console1984 0.1.22 → 0.1.23
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/README.md +16 -15
- data/lib/console1984/config.rb +2 -1
- data/lib/console1984/errors.rb +3 -0
- data/lib/console1984/shield/modes.rb +1 -1
- data/lib/console1984/supervisor.rb +10 -2
- data/lib/console1984/version.rb +1 -1
- metadata +2 -2
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 47d1011d6928811fe965c9935f1ef24d391b406525a2a1155b68f65afceafd78
|
|
4
|
+
data.tar.gz: 81612351e4688ecb94c7a8b27d10dd7b25425cadb8d7f0738214b876335eb603
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: bdeb41585ec87acae2328f61f2077236ef559940084200f1c59c6655cb10f5e4e6e956aa8a34a6792a3512f2ba744c450c2411f948a1ae89d63171fb74331684
|
|
7
|
+
data.tar.gz: ab6095d0ae6f62f77bd76ed146bef36016e1485de710f0c646d211ad8d6645d7be96c00d678483d24fb1039c4d6ef049e3209cd9646598e6114028d97007fa03
|
data/README.md
CHANGED
|
@@ -14,7 +14,7 @@ If you are looking for the auditing tool, check [`audits1984`](https://github.co
|
|
|
14
14
|
|
|
15
15
|
## Installation
|
|
16
16
|
|
|
17
|
-
**Important:** `console1984` depends on [Active Record encryption](https://
|
|
17
|
+
**Important:** `console1984` depends on [Active Record encryption](https://guides.rubyonrails.org/active_record_encryption.html) which is a Rails 7 feature.
|
|
18
18
|
|
|
19
19
|
Add it to your `Gemfile`:
|
|
20
20
|
|
|
@@ -35,7 +35,7 @@ By default, console1984 is only enabled in `production`. You can configure the t
|
|
|
35
35
|
config.console1984.protected_environments = %i[ production staging ]
|
|
36
36
|
```
|
|
37
37
|
|
|
38
|
-
Finally, you need to [configure Active Record Encryption](https://
|
|
38
|
+
Finally, you need to [configure Active Record Encryption](https://guides.rubyonrails.org/active_record_encryption.html#setup) in your
|
|
39
39
|
project. This is because the library stores the tracked console commands encrypted.
|
|
40
40
|
|
|
41
41
|
## How it works
|
|
@@ -66,7 +66,7 @@ Check out [`audits1984`](https://github.com/basecamp/audits1984), a companion au
|
|
|
66
66
|
|
|
67
67
|
### Access to encrypted data
|
|
68
68
|
|
|
69
|
-
By default, `console1984` won't decrypt data encrypted with [Active Record encryption](https://
|
|
69
|
+
By default, `console1984` won't decrypt data encrypted with [Active Record encryption](https://guides.rubyonrails.org/active_record_encryption.html). Users will just see the ciphertexts.
|
|
70
70
|
|
|
71
71
|
To decrypt data, enter the command `decrypt!`. It will ask for a justification, and these accesses will be flagged internally as sensitive.
|
|
72
72
|
|
|
@@ -127,7 +127,7 @@ In the default protected mode, trying to read data from a protected system will
|
|
|
127
127
|
irb(main)> Rails.cache.read("some key") # raises Console1984::Errors::ProtectedConnection
|
|
128
128
|
```
|
|
129
129
|
|
|
130
|
-
Running `decrypt!` will switch you to unprotected mode and let you access these systems normally. The system will ask for a
|
|
130
|
+
Running `decrypt!` will switch you to unprotected mode and let you access these systems normally. The system will ask for a justification and will flag those accesses as sensitive.
|
|
131
131
|
|
|
132
132
|
This will work for systems that use Ruby sockets as the underlying communication mechanism.
|
|
133
133
|
|
|
@@ -143,18 +143,19 @@ When starting a console session, `console1984` will eager load all the applicati
|
|
|
143
143
|
|
|
144
144
|
These config options are namespaced in `config.console1984`:
|
|
145
145
|
|
|
146
|
-
| Name | Description
|
|
147
|
-
|
|
148
|
-
| `protected_environments` | The list of environments where `console1984` will act on. Defaults to `%i[ production ]`.
|
|
149
|
-
| `protected_urls` | The list of URLs corresponding with external systems to protect.
|
|
150
|
-
| `session_logger` | The system used to record session data. The default logger is `Console1984::SessionsLogger::Database`.
|
|
146
|
+
| Name | Description |
|
|
147
|
+
|---------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
|
148
|
+
| `protected_environments` | The list of environments where `console1984` will act on. Defaults to `%i[ production ]`. |
|
|
149
|
+
| `protected_urls` | The list of URLs corresponding with external systems to protect. |
|
|
150
|
+
| `session_logger` | The system used to record session data. The default logger is `Console1984::SessionsLogger::Database`. |
|
|
151
151
|
| `username_resolver` | Configure how the current user is determined for a given console session. The default is `Console1984::Username::EnvResolver.new("CONSOLE_USER")`, which returns the value of the environment variable `CONSOLE_USER`. |
|
|
152
|
-
| `
|
|
153
|
-
| `
|
|
154
|
-
| `
|
|
155
|
-
| `
|
|
156
|
-
| `
|
|
157
|
-
| `
|
|
152
|
+
| `ask_for_username_if_empty` | If `true`, the console will ask for a username if it is empty. If `false`, it will raise an error if no username is set. Defaults to `false`. |
|
|
153
|
+
| `production_data_warning` | The text to show when a console session starts. |
|
|
154
|
+
| `enter_unprotected_encryption_mode_warning` | The text to show when user enters into unprotected mode. |
|
|
155
|
+
| `enter_protected_mode_warning` | The text to show when user go backs to protected mode. |
|
|
156
|
+
| `incinerate` | Whether incinerate sessions automatically after a period of time or not. Default to `true`. |
|
|
157
|
+
| `incinerate_after` | The period to keep sessions around before incinerate them. Default `30.days`. |
|
|
158
|
+
| `incineration_queue` | The name of the queue for session incineration jobs. Default `console1984_incineration`. |
|
|
158
159
|
|
|
159
160
|
### SSH Config
|
|
160
161
|
|
data/lib/console1984/config.rb
CHANGED
|
@@ -7,7 +7,7 @@ class Console1984::Config
|
|
|
7
7
|
PROTECTIONS_CONFIG_FILE_PATH = Console1984::Engine.root.join("config/protections.yml")
|
|
8
8
|
|
|
9
9
|
PROPERTIES = %i[
|
|
10
|
-
session_logger username_resolver shield command_executor
|
|
10
|
+
session_logger username_resolver ask_for_username_if_empty shield command_executor
|
|
11
11
|
protected_environments protected_urls
|
|
12
12
|
production_data_warning enter_unprotected_encryption_mode_warning enter_protected_mode_warning
|
|
13
13
|
incinerate incinerate_after incineration_queue
|
|
@@ -54,6 +54,7 @@ class Console1984::Config
|
|
|
54
54
|
self.incinerate = true
|
|
55
55
|
self.incinerate_after = 30.days
|
|
56
56
|
self.incineration_queue = "console1984_incineration"
|
|
57
|
+
self.ask_for_username_if_empty = false
|
|
57
58
|
|
|
58
59
|
self.debug = false
|
|
59
60
|
self.test_mode = false
|
data/lib/console1984/errors.rb
CHANGED
|
@@ -23,5 +23,8 @@ module Console1984
|
|
|
23
23
|
# Attempt to incinerate a session ahead of time as determined by
|
|
24
24
|
# +config.console1984.incinerate_after+.
|
|
25
25
|
class ForbiddenIncineration < StandardError; end
|
|
26
|
+
|
|
27
|
+
# The console username is not set. Only raised when `config.ask_for_username_if_empty = false`.
|
|
28
|
+
class MissingUsername < StandardError; end
|
|
26
29
|
end
|
|
27
30
|
end
|
|
@@ -35,6 +35,10 @@ class Console1984::Supervisor
|
|
|
35
35
|
IRB.CurrentContext.exit
|
|
36
36
|
end
|
|
37
37
|
|
|
38
|
+
def current_username
|
|
39
|
+
@current_username ||= username_resolver.current.presence || handle_empty_username
|
|
40
|
+
end
|
|
41
|
+
|
|
38
42
|
private
|
|
39
43
|
def require_dependencies
|
|
40
44
|
Kernel.silence_warnings do
|
|
@@ -61,7 +65,11 @@ class Console1984::Supervisor
|
|
|
61
65
|
session_logger.finish_session
|
|
62
66
|
end
|
|
63
67
|
|
|
64
|
-
def
|
|
65
|
-
|
|
68
|
+
def handle_empty_username
|
|
69
|
+
if Console1984.config.ask_for_username_if_empty
|
|
70
|
+
ask_for_value "Please, enter your name:"
|
|
71
|
+
else
|
|
72
|
+
raise Console1984::Errors::MissingUsername
|
|
73
|
+
end
|
|
66
74
|
end
|
|
67
75
|
end
|
data/lib/console1984/version.rb
CHANGED
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: console1984
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.1.
|
|
4
|
+
version: 0.1.23
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Jorge Manrubia
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date:
|
|
11
|
+
date: 2022-04-01 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: colorize
|