libastion 0.0.1 → 0.0.2

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -41,9 +41,18 @@ BASTION_PORT=2222
 
 # 日志级别
 BASTION_LOG_LEVEL=info
+
+# 首次启动创建默认管理员时使用的密码（默认 admin123，生产环境务必设置）
+# BASTION_ADMIN_PASSWORD=change-me-now
+```
+
+### 4. 生成 SSH 主机密钥
+
+```bash
+ssh-keygen -t ed25519 -f host.key -N ""
 ```
 
-### 3. 启动服务
+### 5. 启动服务
 
 ```bash
 npm start
@@ -51,7 +60,7 @@ npm start
 node bin/server.js
 ```
 
-### 4. 使用 CLI 管理
+### 6. 使用 CLI 管理
 
 ```bash
 # 添加目标主机
@@ -73,7 +82,7 @@ node bin/cli.js list-sessions
 node bin/cli.js show-commands 1
 ```
 
-### 5. 连接堡垒机
+### 7. 连接堡垒机
 
 ```bash
 ssh admin@localhost -p 2222
@@ -183,9 +192,9 @@ node bin/cli.js update-password admin new_password
 
 ## 技术栈
 
-- Node.js >= 18
+- Node.js >= 22.5
 - ssh2 - SSH Server + Client
-- better-sqlite3 - 数据库
+- node:sqlite - 数据库
 - bcryptjs - 密码哈希
 - winston - 日志
 - commander - CLI 工具

package/bin/server.js

@@ -12,10 +12,19 @@ const sessionMod = require('../src/session');
 const logger = require('../src/logger');
 const svc = 'server';
 
+if (!config.masterKey) {
+  logger.warn(`${svc}: BASTION_MASTER_KEY is not set, host credentials cannot be encrypted/decrypted`);
+}
+
 logger.info(`${svc}: starting on port ${config.server.port}`);
 auth.initDefaults();
 
-const hostKey = fs.readFileSync(path.join(__dirname, '..', 'host.key'), 'utf8');
+const hostKeyPath = path.join(__dirname, '..', 'host.key');
+if (!fs.existsSync(hostKeyPath)) {
+  logger.error(`${svc}: host key not found at ${hostKeyPath}. Generate one with: ssh-keygen -t ed25519 -f host.key`);
+  process.exit(1);
+}
+const hostKey = fs.readFileSync(hostKeyPath, 'utf8');
 const server = new Server({ hostKeys: [hostKey] });
 
 server.on('connection', (client, info) => {
@@ -26,13 +35,14 @@ server.on('connection', (client, info) => {
 
   client.on('authentication', (ctx) => {
     if (ctx.method !== 'password') return ctx.reject(['password']);
-    if (sessionMod.getActiveSessions() >= sessionMod.getMaxSessions()) return ctx.reject();
+    if (sessionMod.getActiveSessions() >= sessionMod.getMaxSessions()) return ctx.reject(['password']);
     const u = auth.authenticate(ctx.username, ctx.password);
     if (!u) return ctx.reject(['password']);
     const hs = auth.getUserHosts(u.id);
     if (hs.length === 0) return ctx.reject(['password']);
     user = u;
     host = hosts.getHost(hs[0].id);
+    if (!host) return ctx.reject(['password']);
     ctx.accept();
     logger.info(`${svc}: auth ok ${u.username}`);
   });
@@ -49,24 +59,44 @@ server.on('connection', (client, info) => {
       const stream = acceptShell();
       const as = audit.createSession(user.id, host.id, connInfo.ip);
       let last = Date.now();
+      let timerCleared = false;
+      const stopTimer = () => {
+        if (!timerCleared) {
+          timerCleared = true;
+          clearInterval(t);
+        }
+      };
+
       const t = setInterval(() => {
         if (Date.now() - last > config.server.idleTimeoutSec * 1000) {
           stream.write('\r\n*** idle timeout ***\r\n');
           stream.end();
           client.end();
-          clearInterval(t);
+          stopTimer();
         }
       }, 30000);
+
       sessionMod.createClientConnection(host, user.id, as.id, null).then((c) => {
         c.shell({ term: 'vt100' }, (err, rs) => {
-          if (err) { stream.end(); return; }
+          if (err) {
+            stopTimer();
+            audit.endSession(as.id, 'error');
+            stream.end();
+            return;
+          }
           rs.on('data', (d) => { last = Date.now(); stream.write(d); });
           stream.on('data', (d) => { last = Date.now(); rs.write(d); });
-          const close = () => { clearInterval(t); audit.endSession(as.id, 'closed'); client.end(); };
+          const close = () => {
+            stopTimer();
+            audit.endSession(as.id, 'closed');
+            c.end();
+            client.end();
+          };
           rs.on('close', close);
           stream.on('close', close);
         });
       }).catch((e) => {
+        stopTimer();
         logger.error(`${svc}: upstream connect failed: ${e.message}`);
         stream.write('\r\n*** upstream connect failed ***\r\n');
         stream.end();
@@ -74,7 +104,7 @@ server.on('connection', (client, info) => {
     });
 
     ch.on('exec', (acceptExec, rejectExec, info) => {
-      if (!user || !host) { rejectExec && rejectExec(); return; }
+      if (!user || !host) { if (rejectExec) rejectExec(new Error('no target host')); return; }
       const as = audit.createSession(user.id, host.id, connInfo.ip);
       const bp = policy.checkCommand(info.command);
       if (bp.blocked) {
@@ -89,38 +119,123 @@ server.on('connection', (client, info) => {
       audit.recordCommand(as.id, info.command, false);
       sessionMod.createClientConnection(host, user.id, as.id, null).then((c) => {
         c.exec(info.command, (err, rs) => {
-          if (err) { rejectExec && rejectExec(); return; }
+          if (err) {
+            audit.endSession(as.id, 'error');
+            if (rejectExec) rejectExec(err);
+            return;
+          }
           const s = acceptExec();
+          let exitCode = 0;
+          rs.on('exitStatus', (code) => { exitCode = code; });
           rs.on('data', (d) => s.write(d));
           rs.stderr.on('data', (d) => s.stderr && s.stderr.write(d));
-          rs.on('close', () => { s.exit(0); s.end(); c.end(); audit.endSession(as.id, 'closed'); });
+          rs.on('close', () => {
+            s.exit(exitCode);
+            s.end();
+            c.end();
+            audit.endSession(as.id, 'closed');
+          });
         });
-      }).catch((e) => { rejectExec && rejectExec(); });
+      }).catch((e) => {
+        audit.endSession(as.id, 'error');
+        if (rejectExec) rejectExec(e);
+      });
     });
 
-    ch.on('sftp', (acceptSftp) => {
-      if (!user || !host) { ch.close(); return; }
+    ch.on('subsystem', (accept, reject, info) => {
+      if (info.name !== 'sftp') {
+        if (reject) reject(new Error('unsupported subsystem'));
+        return;
+      }
+      if (!user || !host) {
+        if (reject) reject(new Error('no target host'));
+        return;
+      }
       const as = audit.createSession(user.id, host.id, connInfo.ip);
-      const sc = acceptSftp();
-      sc.on('OPEN', (reqid, filename, flags) => {
-        const dir = (flags & 3) ? 'upload' : 'download';
-        audit.recordTransfer(as.id, dir, filename, 0);
+      // accept() returns the raw channel (no SFTP parser attached), enabling
+      // protocol-level relaying to the target host
+      const sc = accept();
+
+      // Minimal SFTP packet parser to audit OPEN operations (upload/download)
+      let buf = Buffer.alloc(0);
+      const onClientData = (chunk) => {
+        buf = Buffer.concat([buf, chunk]);
+        while (buf.length >= 4) {
+          const len = buf.readUInt32BE(0);
+          if (buf.length < 4 + len) break;
+          const pkt = buf.subarray(4, 4 + len);
+          buf = buf.subarray(4 + len);
+          if (pkt.length < 13) continue;
+          const type = pkt[0];
+          if (type === 3) { // SSH_FXP_OPEN: type(1) reqid(4) filename(4+n) flags(4) attrs(4)
+            const nameLen = pkt.readUInt32BE(5);
+            if (13 + nameLen <= pkt.length) {
+              const filename = pkt.subarray(9, 9 + nameLen).toString('utf8');
+              const flags = pkt.readUInt32BE(9 + nameLen);
+              // SSH_FXF_WRITE (0x02) => upload, otherwise read => download
+              audit.recordTransfer(as.id, (flags & 0x02) ? 'upload' : 'download', filename, 0);
+            }
+          }
+        }
+      };
+
+      // Buffer client packets until the upstream SFTP channel is ready
+      let sftp = null;
+      const pending = [];
+      sc.on('data', (d) => {
+        if (sftp) {
+          onClientData(d);
+          sftp.write(d);
+        } else {
+          pending.push(d);
+        }
       });
+
       sessionMod.createClientConnection(host, user.id, as.id, null).then((c) => {
-        c.sftp((err) => { if (err) { sc.close(); } });
+        // Open a raw sftp subsystem channel (no SFTP parser) so we can relay
+        // protocol packets byte-for-byte between client and target
+        c.subsys('sftp', (err, sftpChannel) => {
+          if (err) {
+            audit.endSession(as.id, 'error');
+            sc.close();
+            return;
+          }
+          sftp = sftpChannel;
+          // Flush packets received while the upstream channel was being established
+          for (const d of pending) {
+            onClientData(d);
+            sftp.write(d);
+          }
+          pending.length = 0;
+          // Relay raw SFTP protocol packets from target to client
+          sftp.on('data', (d) => sc.write(d));
+          const close = () => {
+            audit.endSession(as.id, 'closed');
+            sc.end();
+            sftp.end();
+            c.end();
+          };
+          sftp.on('close', close);
+          sc.on('close', close);
+        });
       }).catch(() => sc.close());
     });
 
     ch.on('direct-tcpip', (acceptDst, rejectDst, info) => {
-      if (!user || !host) { rejectDst && rejectDst(new Error('unavailable')); return; }
+      if (!user || !host) {
+        if (rejectDst) rejectDst(new Error('no target host'));
+        return;
+      }
+      // Port forwarding is intentionally disabled; log the attempt for audit
       const as = audit.createSession(user.id, host.id, connInfo.ip);
       audit.recordForward(as.id, 'direct-tcpip', info.srcIP, info.srcPort, info.destIP, info.destPort);
-      rejectDst ? rejectDst(new Error('port forwarding disabled')) : acceptDst().end();
       audit.endSession(as.id, 'closed');
+      if (rejectDst) return rejectDst(new Error('port forwarding disabled'));
+      acceptDst().end();
     });
   });
 
   client.on('close', () => logger.info(`${svc}: conn closed`));
 });
 
-server.listen(config.server.port, () => logger.info(`${svc}: ready on port ${config.server.port}`));
+server.listen(config.server.port, () => logger.info(`${svc}: ready on port ${config.server.port}`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libastion",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "description": "A lightweight bastion host built with Node.js",
   "main": "bin/server.js",
   "bin": {
@@ -34,6 +34,6 @@
     "PLAN.md"
   ],
   "engines": {
-    "node": ">=18"
+    "node": ">=22.5"
   }
 }

package/src/audit/index.js

@@ -92,7 +92,7 @@ function queryCommands(sessionId, options = {}) {
  * Query sessions
  */
 function querySessions(options = {}) {
-  let sql = 'SELECT s.*, u.username, h.name as host_name, h.host as host_addr FROM audit_sessions s JOIN users u ON u.id = s.user_id JOIN hosts h ON h.id = s.host_id WHERE 1=1';
+  let sql = 'SELECT s.*, u.username, h.name as host_name, h.host as host_addr, h.port as host_port FROM audit_sessions s JOIN users u ON u.id = s.user_id JOIN hosts h ON h.id = s.host_id WHERE 1=1';
   const params = [];
 
   if (options.userId) {

package/src/auth/index.js

@@ -9,7 +9,11 @@ const service = 'auth';
 function initDefaults() {
   const user = db.prepare('SELECT id FROM users WHERE username = ?').get('admin');
   if (!user) {
-    const hash = bcrypt.hashSync('admin123', 10);
+    const defaultPassword = process.env.BASTION_ADMIN_PASSWORD || 'admin123';
+    if (!process.env.BASTION_ADMIN_PASSWORD) {
+      logger.warn(`${service}: Using default admin password, set BASTION_ADMIN_PASSWORD and change it immediately after first login`);
+    }
+    const hash = bcrypt.hashSync(defaultPassword, 10);
     db.prepare(
       'INSERT INTO users (username, password_hash, role) VALUES (?, ?, ?)'
     ).run('admin', hash, 'admin');
@@ -22,6 +26,8 @@ function authenticate(username, password) {
   const user = db.prepare('SELECT * FROM users WHERE username = ?').get(username);
   if (!user) {
     logger.warn(`${service}: User not found`, { username });
+    // Mitigate username enumeration via response timing
+    bcrypt.compareSync(password, '$2a$10$CwTycUXWue0Thq9StjUM0uJ8mRr5mN5H9vYjP9gK7q6kQbY3xXyWq');
     return null;
   }
 

package/src/cli/index.js

@@ -11,7 +11,7 @@ const program = new Command();
 program
   .name('bastion')
   .description('CLI for bastion host management')
-  .version('0.1.0');
+  .version('0.0.2');
 
 // User commands
 program
@@ -135,7 +135,7 @@ program
     sessions.forEach(s => {
       console.log(`  ID: ${s.id}`);
       console.log(`  User: ${s.username}`);
-      console.log(`  Host: ${s.host_name} (${s.host_addr}:${22})`);
+      console.log(`  Host: ${s.host_name} (${s.host_addr}:${s.host_port})`);
       console.log(`  Client IP: ${s.client_ip}`);
       console.log(`  Status: ${s.status}`);
       console.log(`  Started: ${s.start_time}`);

package/src/config/index.js

@@ -12,20 +12,28 @@ try {
   console.error('Failed to load config.json:', e.message);
 }
 
+function toInt(value, fallback, min, max) {
+  const n = parseInt(value, 10);
+  if (Number.isNaN(n)) return fallback;
+  if (min !== undefined && n < min) return fallback;
+  if (max !== undefined && n > max) return fallback;
+  return n;
+}
+
 module.exports = {
   server: {
-    port: parseInt(process.env.BASTION_PORT || config.server?.port || 2222, 10),
-    maxSessions: config.server?.maxSessions || 50,
-    sessionTimeoutSec: config.server?.sessionTimeoutSec || 1800,
-    idleTimeoutSec: config.server?.idleTimeoutSec || 900,
+    port: toInt(process.env.BASTION_PORT || config.server?.port || 2222, 2222, 1, 65535),
+    maxSessions: toInt(config.server?.maxSessions || 50, 50, 1, 10000),
+    sessionTimeoutSec: toInt(config.server?.sessionTimeoutSec || 1800, 1800, 0),
+    idleTimeoutSec: toInt(config.server?.idleTimeoutSec || 900, 900, 0),
   },
   auth: {
-    maxFailedAttempts: config.auth?.maxFailedAttempts || 5,
-    lockDurationSec: config.auth?.lockDurationSec || 900,
+    maxFailedAttempts: toInt(config.auth?.maxFailedAttempts || 5, 5, 1, 100),
+    lockDurationSec: toInt(config.auth?.lockDurationSec || 900, 900, 0),
   },
   policy: {
     blockedCommands: config.policy?.blockedCommands || [],
   },
   masterKey: process.env.BASTION_MASTER_KEY || '',
   logLevel: process.env.BASTION_LOG_LEVEL || config.logLevel || 'info',
-};
+};

package/src/crypto.js

@@ -1,14 +1,32 @@
 const crypto = require('crypto');
-const config = require('../config');
 
 const ALGORITHM = 'aes-256-gcm';
 const IV_LENGTH = 16;
-const SALT_LENGTH = 32;
+const SALT_LENGTH = 16;
 const KEY_LENGTH = 32;
 const TAG_LENGTH = 16;
 
-function deriveKey(masterKey) {
-  // Simple key derivation: hash master key
+// scrypt parameters (16 MiB memory, ~50-100ms per derivation)
+const SCRYPT_N = 16384;
+const SCRYPT_R = 8;
+const SCRYPT_P = 1;
+
+// Current ciphertext format: v2:<salt>:<iv>:<tag>:<encrypted>
+// Legacy format (no version prefix): <salt>:<iv>:<tag>:<encrypted> derived via sha256
+const V2_PREFIX = 'v2:';
+const LEGACY_PARTS = 4;
+
+function deriveKeyV2(masterKey, salt) {
+  return crypto.scryptSync(masterKey, salt, KEY_LENGTH, {
+    N: SCRYPT_N,
+    r: SCRYPT_R,
+    p: SCRYPT_P,
+    maxmem: 64 * 1024 * 1024,
+  });
+}
+
+// Legacy derivation (sha256 without salt) kept for backward compatibility
+function deriveKeyLegacy(masterKey) {
   return crypto.createHash('sha256').update(masterKey).digest();
 }
 
@@ -17,29 +35,37 @@ function encrypt(text, masterKey) {
 
   const salt = crypto.randomBytes(SALT_LENGTH);
   const iv = crypto.randomBytes(IV_LENGTH);
-  const key = deriveKey(masterKey);
+  const key = deriveKeyV2(masterKey, salt);
 
   const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
   let encrypted = cipher.update(text, 'utf-8', 'hex');
   encrypted += cipher.final('hex');
   const tag = cipher.getAuthTag().toString('hex');
 
-  // Format: salt:iv:tag:encrypted
-  return [salt.toString('hex'), iv.toString('hex'), tag, encrypted].join(':');
+  return V2_PREFIX + [salt.toString('hex'), iv.toString('hex'), tag, encrypted].join(':');
 }
 
 function decrypt(encryptedText, masterKey) {
   if (!masterKey) throw new Error('Master key is not set');
+  if (typeof encryptedText !== 'string' || encryptedText.length === 0) {
+    throw new Error('Invalid encrypted format');
+  }
 
-  const parts = encryptedText.split(':');
-  if (parts.length !== 4) throw new Error('Invalid encrypted format');
+  const isV2 = encryptedText.startsWith(V2_PREFIX);
+  const payload = isV2 ? encryptedText.slice(V2_PREFIX.length) : encryptedText;
+  const parts = payload.split(':');
+  if (parts.length !== LEGACY_PARTS) throw new Error('Invalid encrypted format');
 
   const salt = Buffer.from(parts[0], 'hex');
   const iv = Buffer.from(parts[1], 'hex');
   const tag = Buffer.from(parts[2], 'hex');
   const encrypted = parts[3];
 
-  const key = deriveKey(masterKey);
+  if (salt.length !== SALT_LENGTH || iv.length !== IV_LENGTH || tag.length !== TAG_LENGTH) {
+    throw new Error('Invalid encrypted format');
+  }
+
+  const key = isV2 ? deriveKeyV2(masterKey, salt) : deriveKeyLegacy(masterKey);
   const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
   decipher.setAuthTag(tag);
 
@@ -49,4 +75,4 @@ function decrypt(encryptedText, masterKey) {
   return decrypted;
 }
 
-module.exports = { encrypt, decrypt };
+module.exports = { encrypt, decrypt };

package/src/logger.js

@@ -1,6 +1,13 @@
 const winston = require('winston');
+const fs = require('fs');
+const path = require('path');
 const config = require('./config');
 
+const LOG_DIR = path.join(__dirname, '..', 'logs');
+if (!fs.existsSync(LOG_DIR)) {
+  fs.mkdirSync(LOG_DIR, { recursive: true });
+}
+
 const logger = winston.createLogger({
   level: config.logLevel,
   format: winston.format.combine(
@@ -19,13 +26,13 @@ const logger = winston.createLogger({
       ),
     }),
     new winston.transports.File({
-      filename: 'logs/error.log',
+      filename: path.join(LOG_DIR, 'error.log'),
       level: 'error',
     }),
     new winston.transports.File({
-      filename: 'logs/combined.log',
+      filename: path.join(LOG_DIR, 'combined.log'),
     }),
   ],
 });
 
-module.exports = logger;
+module.exports = logger;

package/src/policy/index.js

@@ -3,11 +3,15 @@ const logger = require('../logger');
 
 const service = 'policy';
 
-// Pre-compile regex patterns
-const blockedPatterns = config.policy.blockedCommands.map(pattern => ({
-  pattern: new RegExp(pattern, 'i'),
-  original: pattern,
-}));
+// Pre-compile regex patterns, skipping invalid ones instead of crashing the server
+const blockedPatterns = [];
+for (const pattern of config.policy.blockedCommands) {
+  try {
+    blockedPatterns.push({ pattern: new RegExp(pattern, 'i'), original: pattern });
+  } catch (e) {
+    logger.warn(`${service}: Skipping invalid blocked-command pattern "${pattern}": ${e.message}`);
+  }
+}
 
 /**
  * Check if a command is blocked
@@ -29,4 +33,4 @@ function checkCommand(command) {
   return { blocked: false, reason: null };
 }
 
-module.exports = { checkCommand };
+module.exports = { checkCommand };

package/src/session/index.js

@@ -14,8 +14,19 @@ let activeSessions = 0;
 function createClientConnection(hostInfo, userId, sessionId, serverStream) {
   return new Promise((resolve, reject) => {
     const client = new Client();
+    let connected = false;
+    let ended = false;
+
+    // End audit session exactly once, preserving the first (most specific) status
+    function markEnded(status) {
+      if (ended) return;
+      ended = true;
+      audit.endSession(sessionId, status);
+    }
 
     client.on('ready', () => {
+      connected = true;
+      activeSessions++;
       logger.info(`${service}: SSH client connected to target`, {
         host: hostInfo.host,
         port: hostInfo.port,
@@ -27,14 +38,17 @@ function createClientConnection(hostInfo, userId, sessionId, serverStream) {
 
     client.on('error', (err) => {
       logger.error(`${service}: SSH client error`, { error: err.message, host: hostInfo.host });
-      audit.endSession(sessionId, 'error');
+      markEnded('error');
       reject(err);
     });
 
     client.on('close', () => {
+      if (connected) {
+        connected = false;
+        activeSessions--;
+      }
       logger.info(`${service}: SSH client closed`, { sessionId });
-      audit.endSession(sessionId, 'closed');
-      activeSessions--;
+      markEnded('closed');
     });
 
     // Connect to target host
@@ -53,6 +67,8 @@ function createClientConnection(hostInfo, userId, sessionId, serverStream) {
  */
 async function handleShell(client, sessionId) {
   return new Promise((resolve, reject) => {
+    let resolved = false;
+
     client.shell({
       term: 'xterm',
       cols: 80,
@@ -67,23 +83,31 @@ async function handleShell(client, sessionId) {
       logger.info(`${service}: Shell session started`, { sessionId });
       activeSessions++;
 
-      // Set idle timeout
       let idleTimer = setTimeout(() => {
         logger.warn(`${service}: Session timed out (idle)`, { sessionId });
         stream.end();
-        resolve();
+        if (!resolved) {
+          resolved = true;
+          resolve(stream);
+        }
       }, config.server.idleTimeoutSec * 1000);
 
-      stream.on('data', (data) => {
+      stream.on('data', () => {
         clearTimeout(idleTimer);
         idleTimer = setTimeout(() => {
           logger.warn(`${service}: Session timed out (idle)`, { sessionId });
           stream.end();
-          resolve();
+          if (!resolved) {
+            resolved = true;
+            resolve(stream);
+          }
         }, config.server.idleTimeoutSec * 1000);
       });
 
-      resolve(stream);
+      if (!resolved) {
+        resolved = true;
+        resolve(stream);
+      }
     });
   });
 }
@@ -98,6 +122,7 @@ async function handleExec(client, command, sessionId) {
     client.exec(command, (err, stream) => {
       if (err) {
         logger.error(`${service}: Exec error`, { error: err.message });
+        activeSessions--;
         reject(err);
         return;
       }
@@ -137,4 +162,4 @@ module.exports = {
   bridgeStreams,
   getActiveSessions: () => activeSessions,
   getMaxSessions: () => config.server.maxSessions,
-};
+};