@p0security/cli 0.6.0 → 0.6.1

package/dist/commands/scp.js

@@ -58,6 +58,10 @@ const scpCommand = (yargs) => yargs.command("scp <source> <destination>",
     .option("sudo", {
     type: "boolean",
     describe: "Add user to sudoers file",
+})
+    .option("debug", {
+    type: "boolean",
+    describe: "Print debug information, dangerous for sensitive data",
 }), (0, firestore_1.guard)(scpAction));
 exports.scpCommand = scpCommand;
 /** Transfers files between a local and remote hosts using SSH.

package/dist/commands/shared.d.ts

@@ -22,6 +22,7 @@ export declare type ScpCommandArgs = BaseSshCommandArgs & {
     source: string;
     destination: string;
     recursive?: boolean;
+    debug?: boolean;
 };
 export declare type SshCommandArgs = BaseSshCommandArgs & {
     sudo?: boolean;

package/dist/plugins/aws/ssm/index.d.ts

@@ -12,4 +12,4 @@ import { ExerciseGrantResponse, ScpCommandArgs, SshCommandArgs } from "../../../
 import { Authn } from "../../../types/identity";
 /** Connect to an SSH backend using AWS Systems Manager (SSM) */
 export declare const ssm: (authn: Authn, request: ExerciseGrantResponse, args: SshCommandArgs) => Promise<void>;
-export declare const scp: (authn: Authn, data: ExerciseGrantResponse, args: ScpCommandArgs, privateKey: string) => Promise<void>;
+export declare const scp: (authn: Authn, data: ExerciseGrantResponse, args: ScpCommandArgs, privateKey: string) => Promise<number | null>;

package/dist/plugins/aws/ssm/index.js

@@ -16,6 +16,7 @@ exports.scp = exports.ssm = void 0;
 const stdio_1 = require("../../../drivers/stdio");
 const aws_1 = require("../../okta/aws");
 const install_1 = require("./install");
+const lodash_1 = require("lodash");
 const node_child_process_1 = require("node:child_process");
 const node_stream_1 = require("node:stream");
 const ps_tree_1 = __importDefault(require("ps-tree"));
@@ -138,54 +139,39 @@ function spawnChildProcess(credential, command, args, stdio) {
  *
  * Requires `aws ssm` to be installed on the client machine.
  */
-const spawnSsmNode = (options) => __awaiter(void 0, void 0, void 0, function* () {
-    return new Promise((resolve, reject) => {
-        const child = spawnChildProcess(options.credential, options.command, options.args, ["inherit", "inherit", "pipe"]);
-        const { isAccessPropagated } = accessPropagationGuard(child);
-        const exitListener = child.on("exit", (code) => {
+function spawnSsmNode(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        return new Promise((resolve, reject) => {
             var _a, _b;
-            exitListener.unref();
-            // In the case of ephemeral AccessDenied exceptions due to unpropagated
-            // permissions, continually retry access until success
-            if (!isAccessPropagated()) {
-                const attemptsRemaining = (_a = options === null || options === void 0 ? void 0 : options.attemptsRemaining) !== null && _a !== void 0 ? _a : MAX_SSM_RETRIES;
-                if (attemptsRemaining <= 0) {
-                    reject("Access did not propagate through AWS before max retry attempts were exceeded. Please contact support@p0.dev for assistance.");
+            const child = spawnChildProcess(options.credential, options.command, options.args, options.stdio);
+            // optionally buffer content into stdin for the child process
+            for (const command of (_a = options.writeStdin) !== null && _a !== void 0 ? _a : []) {
+                (_b = child.stdin) === null || _b === void 0 ? void 0 : _b.write(`${command}\n`);
+            }
+            const { isAccessPropagated } = accessPropagationGuard(child);
+            const exitListener = child.on("exit", (code) => {
+                var _a, _b;
+                exitListener.unref();
+                // In the case of ephemeral AccessDenied exceptions due to unpropagated
+                // permissions, continually retry access until success
+                if (!isAccessPropagated()) {
+                    const attemptsRemaining = (_a = options === null || options === void 0 ? void 0 : options.attemptsRemaining) !== null && _a !== void 0 ? _a : MAX_SSM_RETRIES;
+                    if (attemptsRemaining <= 0) {
+                        reject("Access did not propagate through AWS before max retry attempts were exceeded. Please contact support@p0.dev for assistance.");
+                        return;
+                    }
+                    spawnSsmNode(Object.assign(Object.assign({}, options), { attemptsRemaining: attemptsRemaining - 1 }))
+                        .then((code) => resolve(code))
+                        .catch(reject);
                     return;
                 }
-                spawnSsmNode(Object.assign(Object.assign({}, options), { attemptsRemaining: attemptsRemaining - 1 }))
-                    .then((code) => resolve(code))
-                    .catch(reject);
-                return;
-            }
-            (_b = options.abortController) === null || _b === void 0 ? void 0 : _b.abort(code);
-            (0, stdio_1.print2)(`SSH session terminated`);
-            resolve(code);
+                (_b = options.abortController) === null || _b === void 0 ? void 0 : _b.abort(code);
+                (0, stdio_1.print2)(`SSH session terminated`);
+                resolve(code);
+            });
         });
     });
-});
-/**
- * Spawns a child process to add a private key to the ssh-agent. The SSH agent is included in the OpenSSH suite of tools
- * and is used to hold private keys during a session. The SSH agent typically does not persist keys across system reboots
- * or logout/login cycles. Once you log out or restart your system, any keys added to the SSH agent during that session
- * will need to be added again in subsequent sessions.
- */
-const executeScpCommand = (credential, command, privateKey) => __awaiter(void 0, void 0, void 0, function* () {
-    // Execute should not leave any ssh-agent processes running after it's done performing an SCP transaction.
-    const execute = `
-  eval $(ssh-agent) >/dev/null 2>&1
-  trap 'kill $SSH_AGENT_PID' EXIT
-  ssh-add -q - <<< '${privateKey}' 
-  ${command}
-  SCP_EXIT_CODE=$? 
-  exit $SCP_EXIT_CODE
-  `;
-    return spawnSsmNode({
-        credential,
-        command: "bash",
-        args: ["-c", execute],
-    });
-});
+}
 /**
  * A subprocess SSM session redirects its output through a proxy that filters certain messages reducing the verbosity of the output.
  * The subprocess also makes sure to terminate any grandchild processes that might spawn during the session.
@@ -283,14 +269,14 @@ const startSsmProcesses = (credential, commands) => __awaiter(void 0, void 0, vo
     const abortController = new AbortController();
     const args = { credential, abortController };
     const processes = [
-        spawnSsmNode(Object.assign(Object.assign({}, args), { command: "/usr/bin/env", args: commands.shellCommand })),
+        spawnSsmNode(Object.assign(Object.assign({}, args), { command: "/usr/bin/env", args: commands.shellCommand, stdio: ["inherit", "inherit", "pipe"] })),
     ];
     if (commands.subCommand) {
         processes.push(spawnSubprocessSsmNode(Object.assign(Object.assign({}, args), { command: commands.subCommand })));
     }
     yield Promise.all(processes);
 });
-const createScpCommand = (data, args) => {
+const createProxyCommands = (data, args, debug) => {
     const ssmCommand = [
         ...createBaseSsmCommand({
             region: data.instance.region,
@@ -301,34 +287,92 @@ const createScpCommand = (data, args) => {
         "--parameters",
         '"portNumber=%p"',
     ];
-    // TODO: add support for original SSH too.
-    return [
-        "scp",
-        "-o",
-        `ProxyCommand='${ssmCommand.join(" ")}'`,
-        // if a response is not received after three 5 minute attempts,
-        // the connection will be closed.
-        "-o",
-        "ServerAliveCountMax=3",
-        `-o`,
-        "ServerAliveInterval=300",
-        ...(args.recursive ? ["-r"] : []),
-        args.source,
-        args.destination,
-    ];
+    return {
+        scp: [
+            "scp",
+            ...(debug ? ["-v"] : []),
+            "-o",
+            `ProxyCommand='${ssmCommand.join(" ")}'`,
+            // if a response is not received after three 5 minute attempts,
+            // the connection will be closed.
+            "-o",
+            "ServerAliveCountMax=3",
+            `-o`,
+            "ServerAliveInterval=300",
+            ...(args.recursive ? ["-r"] : []),
+            args.source,
+            args.destination,
+        ],
+        ssh: [
+            "ssh",
+            ...(debug ? ["-v"] : []),
+            "-o",
+            `ProxyCommand='${ssmCommand.join(" ")}'`,
+            `${data.linuxUserName}@${data.instance.id}`,
+        ],
+        ssm: ssmCommand,
+    };
 };
 const scp = (authn, data, args, privateKey) => __awaiter(void 0, void 0, void 0, function* () {
     if (!(yield (0, install_1.ensureSsmInstall)())) {
         throw "Please try again after installing the required AWS utilities";
     }
+    if (!privateKey) {
+        throw "Failed to load a private key for this request. Please contact support@p0.dev for assistance.";
+    }
     const credential = yield (0, aws_1.assumeRoleWithOktaSaml)(authn, {
         account: data.instance.accountId,
         role: data.role,
     });
-    const command = createScpCommand(data, args).join(" ");
-    if (!privateKey) {
-        throw "Failed to load a private key for this request. Please contact support@p0.dev for assistance.";
+    const commands = createProxyCommands(data, args, args.debug);
+    const scpCommand = commands.scp.join(" ");
+    const sshCommand = commands.ssh.join(" ");
+    const debug = [
+        `echo "SSH_AUTH_SOCK: $SSH_AUTH_SOCK"`,
+        `echo "SSH_AGENT_PID: $SSH_AGENT_PID"`,
+        `echo '$(p0 aws role assume ${data.role})'`,
+        `echo "${sshCommand}"`,
+        `echo "${scpCommand}"`,
+        `echo "SSH Agent Keys:"`,
+        `ssh-add -l`,
+    ];
+    /**
+     * Spawns a child process to add a private key to the ssh-agent. The SSH agent is included in the OpenSSH suite
+     * of tools and is used to hold private keys during a session. The SSH agent typically does not persist keys
+     * across system reboots or logout/login cycles. Once you log out or restart your system, any keys added to
+     * the SSH agent during that session will need to be added again in subsequent sessions.
+     */
+    const writeStdin = [
+        // This might be overkill because we are already spawning a subprocess that will run the commands for us
+        // but just in case someone enters that subprocess we're also disabling the history of commands run.
+        `unset HISTFILE`,
+        // in debug mode, we want to see the pid of the ssh-agent and compare it to the environment variable
+        `eval $(ssh-agent)${args.debug ? "" : " >/dev/null 2>&1"}`,
+        `trap 'kill $SSH_AGENT_PID' EXIT`,
+        `ssh-add -q - <<< '${privateKey}'`,
+        // in debug mode, we'll see the keys that were added to the agent and more information about the agent
+        ...(args.debug ? debug : []),
+        scpCommand,
+        `SCP_EXIT_CODE=$?`,
+        `exit $SCP_EXIT_CODE`,
+    ];
+    if (args.debug) {
+        // Print commands that can be individually executed to reproduce behavior
+        // Remove the debug information - can be executed manually between steps
+        const reproCommands = (0, lodash_1.without)([
+            "bash",
+            ...Object.entries(process.env).map(([key, value]) => `export ${key}='${value}'`),
+            ...Object.entries(credential).map(([key, value]) => `export ${key}='${value}'`),
+            ...writeStdin,
+        ], ...debug);
+        (0, stdio_1.print2)(`Execute the following commands to create a similar SCP session:\n *** COMMANDS BEGIN ***\n${reproCommands.join("\n")}\n *** COMMANDS END ***`);
     }
-    yield executeScpCommand(credential, command, privateKey);
+    return spawnSsmNode({
+        credential,
+        writeStdin,
+        stdio: ["pipe", "inherit", "pipe"],
+        command: "bash",
+        args: [],
+    });
 });
 exports.scp = scp;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@p0security/cli",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Execute infra CLI commands with P0 grants",
   "main": "index.ts",
   "repository": {