keywarden-ssh 0.3.0__py3-none-any.whl

keywarden/ui.py

@@ -0,0 +1,348 @@
+"""keywarden ui: the same checks in a browser tab, served from this machine only.
+
+The server listens on 127.0.0.1, answers only requests that carry the session
+token and a localhost Host header, and keeps nothing between requests. Public
+key text is fingerprinted on arrival and dropped; the page holds fingerprints.
+"""
+
+from __future__ import annotations
+
+import json
+import secrets
+import sys
+import threading
+import time
+import webbrowser
+from datetime import date
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+from types import SimpleNamespace
+from urllib.parse import parse_qs, urlsplit
+
+from keywarden import __version__
+from keywarden.access import key_rows
+from keywarden.check import FINGERPRINT, HostObservation, Policy, apply_drift, evaluate
+from keywarden.cli import (
+    _envelope,
+    _host_report,
+    _matches,
+    _observe_target,
+    _targets,
+    _unreachable,
+    csv_text,
+    prior_from_document,
+)
+from keywarden.collect import REMOTE_SCRIPT, ProtocolError, collect_local, collect_remote, parse_protocol
+from keywarden.parse import KeyRef, PrivateKeyError, kind_of, parse_public_keys
+from keywarden.ui_lab import LAB_PUSH, lab_hosts
+from keywarden.ui_page import render_page
+from keywarden.waivers import apply_waivers, load_waivers
+
+MAX_BODY = 2_000_000
+TARGETS = {"lab", "local", "host", "inventory", "paste"}
+
+
+class BadRequest(ValueError):
+    pass
+
+
+def _push_from(body: dict) -> list[KeyRef]:
+    """New key text replaces the set. Without it, the fingerprints the page already holds are used."""
+    text = body.get("allowText") or ""
+    if not isinstance(text, str):
+        raise BadRequest("allowText must be text")
+    if text.strip():
+        try:
+            keys, _issues = parse_public_keys(text)
+        finally:
+            del text
+        if not keys:
+            raise BadRequest("No public keys were found in the push box.")
+        return keys
+    keys = []
+    for item in body.get("allowFingerprints") or []:
+        if not isinstance(item, dict) or not FINGERPRINT.fullmatch(str(item.get("fingerprint", ""))):
+            raise BadRequest("allowFingerprints holds something that is not a fingerprint")
+        key_type = str(item.get("type") or "unknown")
+        bits = item.get("bits") if isinstance(item.get("bits"), int) else None
+        keys.append(KeyRef(item["fingerprint"], key_type, kind_of(key_type), bits, str(item.get("comment") or "")))
+    return keys
+
+
+def _policy(body: dict) -> Policy:
+    stale = body.get("staleDays", 90)
+    if not isinstance(stale, int) or stale < 1 or stale > 3650:
+        raise BadRequest("Stale after must be between 1 and 3650 days.")
+    return Policy(
+        flag_outside_push=bool(body.get("flagOutside", True)),
+        flag_weak=bool(body.get("flagWeak", True)),
+        stale_days=stale,
+    )
+
+
+def _args(body: dict) -> SimpleNamespace:
+    accounts = body.get("accounts") or []
+    if not isinstance(accounts, list) or not all(isinstance(item, str) for item in accounts):
+        raise BadRequest("accounts must be a list of names")
+    return SimpleNamespace(account=accounts, accept_new=bool(body.get("acceptNew", False)))
+
+
+def _observations(body: dict):
+    """Yield (name, observation or error dict, role, prior) for the chosen target."""
+    target = body.get("target")
+    if target not in TARGETS:
+        raise BadRequest("Pick what to check.")
+    args = _args(body)
+    if target == "lab":
+        for observation, address, role, prior in lab_hosts(int(time.time())):
+            observation.address = address
+            yield observation.name, observation, role, prior
+        return
+    if target == "local":
+        observation = collect_local(args.account)
+        yield observation.name, observation, "This machine", None
+        return
+    if target == "host":
+        destination = str(body.get("host") or "").strip()
+        if not destination:
+            raise BadRequest("Enter a host as user@hostname.")
+        try:
+            observation = collect_remote(destination, args.account, accept_new=args.accept_new)
+        except ProtocolError as exc:
+            yield destination, _unreachable(destination, destination, str(exc), code="collector-output"), "", None
+            return
+        except (OSError, RuntimeError, ValueError) as exc:
+            yield destination, _unreachable(destination, destination, str(exc)), "", None
+            return
+        yield observation.name, observation, "", None
+        return
+    if target == "paste":
+        text = str(body.get("observation") or "")
+        if not text.strip():
+            raise BadRequest("Paste the collector output first.")
+        if len(text) > 1_000_000:
+            raise BadRequest("The pasted output is larger than 1 MB.")
+        try:
+            observation = parse_protocol(text, address="pasted")
+        finally:
+            del text
+        yield observation.name, observation, "Pasted", None
+        return
+    path = Path(str(body.get("inventoryPath") or "").strip()).expanduser()
+    if not str(path) or not path.is_file():
+        raise BadRequest("Enter the path to an INI inventory on this machine.")
+    for target_host in _targets(path):
+        try:
+            observation = _observe_target(target_host, args)
+        except ProtocolError as exc:
+            yield target_host.name, _unreachable(target_host.name, target_host.destination, str(exc), code="collector-output"), "", None
+            continue
+        except (OSError, RuntimeError, ValueError) as exc:
+            yield target_host.name, _unreachable(target_host.name, target_host.destination, str(exc)), "", None
+            continue
+        yield target_host.name, observation, "", None
+
+
+def run_check(body: dict) -> dict:
+    push = _push_from(body)
+    policy = _policy(body)
+    waivers = []
+    waiver_path = str(body.get("waiversPath") or "").strip()
+    if waiver_path:
+        waivers = load_waivers(Path(waiver_path).expanduser())
+    uploaded_prior = body.get("prior")
+    used: set[int] = set()
+    hosts: list[dict] = []
+    rows: list[dict] = []
+    for name, observed, role, lab_prior in _observations(body):
+        if not isinstance(observed, HostObservation):
+            observed["roleLabel"] = role
+            hosts.append(observed)
+            continue
+        prior = None
+        if lab_prior is not None:
+            # The lab's previous run: today's results, except where it says a check was different.
+            prior = {item.code: (item.severity, set(item.fingerprints)) for item in evaluate(observed, push, policy)}
+            prior.update(lab_prior)
+        if uploaded_prior is not None:
+            prior = prior_from_document(uploaded_prior, observed.name) or prior
+        findings = apply_drift(evaluate(observed, push, policy), prior)
+        findings = apply_waivers(findings, observed.name, waivers, date.today(), used)
+        host_rows = key_rows(observed, push, policy)
+        rows.extend(host_rows)
+        report = _host_report(observed, findings, host_rows)
+        report["roleLabel"] = role
+        hosts.append(report)
+    document = _envelope(push)
+    document["hosts"] = hosts
+    document["posture"] = "fail" if any(host["posture"] == "fail" for host in hosts) else "pass"
+    notes = [
+        f"Waiver {waiver.label} ({waiver.code}) matched nothing; remove it if the risk is gone."
+        for waiver in waivers
+        if waiver.index not in used
+    ]
+    from keywarden.evidence import render_evidence
+
+    return {
+        "report": document,
+        "csv": csv_text(rows),
+        "evidence": render_evidence(document),
+        "notes": notes,
+        "lab": body.get("target") == "lab",
+    }
+
+
+def run_where(body: dict) -> dict:
+    wanted: list[str] = []
+    for value in body.get("fingerprints") or []:
+        value = str(value).strip()
+        if value:
+            if not FINGERPRINT.fullmatch(value):
+                raise BadRequest(f"{value[:60]} is not a fingerprint. Use SHA256:..., as ssh-keygen -lf prints.")
+            wanted.append(value)
+    text = str(body.get("keyText") or "")
+    if text.strip():
+        try:
+            keys, _issues = parse_public_keys(text)
+        finally:
+            del text
+        wanted.extend(key.fingerprint for key in keys)
+    if not wanted:
+        raise BadRequest("Enter a fingerprint or paste a public key.")
+    found: list[dict] = []
+    blind: list[str] = []
+    for name, observed, _role, _prior in _observations(body):
+        if not isinstance(observed, HostObservation):
+            blind.append(f"{name}: not checked ({observed['findings'][0]['detail'][:120]})")
+            continue
+        found.extend(_matches(observed, set(wanted)))
+        blind.extend(f"{observed.name}: {account.user} could not be read" for account in observed.accounts if account.read_state == "unreadable")
+    return {"fingerprints": list(dict.fromkeys(wanted)), "found": found, "notChecked": blind}
+
+
+class Handler(BaseHTTPRequestHandler):
+    server_version = "keywarden-ui"
+    sys_version = ""
+
+    def log_message(self, format, *args):  # noqa: A002 - quiet: requests can carry host names
+        return
+
+    # Every response: no caching, no framing, no referrer, scripts only with this page's nonce.
+    def _headers(self, status: int, content_type: str, length: int, nonce: str | None = None) -> None:
+        self.send_response(status)
+        self.send_header("Content-Type", content_type)
+        self.send_header("Content-Length", str(length))
+        self.send_header("Cache-Control", "no-store")
+        self.send_header("X-Content-Type-Options", "nosniff")
+        self.send_header("Referrer-Policy", "no-referrer")
+        self.send_header("X-Frame-Options", "DENY")
+        self.send_header("Cross-Origin-Opener-Policy", "same-origin")
+        self.send_header("Cross-Origin-Resource-Policy", "same-origin")
+        if nonce:
+            self.send_header(
+                "Content-Security-Policy",
+                f"default-src 'none'; script-src 'nonce-{nonce}'; style-src 'nonce-{nonce}'; "
+                "img-src data:; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
+            )
+        self.end_headers()
+
+    def _send_json(self, status: int, payload: dict) -> None:
+        data = json.dumps(payload).encode("utf-8")
+        self._headers(status, "application/json; charset=utf-8", len(data))
+        self.wfile.write(data)
+
+    def _host_ok(self) -> bool:
+        port = self.server.server_address[1]
+        return self.headers.get("Host", "") in {f"127.0.0.1:{port}", f"localhost:{port}"}
+
+    def _origin_ok(self) -> bool:
+        origin = self.headers.get("Origin")
+        if origin is None:
+            return True
+        port = self.server.server_address[1]
+        return origin in {f"http://127.0.0.1:{port}", f"http://localhost:{port}"}
+
+    def _token_ok(self, supplied: str | None) -> bool:
+        return supplied is not None and secrets.compare_digest(supplied, self.server.token)
+
+    def do_GET(self):  # noqa: N802
+        if not self._host_ok():
+            return self._send_json(421, {"error": "wrong host"})
+        url = urlsplit(self.path)
+        if url.path == "/":
+            token = parse_qs(url.query).get("t", [None])[0]
+            if not self._token_ok(token):
+                body = b"Open the link keywarden ui printed. It carries this session's token."
+                self._headers(403, "text/plain; charset=utf-8", len(body))
+                return self.wfile.write(body)
+            nonce = secrets.token_urlsafe(16)
+            page = render_page(nonce, self.server.token, __version__).encode("utf-8")
+            self._headers(200, "text/html; charset=utf-8", len(page), nonce)
+            return self.wfile.write(page)
+        return self._send_json(404, {"error": "not found"})
+
+    def do_POST(self):  # noqa: N802
+        if not self._host_ok() or not self._origin_ok():
+            return self._send_json(403, {"error": "This server only answers its own page."})
+        if not self._token_ok(self.headers.get("X-Keywarden-Token")):
+            return self._send_json(403, {"error": "Missing or wrong session token. Reopen the link keywarden ui printed."})
+        if self.headers.get("Content-Type", "").split(";")[0].strip() != "application/json":
+            return self._send_json(415, {"error": "Send JSON."})
+        try:
+            length = int(self.headers.get("Content-Length", "0"))
+        except ValueError:
+            length = -1
+        if length < 0 or length > MAX_BODY:
+            return self._send_json(413, {"error": "The request is larger than 2 MB."})
+        raw = self.rfile.read(length)
+        try:
+            body = json.loads(raw.decode("utf-8"))
+        except (UnicodeDecodeError, json.JSONDecodeError):
+            return self._send_json(400, {"error": "The request was not valid JSON."})
+        finally:
+            del raw
+        if not isinstance(body, dict):
+            return self._send_json(400, {"error": "The request was not a JSON object."})
+        try:
+            if self.path == "/api/check":
+                return self._send_json(200, run_check(body))
+            if self.path == "/api/where":
+                return self._send_json(200, run_where(body))
+            if self.path == "/api/collector":
+                return self._send_json(200, {"script": REMOTE_SCRIPT})
+            if self.path == "/api/lab-keys":
+                return self._send_json(200, {"keys": LAB_PUSH})
+            return self._send_json(404, {"error": "not found"})
+        except PrivateKeyError:
+            return self._send_json(400, {"error": "A private key was in the input. Keywarden takes public keys only and kept nothing."})
+        except (BadRequest, ValueError, OSError, RuntimeError, json.JSONDecodeError) as exc:
+            return self._send_json(400, {"error": str(exc)[:400]})
+        finally:
+            body.clear()
+
+
+class KeywardenServer(ThreadingHTTPServer):
+    daemon_threads = True
+
+    def __init__(self, port: int):
+        super().__init__(("127.0.0.1", port), Handler)
+        self.token = secrets.token_urlsafe(24)
+
+
+def serve(port: int = 0, open_browser: bool = True) -> int:
+    server = KeywardenServer(port)
+    url = f"http://127.0.0.1:{server.server_address[1]}/?t={server.token}"
+    print(f"Keywarden is running at {url}")
+    print("Only this machine can reach it. Press Ctrl+C to stop; nothing is kept when it stops.")
+    if open_browser:
+        threading.Timer(0.3, lambda: webbrowser.open(url)).start()
+    try:
+        server.serve_forever()
+    except KeyboardInterrupt:
+        print("\nStopped.", file=sys.stderr)
+    finally:
+        server.server_close()
+    return 0
+
+
+__all__ = ["serve", "run_check", "run_where"]

keywarden/ui_lab.py

@@ -0,0 +1,173 @@
+"""The lab: six made-up hosts for trying the interface. None of these keys exist anywhere real."""
+
+from __future__ import annotations
+
+from keywarden.check import HostObservation
+from keywarden.collect import parse_protocol
+from keywarden.parse import parse_public_keys
+
+DAY = 86400
+
+LAB_KEYS = {
+    "ops": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMw3CRyIVJdlcMu0yNey4yKK9cbarwPgFyt3RYj11nOm ops@latch",
+    "deploy": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFNC5kulzZA+Y15VIvsXBCD4xVqmzgNc3Yrt0uMZrLMe deploy@latch",
+    "ci": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKyqTebqUn7JMI3f6e7CRqxw/LVNetdp5tfDuNCSA9hi ci-bot",
+    "root": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMjKhLYgU3zJepCV0ElII061TiD8YX9qsBP9hfJjhB6v root@app-web-03",
+    "contractor": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAFuDUY/c8R+5oUuOUyByXj9ZGOVT/nVX5lnf+RXtZwI contractor@temp",
+    "alice": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILamNR3cDT6qyuPVk9beyF8PHD/KXGgtPGuYeqOp4Tmz alice@old-laptop",
+    "legacy": (
+        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDM6KTe5dS730B8qyUwp1YK6JM8ccsTIrDRedOsdrz0eF+058iL/B21uIPEE+5/ffdY+DXN0so0IjckwZvVm3SkdFu3"
+        "KnVShlUXIlyvjtHWKohCpK6ZiNf33OvpPBePbciFUrcFT9XeclgqziKoMUzeCgsSJ89sOkXvUTBfBNkq3JkK7Lges129q/D0XpFduFjAagdG10jOGBbR5OyduljMYJVjL3bn"
+        "88GaaNsPTkYoZsEZ9ttawoIi4sJTNLQYJBcXjmrviQNjIjVLDzsnhXArXQd/oJnXl2ZxVXIoQxKucHlChbLQDIJ8MT61hB2X4ee+ltwAwK3lRHRSynzLyfyh legacy-jump"
+    ),
+}
+LAB_PUSH = [LAB_KEYS["ops"], LAB_KEYS["deploy"], LAB_KEYS["ci"]]
+
+_SAFE_SSHD = {
+    "permitrootlogin": "no",
+    "passwordauthentication": "no",
+    "kbdinteractiveauthentication": "no",
+    "pubkeyauthentication": "yes",
+    "permitemptypasswords": "no",
+    "authenticationmethods": "publickey",
+    "hostbasedauthentication": "no",
+    "pubkeyacceptedalgorithms": "ssh-ed25519,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256",
+    "casignaturealgorithms": "ssh-ed25519,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256",
+    "trustedusercakeys": "none",
+    "revokedkeys": "none",
+    "authorizedkeyscommand": "none",
+    "authorizedkeysfile": ".ssh/authorized_keys .ssh/authorized_keys2",
+    "loglevel": "INFO",
+    "allowtcpforwarding": "yes",
+    "allowagentforwarding": "yes",
+    "x11forwarding": "no",
+    "permituserenvironment": "no",
+}
+_ADMIN_SUDO = ["User {user} may run the following commands on {host}:", "    (ALL : ALL) NOPASSWD: ALL"]
+_NO_SUDO = ["User {user} is not allowed to run sudo on {host}."]
+_PASSWORD_SUDO = ["User {user} may run the following commands on {host}:", "    (ALL : ALL) ALL"]
+
+
+def _fingerprint(line: str) -> str:
+    return parse_public_keys(line)[0][0].fingerprint
+
+
+def _account(user, uid, groups, sudo, keys, host, mode="600"):
+    lines = [f"ACCOUNT {user}", f"UID {uid}", "LOCKED yes", f"GROUPS {' '.join(groups)}", "SUDOSTATE ok", "SUDO"]
+    lines += ["S " + line.format(user=user, host=host) for line in sudo]
+    lines += ["ENDSUDO"]
+    if not keys:
+        return lines + ["DIR 700", "FILE absent", "STATE absent", "KEYS", "ENDKEYS"]
+    lines += ["DIR 700", f"FILE {mode}", "STATE ok", "KEYS"]
+    lines += ["K " + key for key in keys]
+    return lines + ["ENDKEYS"]
+
+
+def _host(name, now, sshd_changes, accounts, logins):
+    sshd = dict(_SAFE_SSHD)
+    sshd.update(sshd_changes)
+    lines = [
+        "KEYWARDEN 3",
+        f"HOST {name}",
+        f"NOW {now} +0000",
+        "PRIV sudo",
+        "SSHDRUN ok",
+        "SSHD",
+        *(f"{key} {value}" for key, value in sshd.items()),
+        "ENDSSHD",
+        "MATCH no",
+        "SSHDROOT",
+        "ENDSSHDROOT",
+        "AUTHLOG journal",
+        "LOGINS",
+        f"AUTHFIRST {now - 210 * DAY}.000000",
+    ]
+    for user, key, days_ago, source, count in logins:
+        lines.append(
+            f"L {count} {now - days_ago * DAY}.000000 {name} sshd[1]: Accepted publickey for {user} "
+            f"from {source} port 50000 ssh2: ED25519 {_fingerprint(LAB_KEYS[key])}"
+        )
+    lines.append("ENDLOGINS")
+    for account in accounts:
+        lines += account
+    lines += ["PASSWD ok", "END"]
+    return "\n".join(lines) + "\n"
+
+
+def lab_hosts(now: int) -> list[tuple[HostObservation, str, str, dict]]:
+    """(observation, address, role, prior changes) for each lab host.
+
+    The prior changes are how the previous run differed from this one; every other check is unchanged.
+    """
+    k = LAB_KEYS
+    root_none = lambda host: _account("root", 0, ["root"], [], [], host)  # noqa: E731
+    specs = [
+        (
+            "app-web-03", "10.0.4.23", "Application",
+            {"permitrootlogin": "prohibit-password"},
+            lambda h: [
+                _account("root", 0, ["root"], [], [k["root"]], h),
+                _account("ops", 1000, ["ops", "sudo"], _ADMIN_SUDO, ['from="10.0.0.0/16" ' + k["ops"]], h),
+                _account("deploy", 1001, ["deploy"], _NO_SUDO, [k["deploy"]], h),
+            ],
+            [("ops", "ops", 1, "10.0.0.9", 41), ("deploy", "deploy", 0, "10.0.6.15", 212)],
+            {"permit-root": ("pass", set()), "root-authorized-key": ("pass", set())},
+        ),
+        (
+            "db-primary", "10.0.8.4", "Database",
+            {"passwordauthentication": "yes"},
+            lambda h: [
+                root_none(h),
+                _account("ops", 1000, ["ops", "sudo"], _ADMIN_SUDO, ['from="10.0.0.0/16" ' + k["ops"]], h),
+                _account("postgres", 113, ["postgres"], _NO_SUDO, [k["contractor"]], h),
+            ],
+            [("ops", "ops", 3, "10.0.0.9", 12)],
+            {"password-auth": ("fail", set()), "outside-push": ("fail", {_fingerprint(k["contractor"])})},
+        ),
+        (
+            "ci-runner", "10.0.6.15", "Automation",
+            {},
+            lambda h: [
+                root_none(h),
+                _account("deploy", 1001, ["deploy", "docker"], _NO_SUDO, [k["ci"], k["alice"]], h),
+            ],
+            [("deploy", "ci", 0, "140.82.112.4", 388), ("deploy", "alice", 151, "10.20.0.14", 3)],
+            {"outside-push": ("pass", set()), "stale-key": ("pass", set())},
+        ),
+        (
+            "jump-legacy", "10.0.1.4", "Legacy jump",
+            {"pubkeyacceptedalgorithms": "ssh-ed25519,rsa-sha2-256,ssh-rsa"},
+            lambda h: [
+                root_none(h),
+                _account("ops", 1000, ["ops"], _NO_SUDO, ['from="10.0.0.0/16" ' + k["ops"], k["legacy"]], h),
+            ],
+            [("ops", "ops", 2, "10.0.0.9", 30)],
+            {"weak-algorithm": ("fail", {_fingerprint(k["legacy"])}), "accepted-algorithms": ("fail", set())},
+        ),
+        (
+            "bastion", "10.0.0.9", "Bastion",
+            {"allowtcpforwarding": "no", "allowagentforwarding": "no"},
+            lambda h: [
+                root_none(h),
+                _account("ops", 1000, ["ops"], _NO_SUDO, [k["ops"]], h),
+            ],
+            [("ops", "ops", 0, "203.0.113.20", 96)],
+            {},
+        ),
+        (
+            "mon-01", "10.0.9.7", "Monitoring",
+            {},
+            lambda h: [
+                root_none(h),
+                _account("ops", 1000, ["ops", "sudo"], _PASSWORD_SUDO, ['from="10.0.0.0/16" ' + k["ops"]], h),
+                _account("deploy", 1001, ["deploy"], _NO_SUDO, ['restrict,command="/usr/local/bin/collect" ' + k["deploy"]], h),
+            ],
+            [("ops", "ops", 6, "10.0.0.9", 8), ("deploy", "deploy", 0, "10.0.6.15", 1440)],
+            {},
+        ),
+    ]
+    result = []
+    for name, address, role, sshd, accounts, logins, prior in specs:
+        observation = parse_protocol(_host(name, now, sshd, accounts(name), logins), address=address)
+        result.append((observation, address, role, prior))
+    return result