func mainExitCode() int {
 		log.Errorf("Cannot contact etcd cluster to update state: %v", err)
 	}
 
+	if cli != nil && cli.IsAlive() {
+		if config.MaxConnectionsPerUser > 0 {
+			userConnectionsCount, err := cli.GetUserConnectionsCount(username)
+			if err != nil {
+				log.Fatalf("Getting user connections count: %s", err)
+			}
+			log.Debugf("Number of connections of %s: %d", username, userConnectionsCount)
+			if userConnectionsCount >= config.MaxConnectionsPerUser {
+				fmt.Fprintln(os.Stderr, "Too many simultaneous connections")
+				log.Fatalf("Max connections per user reached for %s", username)
+			}
+		}
+	} else {
+		if config.Etcd.Mandatory {
+			log.Fatal("Etcd is mandatory but unavailable")
+		}
+	}
+
 	service, hostport, forceCommand, commandMustMatch, etcdKeyTTL, environment, err := findDestination(cli, username, config.Routes, sshInfos.Dst(), config.CheckInterval)
 	switch {
 	case err != nil:

config/sshproxy.yaml

@@ -91,6 +91,8 @@
 # - password: password if basic authentication is enabled.
 # - keyttl: time to live in second for a connection stored in etcd after it has
 #   ended. Default is 5 seconds.
+# - mandatory: if true, connections will be allowed only if etcd is available.
+#   Default is false.
 #etcd:
 #    endpoints:
 #        - "host1:port1"
@@ -102,6 +104,7 @@
 #    username: ""
 #    password: ""
 #    keyttl: 5
+#    mandatory: false
 
 # Environment.
 # Environment variables can be set if needed. The '{user}' pattern will be
@@ -114,6 +117,11 @@
 #    exe: ssh
 #    args: ["-q", "-Y"]
 
+# Maximum number of connections allowed per user.  Connections are counted in
+# the etcd database. If set to 0, there is no limit number of connections per
+# user. Default is 0.
+#max_connections_per_user: 0
+
 # Routes definition.
 # The key is the service name (only used for display). The special service name
 # "default" can be used to define a default route and does not need the source

doc/sshproxy.yaml.txt

@@ -99,6 +99,11 @@ It can also be a network address where to send dumps if specified as
 	suffix such as 'h', 'm' and 's' (e.g. '2m30s'). These statistics are
 	only available when the 'dump' option is set.
 
+*max_connections_per_user*::
+	an integer setting the maximum number of connections allowed per user.
+	Connections are counted in the etcd database. If set to 0, there is no
+	limit number of connections per user. Default is 0.
+
 Commands can be translated between what is received by sshproxy and what is
 executed by the ssh forked by sshproxy. *translate_commands* is an associative
 array whose keys are strings containing the exact user command.  *ssh_args*
@@ -150,6 +155,10 @@ etcd configuration is provided in an associative array *etcd* whose keys are:
 	is up. It will be removed from etcd after this number of seconds.
 	Default is 5 seconds.
 
+*mandatory*::
+	a boolean. If true, connections will be allowed only if etcd is
+	available.  Default is false.
+
 For example, we can have the following:
 
 	etcd:
@@ -161,6 +170,7 @@ For example, we can have the following:
 	        certfile: "/etc/sshproxy/sshproxy.pem"
 	    username: "sshproxy"
 	    password: "sshproxypassword"
+	    mandatory: true
 
 An associative array *environment* can be used to set environment variables.
 The pattern '\{user}' will be replaced with the user login:

pkg/record/record.go

@@ -18,16 +18,17 @@
 // - data.
 //
 // A file record has a header with the following fields:
-// - an unsigned 16 bits integer for the version number,
-// - an unsigned 16 bits integer indicating the header size (from byte 0 to the
-//   start of the first record),
-// - an unsigned 128 bits integer for the source IP address,
-// - an unsigned 16 bits integer for the source port,
-// - an unsigned 128 bits integer for the destination IP address,
-// - an unsigned 16 bits integer for the destination port,
-// - an unsigned 64 bits integer for the start of connection (in ns),
-// - a NULL terminated string with the user name,
-// - a NULL terminated string with the command run by the user (can be empty
+//   - an unsigned 16 bits integer for the version number,
+//   - an unsigned 16 bits integer indicating the header size (from byte 0 to the
+//     start of the first record),
+//   - an unsigned 128 bits integer for the source IP address,
+//   - an unsigned 16 bits integer for the source port,
+//   - an unsigned 128 bits integer for the destination IP address,
+//   - an unsigned 16 bits integer for the destination port,
+//   - an unsigned 64 bits integer for the start of connection (in ns),
+//   - a NULL terminated string with the user name,
+//   - a NULL terminated string with the command run by the user (can be empty
+//
 // with only its NULL end).
 //
 // All integers are big endian.

pkg/utils/config.go

@@ -29,23 +29,24 @@ var (
 
 // Config represents the configuration for sshproxy.
 type Config struct {
-	Debug             bool
-	Log               string
-	CheckInterval     Duration `yaml:"check_interval"`
-	ErrorBanner       string   `yaml:"error_banner"`
-	Dump              string
-	DumpLimitSize     uint64   `yaml:"dump_limit_size"`
-	DumpLimitWindow   Duration `yaml:"dump_limit_window"`
-	Etcd              etcdConfig
-	EtcdStatsInterval Duration `yaml:"etcd_stats_interval"`
-	LogStatsInterval  Duration `yaml:"log_stats_interval"`
-	BgCommand         string   `yaml:"bg_command"`
-	SSH               sshConfig
-	TranslateCommands map[string]*TranslateCommandConfig `yaml:"translate_commands"`
-	Environment       map[string]string
-	Routes            map[string]*RouteConfig
-	Users             []map[string]subConfig
-	Groups            []map[string]subConfig
+	Debug                 bool
+	Log                   string
+	CheckInterval         Duration `yaml:"check_interval"`
+	ErrorBanner           string   `yaml:"error_banner"`
+	Dump                  string
+	DumpLimitSize         uint64   `yaml:"dump_limit_size"`
+	DumpLimitWindow       Duration `yaml:"dump_limit_window"`
+	Etcd                  etcdConfig
+	EtcdStatsInterval     Duration `yaml:"etcd_stats_interval"`
+	LogStatsInterval      Duration `yaml:"log_stats_interval"`
+	BgCommand             string   `yaml:"bg_command"`
+	SSH                   sshConfig
+	TranslateCommands     map[string]*TranslateCommandConfig `yaml:"translate_commands"`
+	Environment           map[string]string
+	Routes                map[string]*RouteConfig
+	MaxConnectionsPerUser int `yaml:"max_connections_per_user"`
+	Users                 []map[string]subConfig
+	Groups                []map[string]subConfig
 }
 
 // TranslateCommandConfig represents the configuration of a translate_command.
@@ -82,6 +83,7 @@ type etcdConfig struct {
 	Username  string
 	Password  string
 	KeyTTL    int64
+	Mandatory bool
 }
 
 type etcdTLSConfig struct {
@@ -93,19 +95,20 @@ type etcdTLSConfig struct {
 // We use interface{} instead of real type to check if the option was specified
 // or not.
 type subConfig struct {
-	Debug             interface{}
-	Log               interface{}
-	ErrorBanner       interface{} `yaml:"error_banner"`
-	Dump              interface{}
-	DumpLimitSize     interface{}                        `yaml:"dump_limit_size"`
-	DumpLimitWindow   interface{}                        `yaml:"dump_limit_window"`
-	EtcdStatsInterval interface{}                        `yaml:"etcd_stats_interval"`
-	LogStatsInterval  interface{}                        `yaml:"log_stats_interval"`
-	BgCommand         interface{}                        `yaml:"bg_command"`
-	TranslateCommands map[string]*TranslateCommandConfig `yaml:"translate_commands"`
-	Environment       map[string]string
-	Routes            map[string]*RouteConfig
-	SSH               sshConfig
+	Debug                 interface{}
+	Log                   interface{}
+	ErrorBanner           interface{} `yaml:"error_banner"`
+	Dump                  interface{}
+	DumpLimitSize         interface{}                        `yaml:"dump_limit_size"`
+	DumpLimitWindow       interface{}                        `yaml:"dump_limit_window"`
+	EtcdStatsInterval     interface{}                        `yaml:"etcd_stats_interval"`
+	LogStatsInterval      interface{}                        `yaml:"log_stats_interval"`
+	BgCommand             interface{}                        `yaml:"bg_command"`
+	TranslateCommands     map[string]*TranslateCommandConfig `yaml:"translate_commands"`
+	Environment           map[string]string
+	Routes                map[string]*RouteConfig
+	MaxConnectionsPerUser interface{} `yaml:"max_connections_per_user"`
+	SSH                   sshConfig
 }
 
 func parseSubConfig(config *Config, subconfig *subConfig) error {
@@ -170,6 +173,10 @@ func parseSubConfig(config *Config, subconfig *subConfig) error {
 		config.Routes[service] = opts
 	}
 
+	if subconfig.MaxConnectionsPerUser != nil {
+		config.MaxConnectionsPerUser = subconfig.MaxConnectionsPerUser.(int)
+	}
+
 	// merge translate_commands
 	for k, v := range subconfig.TranslateCommands {
 		config.TranslateCommands[k] = v

pkg/utils/etcd.go

@@ -32,9 +32,10 @@ import (
 type State int
 
 // These are the possible states of an host:
-//   Up: host is up,
-//   Down: host is down,
-//   Disabled: host was disabled by an admin.
+//
+//	Up: host is up,
+//	Down: host is down,
+//	Disabled: host was disabled by an admin.
 const (
 	Unknown State = iota
 	Up
@@ -529,6 +530,35 @@ func (c *Client) GetAllConnections() ([]*FlatConnection, error) {
 	return conns, nil
 }
 
+// GetUserConnectionsCount returns the number of active connections of a user, based on etcd.
+func (c *Client) GetUserConnectionsCount(username string) (int, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), c.requestTimeout)
+	resp, err := c.cli.Get(ctx, etcdConnectionsPath, clientv3.WithPrefix(), clientv3.WithSort(clientv3.SortByKey, clientv3.SortAscend))
+	cancel()
+	if err != nil {
+		return 0, err
+	}
+
+	count := 0
+	for _, ev := range resp.Kvs {
+		subkey := string(ev.Key)[len(etcdConnectionsPath)+1:]
+		fields := strings.Split(subkey, "/")
+		if len(fields) != 4 {
+			return 0, fmt.Errorf("bad key format %s", subkey)
+		}
+
+		subfields := strings.Split(fields[0], "@")
+		if len(subfields) != 2 {
+			return 0, fmt.Errorf("bad subkey format %s", fields[0])
+		}
+		if subfields[0] == username {
+			count++
+		}
+	}
+
+	return count, nil
+}
+
 // FlatHost is a structure used to flatten a host informations present in etcd.
 type FlatHost struct {
 	Hostname string
@@ -539,7 +569,7 @@ type FlatHost struct {
 	*Host
 }
 
-// GetUserHosts returns a list of hosts used by a user, based on etcd.
+// GetUserHosts returns a list of hosts used by a user@service, based on etcd.
 func (c *Client) GetUserHosts(key string) (map[string]*FlatHost, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), c.requestTimeout)
 	resp, err := c.cli.Get(ctx, etcdConnectionsPath, clientv3.WithPrefix(), clientv3.WithSort(clientv3.SortByKey, clientv3.SortAscend))

pkg/utils/route.go

@@ -20,7 +20,7 @@ import (
 	"github.com/op/go-logging"
 )
 
-var mylog = logging.MustGetLogger("sshproxy/route")
+var mylog = logging.MustGetLogger("sshproxy")
 
 type selectDestinationFunc func([]string, HostChecker, *Client, string) (string, error)
 

test/centos-image/etcd/ca-key.pem

@@ -1,27 +1,27 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIIEpQIBAAKCAQEArhn0BdvFSr82bez8E7351GfniSt8Kq3VVbpk+83L5wTFgAZT
-2vrdU+a9+K3xiZeGkrs7Rm0QTlwHZ/BxnwotpW1m6wABhkdPNC2JSccZOrxuMCA5
-mw7EKTtfe3QuKzVy17090OHLuzzmJHETFAavldm1nhaBLImxb/uDni3spr20QW6p
-42lc7m3ZpUv9m54/FlBzP601sTfp2j43+s3qoU+zuTJ0aeLM96fyykEBA6nC9wLf
-YUlEny6jg/RHTquZ05tzyexUH0ZS1fGSEZHQhAhmRCW5IV5xsbHfWnQgYoyO9ART
-in74e01u7QRPxKOlWNbH6fTq5kHIbIxPKkyckwIDAQABAoIBAQCUN1IQXr3CWbDL
-upILeJMkqeRqWZPWfbD9z7ZCzDvHi79bs4dWCHW+BNU7zVGwskgFyNG4rgbQvvYr
-HX6NR8v+ZnnUnGev2itqn02eeppW763a2MRR5itHct1hq1HWxSTk1521o1SfLUQ8
-R+tXBC4dI3/DeyMzOHHPhM7TLgOnGrdnq6kaNSCEvHekkxujyd/T3DF1/EFzwkJi
-af/3zRn4/KYLiKg68Eu3Paxd58yflwL/eiobxAd/XL6Vra/8vSoJrbY2wTC1dRm/
-rcT9otkzvXnje3l9tBL1rOZvP5Pwj7czzmoMiHEnHz01gHitweA7yM0fMXM6V0dN
-8fCL8nyBAoGBAN1+GZYzer8c4NZm+97wL69VMUJwmdzyXiSUzdfoXY5T3eM50dAS
-0t5kUI+uTJvdRUcqKrVHd862LfY1eCsAdOahjjucRnE7y5eB7us+Jw2kAdbfLYmY
-zNwXda7Hr8oSEZD08ZAc6SSsFaXIBZHHNG3l0cCyT+iYY1+iPW9e2yhBAoGBAMk5
-ueq+4nVgiyAGs+zrEN5PDxkDPzIl3ay2CnX3/uZgPFwMSc5+11XzElx4w2SuH5KN
-P6Jw2/wyXrBQizLftMo5sUTER0MsR5kJGj8mOqE4nXlVaJjEcc+zqiQL2+ut+G9r
-QWjc2MvecxbRZWbljvo7iWPPow1rD/hcJPPRpq/TAoGAElWq5o0SXxmT3wudU+IM
-AHaL4lUR14FUm7CZrYK1o997YaDapl+4huJE7O/ftZNGddKewGzPFRRtj5DzhpO+
-GY1MCdEw35S0kLEXxu9ZKj7mTBQjX91/L8TdX/91pMOEIryz9lr+TaPVEukQ1PVp
-eKNqjon0JWvf5f23Gi3+9EECgYEAkSXDlrGUFkjKchKDrIyuwTzTzh4KcrjfmppB
-F3EIe9LFFzyB7KKP316TSwKNJs121rZuRVUVSWhn5tRiZBL7jLdqyAiwwqJpDtmD
-BjQkLHDzHjdeWHuzALg/LPsk6m61+mCqcOKEuyG9cKMgesVxicxyQP3gRmiIv4Rv
-3zPGAaMCgYEAtmQX1I8IgKlr8FrscwjyUSUYW85dLL77LBzYEwJMmmMP6XFMJoxt
-mR/UcG/On1PSPq0mZljtQiXoz7vhwBwPuvKgDyh1oJ6kaBILxKiYpECv1ncyR7an
-g+uLOVccnb5X7/kEDdgaDxhpYxj/QZITdL24fs5BJvOJpYuF3nLkaJk=
+MIIEowIBAAKCAQEA10QIT3hacop0YnAxwo/vWdIM+FVHDw7IzI5KoGtMIkW0Z7Yy
+adHru/fnNPFmgKWB4Uoc6RBdVoxj2RxevWELsDbWx6M+yz9NJBsQBvhfFHVF+F36
+Y/0FYqGd4kSDsXepeuQwfG3u68HfDmuwceQuRYndUICyV2TJd/d5boTCmQodvHiu
+gMg7xKhsp4D2Ty7MwI5134JJc6HgxEj17JXNOyYHSNi3+oi9YBbgJnkSvDK4CYWV
+yTJg9Q0cmzy16t7wq31/1xClTPFtPBKyD1lQ60QAfAyYVTskox98n8wJexaFWIcW
+VpSbIzra8lyEpPtI6dtJ26XtrLC7Ftd0lbAtvwIDAQABAoIBAQDEo3bb8Vrd6q/q
+BAbQbd78s635YxzoGl8+zHRLGfiQDhB/9KUUmRe3uvrPF/zEY2vDOooyNCqvFstW
+1l2MrQuaSl3kO7DuxMJYywfW9icUbxQdjutdTxIOSQgKWv/Zqy97/Np1r45iedSi
+PakOQJwsFYW/NfCzeHO5TKz2UfvZAwHIpoLUXGzor44ImKU50hMCJ0hVJ5rxlNrH
+PwFo3T91DITj0B9UFoi0pc7jeZcLmPkwk3HNhOb3qD/+BImuZszQQHxXAiXa2zky
+hgQ4GFPQMAN7acWWQSE6ePjlkff+XX8TGNi7oTYls0MT/DblL9rfPEh0Fr8Wx7yw
+0vw0xFSBAoGBAOtoAFiizq4JGsSnElAEXe1Ro4v3NOka69Mz8ZcOg5RYihJzXk2z
+IYAGl6/VCgxbZZEX1m1MDxPT+9N59ubWZXIntAQG9Roy5kdLxHI6yR+SAN74t5ee
+1910UkeO3Mcklu/ZK6j2q2NQo0A1k7UQDMKhQia67sdYXZsMTCBBCEBhAoGBAOoY
++mLNngDCE62pqjWhCTZx28G3uYV+RAfILlmtO+WXfkeaWdNT2zCtqu2JA4+1Qa8p
+Hk3Q6h4dMlVxv7MRFfSt5MfNr2cXeSQMuF+RY92rYikZ+lEqQvx80OeWW4AnSFZw
+F2SzUIhMEKBpMioe0cVg97p8t6Y3SSEvUAON06IfAoGAfWGFXbBJWNSslzVNQaUx
+yecDrtbaLZYTKQivkn8+gdKup6ke/097dk8Ml7Bmi7JaZG9H3Cr4lN0Bcd+yK7zh
+h22yKbry7SNTF4I5fYXl/ZSsNhZO4sjNvLvp3wcufDr20YTgBjxriJg4e0iOBZAo
+27k8HJjP+QkNwjlIip1YocECgYAXxnGnlzp02UEmYhTnXXOSE/49rmspI6nFII+U
+jAOJTdmFbCezTtD0IK87cK7r6XzCTWrGfHFKnax/AQ53IUUZlI+nuzwVPE0RXDld
+e2apHL7bbcf+dkxXWFXfL2YbneG65ad6krubHB6ULBrsLDUh1rdSOVhtiS/kLunx
+cnYMAQKBgAh21WUGlxSYSCR6AO5nj7tmOsrohy4MkYQGK4LZ9FjKJA97M37hXaG2
+Bej7B+Smng1lLzXlpCBWpvoKlHcYT7R/aSg2SpV7lIeKqi526Qmne0gjbJRdNGJA
+p2xSAxrYL8KFvIlDX380SOFo2Ak2PbmFE9RukMuTN6k/g73fvLdY
 -----END RSA PRIVATE KEY-----

test/centos-image/etcd/ca.csr

@@ -1,16 +1,16 @@
 -----BEGIN CERTIFICATE REQUEST-----
 MIICeTCCAWECAQAwEjEQMA4GA1UEAxMHRXRjZCBDQTCCASIwDQYJKoZIhvcNAQEB
-BQADggEPADCCAQoCggEBAK4Z9AXbxUq/Nm3s/BO9+dRn54krfCqt1VW6ZPvNy+cE
-xYAGU9r63VPmvfit8YmXhpK7O0ZtEE5cB2fwcZ8KLaVtZusAAYZHTzQtiUnHGTq8
-bjAgOZsOxCk7X3t0Lis1cte9PdDhy7s85iRxExQGr5XZtZ4WgSyJsW/7g54t7Ka9
-tEFuqeNpXO5t2aVL/ZuePxZQcz+tNbE36do+N/rN6qFPs7kydGnizPen8spBAQOp
-wvcC32FJRJ8uo4P0R06rmdObc8nsVB9GUtXxkhGR0IQIZkQluSFecbGx31p0IGKM
-jvQEU4p++HtNbu0ET8SjpVjWx+n06uZByGyMTypMnJMCAwEAAaAiMCAGCSqGSIb3
-DQEJDjETMBEwDwYDVR0RBAgwBocEfwAAATANBgkqhkiG9w0BAQsFAAOCAQEAHyYl
-oibnkfrbmWV5AZ86RAv62RFQ2ZAY4gqsfAg9fAZAvAEXqz+xGyakPUuB/ab5BA75
-6/4Mpa4YTyVPnyRAEfswSa/p+rGbVcVCdLOXNCM+K9BOoRAB4uPqRb4ZDpFhAK1C
-ESYZpYqrSANQjejkr0Zfq1ZDIfQjfYlmUA0kM6h4CAoAlHhMgbpm4kCn6rfE0xbS
-IxONzEt9MwqRDXGQl1pHgiqxZ2LQcdQ1lxaDSg7yZPhjmo6LHueYBWRVUgW3mwxm
-Ga6P8RLEsrb/H5kp+q63P3X0Osv8II5uV2jpTb5vy0ucRAU84a+MJumVIn3O9HtH
-jkwpB7lj/U3NtvQw3Q==
+BQADggEPADCCAQoCggEBANdECE94WnKKdGJwMcKP71nSDPhVRw8OyMyOSqBrTCJF
+tGe2MmnR67v35zTxZoClgeFKHOkQXVaMY9kcXr1hC7A21sejPss/TSQbEAb4XxR1
+Rfhd+mP9BWKhneJEg7F3qXrkMHxt7uvB3w5rsHHkLkWJ3VCAsldkyXf3eW6EwpkK
+Hbx4roDIO8SobKeA9k8uzMCOdd+CSXOh4MRI9eyVzTsmB0jYt/qIvWAW4CZ5Erwy
+uAmFlckyYPUNHJs8tere8Kt9f9cQpUzxbTwSsg9ZUOtEAHwMmFU7JKMffJ/MCXsW
+hViHFlaUmyM62vJchKT7SOnbSdul7aywuxbXdJWwLb8CAwEAAaAiMCAGCSqGSIb3
+DQEJDjETMBEwDwYDVR0RBAgwBocEfwAAATANBgkqhkiG9w0BAQsFAAOCAQEArIfh
+ZksIKHFa7RYSR7Qr6OvD3UL6yRh5xx4BcNXGIWX/bM1THr5VFTLCyWnvMfXbx264
+EYJ9VyJPiFXer0VyWKWfcIYcGJAY8lEQhcAWkMb3Q+u0mX8otYt/ChqeSQIIWOJ5
+6Bi0FzvYxsneTPMXdTD6ZdHKrqVn8xUz6cbFhedyBwhxykvY/0vNov7Ad2+Sa2uK
+au+7r4iWQpaiETmCAAEVif72MXIqdPRYoUwm+rQuTgR9bZBwfcng1szKF7wf57lm
+s84nHgmB/CJ8p5tigqKDYRQB7HX3UI9KdKCB7xElg0tdwnD4rlRh+y+rWW7JFlwi
+BP6ku04mE8t3piEGbw==
 -----END CERTIFICATE REQUEST-----