keywarden-ssh 0.3.0__tar.gz → 0.3.1__tar.gz

{keywarden_ssh-0.3.0 → keywarden_ssh-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: keywarden-ssh
-Version: 0.3.0
+Version: 0.3.1
 Summary: Check SSH posture around the public keys you push. Never stores them.
 Author: Michael Waxman
 License-Expression: MIT
@@ -31,6 +31,15 @@ One command checks this machine, one host, or every host in an Ansible inventory
 
 `keywarden ui` on the built-in lab hosts. Screenshots: [findings, light](https://raw.githubusercontent.com/generalwax2018/keywarden/main/docs/screenshots/findings-light.webp) · [findings, dark](https://raw.githubusercontent.com/generalwax2018/keywarden/main/docs/screenshots/findings-dark.webp) · [access review](https://raw.githubusercontent.com/generalwax2018/keywarden/main/docs/screenshots/access-review.webp).
 
+## Try it in a minute
+
+```sh
+pip install keywarden-ssh
+keywarden ui
+```
+
+Your browser opens Keywarden. Press **Use Lab Keys**, then **Run Checks**, to see six made-up hosts with the kinds of problems real fleets have: a former employee's key on a shared admin account, a contractor key nobody uses, a root key that works from anywhere. Nothing is sent anywhere and nothing is stored. Then point it at a real host with **One host**.
+
 ## Install
 
 Python 3.9 or newer. No third-party packages. `--local` needs Linux or another POSIX system; the browser UI, `--host`, and `--inventory` also run on Windows using its built-in `ssh`.
@@ -42,7 +51,7 @@ python3 -m pip install keywarden-ssh
 Or straight from a tag:
 
 ```sh
-python3 -m pip install "git+https://github.com/generalwax2018/keywarden.git@v0.3.0"
+python3 -m pip install "git+https://github.com/generalwax2018/keywarden.git@v0.3.1"
 ```
 
 The distribution name is `keywarden-ssh`. The `keywarden` package on PyPI is an unrelated project; do not install it expecting this tool.

{keywarden_ssh-0.3.0 → keywarden_ssh-0.3.1}/README.md

@@ -10,6 +10,15 @@ One command checks this machine, one host, or every host in an Ansible inventory
 
 `keywarden ui` on the built-in lab hosts. Screenshots: [findings, light](https://raw.githubusercontent.com/generalwax2018/keywarden/main/docs/screenshots/findings-light.webp) · [findings, dark](https://raw.githubusercontent.com/generalwax2018/keywarden/main/docs/screenshots/findings-dark.webp) · [access review](https://raw.githubusercontent.com/generalwax2018/keywarden/main/docs/screenshots/access-review.webp).
 
+## Try it in a minute
+
+```sh
+pip install keywarden-ssh
+keywarden ui
+```
+
+Your browser opens Keywarden. Press **Use Lab Keys**, then **Run Checks**, to see six made-up hosts with the kinds of problems real fleets have: a former employee's key on a shared admin account, a contractor key nobody uses, a root key that works from anywhere. Nothing is sent anywhere and nothing is stored. Then point it at a real host with **One host**.
+
 ## Install
 
 Python 3.9 or newer. No third-party packages. `--local` needs Linux or another POSIX system; the browser UI, `--host`, and `--inventory` also run on Windows using its built-in `ssh`.
@@ -21,7 +30,7 @@ python3 -m pip install keywarden-ssh
 Or straight from a tag:
 
 ```sh
-python3 -m pip install "git+https://github.com/generalwax2018/keywarden.git@v0.3.0"
+python3 -m pip install "git+https://github.com/generalwax2018/keywarden.git@v0.3.1"
 ```
 
 The distribution name is `keywarden-ssh`. The `keywarden` package on PyPI is an unrelated project; do not install it expecting this tool.

{keywarden_ssh-0.3.0 → keywarden_ssh-0.3.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "keywarden-ssh"
-version = "0.3.0"
+version = "0.3.1"
 description = "Check SSH posture around the public keys you push. Never stores them."
 readme = "README.md"
 license = "MIT"

{keywarden_ssh-0.3.0 → keywarden_ssh-0.3.1}/src/keywarden/__init__.py

@@ -1,3 +1,3 @@
 """Check SSH posture around public keys you push. Never stores the keys."""
 
-__version__ = "0.3.0"
+__version__ = "0.3.1"

{keywarden_ssh-0.3.0 → keywarden_ssh-0.3.1}/src/keywarden/cli.py

@@ -7,6 +7,7 @@ import csv
 import dataclasses
 import io
 import json
+import os
 import sys
 from datetime import date
 from pathlib import Path
@@ -609,6 +610,13 @@ def main(argv: list[str] | None = None) -> int:
         if args.inventory:
             return _check_inventory(args)
         return _check_one(args)
+    except BrokenPipeError:
+        # Output piped into head or similar that closed early; nothing went wrong.
+        try:
+            sys.stdout = open(os.devnull, "w")
+        except OSError:
+            pass
+        return 0
     except PrivateKeyError:
         print(
             "Refusing to continue: a private key was in the input. Keywarden accepts public keys only and did not keep a copy.",
@@ -618,6 +626,16 @@ def main(argv: list[str] | None = None) -> int:
     except (OSError, ValueError, RuntimeError, json.JSONDecodeError) as exc:
         print(str(exc), file=sys.stderr)
         return 2
+    except Exception as exc:  # noqa: BLE001 - a bug should end in a message, not a traceback
+        if os.environ.get("KEYWARDEN_DEBUG"):
+            raise
+        print(
+            f"Keywarden hit an unexpected error ({type(exc).__name__}: {exc}). "
+            "Set KEYWARDEN_DEBUG=1 to see the details, and please report it at "
+            "https://github.com/generalwax2018/keywarden/issues",
+            file=sys.stderr,
+        )
+        return 3
 
 
 if __name__ == "__main__":

{keywarden_ssh-0.3.0 → keywarden_ssh-0.3.1}/src/keywarden/collect.py

@@ -336,6 +336,18 @@ echo END
 """
 
 FINGERPRINT_TEXT = re.compile(r"SHA256:[A-Za-z0-9+/]+")
+LOCAL_SUPPORTED = os.name == "posix" and hasattr(os, "geteuid")
+LOCAL_UNSUPPORTED_MESSAGE = (
+    "--local reads this machine's sshd and user accounts, which only exist on Linux and other POSIX systems. "
+    "Run Keywarden on the server itself, or from here use --host user@server, --inventory hosts.ini, "
+    "or keywarden ui and its lab hosts."
+)
+
+
+def _euid() -> int:
+    return os.geteuid() if hasattr(os, "geteuid") else -1
+
+
 _DESTINATION = re.compile(r"^[A-Za-z0-9._:-]+@[A-Za-z0-9._:-]+$|^[A-Za-z0-9._:-]+$")
 _USERNAME = re.compile(r"^[a-z_][-a-z0-9_.]*\$?$", re.IGNORECASE)
 
@@ -446,7 +458,7 @@ def _run(command: list[str]) -> subprocess.CompletedProcess | None:
 
 def _sshd_output(binary: str, extra: list[str]) -> str | None:
     attempts = [[binary, "-T", *extra]]
-    if os.geteuid() != 0 and shutil.which("sudo"):
+    if _euid() != 0 and shutil.which("sudo"):
         attempts.append(["sudo", "-n", binary, "-T", *extra])
     for command in attempts:
         completed = _run(command)
@@ -619,6 +631,8 @@ def _run_long(command: list[str]) -> subprocess.CompletedProcess | None:
 
 
 def collect_local(extra_users: list[str] | None = None) -> HostObservation:
+    if not LOCAL_SUPPORTED:
+        raise ValueError(LOCAL_UNSUPPORTED_MESSAGE)
     records, passwd_state = _passwd_records()
     accounts = []
     for user in _ordered_users(extra_users or [], records):
@@ -652,7 +666,7 @@ def collect_local(extra_users: list[str] | None = None) -> HostObservation:
         sshd_state=sshd_state,
         match_blocks=match,
         sshd_root=root,
-        privilege="root" if os.geteuid() == 0 else "none",
+        privilege="root" if _euid() == 0 else "none",
         now=now,
         log_source=log_source,
         log_since=log_since,
@@ -894,6 +908,12 @@ def _parse_account(lines: list[str], index: int) -> tuple[Account, int]:
     return account, index
 
 
+def _text(data) -> str:
+    if isinstance(data, bytes):
+        return data.decode("utf-8", errors="replace")
+    return data or ""
+
+
 def collect_remote(
     destination: str,
     extra_users: list[str] | None = None,
@@ -933,11 +953,12 @@ def collect_remote(
         options.extend(["-i", os.path.expanduser(identity_file), "-o", "IdentitiesOnly=yes"])
     command = ["ssh", *options, "--", destination, "sh", "-s", "--", *users]
     try:
+        # Bytes, not text: in text mode Windows would turn every newline in the
+        # script into CRLF on the way to the remote sh, and the script would fail.
         completed = subprocess.run(
             command,
-            input=REMOTE_SCRIPT,
+            input=REMOTE_SCRIPT.encode("utf-8"),
             capture_output=True,
-            text=True,
             timeout=60,
             check=False,
         )
@@ -945,14 +966,15 @@ def collect_remote(
         raise RuntimeError("ssh timed out before a check could finish") from exc
     except OSError as exc:
         raise RuntimeError("ssh is not available on this machine") from exc
+    stderr = _text(completed.stderr)
     if completed.returncode != 0:
         tail = ""
-        for line in reversed((completed.stderr or "").splitlines()):
+        for line in reversed(stderr.splitlines()):
             if line.strip() and "PRIVATE KEY" not in line and "ssh-" not in line:
                 tail = line.strip()[:180]
                 break
         raise RuntimeError(tail or f"ssh exited {completed.returncode}")
-    output = completed.stdout
+    output = _text(completed.stdout)
     try:
         return parse_protocol(output, address=destination)
     finally:

{keywarden_ssh-0.3.0 → keywarden_ssh-0.3.1}/src/keywarden/ui.py

@@ -32,7 +32,15 @@ from keywarden.cli import (
     csv_text,
     prior_from_document,
 )
-from keywarden.collect import REMOTE_SCRIPT, ProtocolError, collect_local, collect_remote, parse_protocol
+from keywarden.collect import (
+    LOCAL_SUPPORTED,
+    LOCAL_UNSUPPORTED_MESSAGE,
+    REMOTE_SCRIPT,
+    ProtocolError,
+    collect_local,
+    collect_remote,
+    parse_protocol,
+)
 from keywarden.parse import KeyRef, PrivateKeyError, kind_of, parse_public_keys
 from keywarden.ui_lab import LAB_PUSH, lab_hosts
 from keywarden.ui_page import render_page
@@ -99,6 +107,8 @@ def _observations(body: dict):
             yield observation.name, observation, role, prior
         return
     if target == "local":
+        if not LOCAL_SUPPORTED:
+            raise BadRequest(LOCAL_UNSUPPORTED_MESSAGE.replace("--local", "This machine").replace(" or keywarden ui and its lab hosts", " or the lab hosts"))
         observation = collect_local(args.account)
         yield observation.name, observation, "This machine", None
         return
@@ -276,7 +286,7 @@ class Handler(BaseHTTPRequestHandler):
                 self._headers(403, "text/plain; charset=utf-8", len(body))
                 return self.wfile.write(body)
             nonce = secrets.token_urlsafe(16)
-            page = render_page(nonce, self.server.token, __version__).encode("utf-8")
+            page = render_page(nonce, self.server.token, __version__, LOCAL_SUPPORTED).encode("utf-8")
             self._headers(200, "text/html; charset=utf-8", len(page), nonce)
             return self.wfile.write(page)
         return self._send_json(404, {"error": "not found"})
@@ -317,6 +327,8 @@ class Handler(BaseHTTPRequestHandler):
             return self._send_json(400, {"error": "A private key was in the input. Keywarden takes public keys only and kept nothing."})
         except (BadRequest, ValueError, OSError, RuntimeError, json.JSONDecodeError) as exc:
             return self._send_json(400, {"error": str(exc)[:400]})
+        except Exception as exc:  # noqa: BLE001 - answer the page instead of dropping the connection
+            return self._send_json(500, {"error": f"Keywarden hit an unexpected error ({type(exc).__name__}). Please report it on GitHub."})
         finally:
             body.clear()
 

{keywarden_ssh-0.3.0 → keywarden_ssh-0.3.1}/src/keywarden/ui_page.py

@@ -119,6 +119,7 @@ textarea:focus, input[type=text]:focus, input[type=number]:focus { outline: none
 .option .text { display: grid; gap: 1px; min-width: 0; }
 .option small { color: var(--secondary); font-size: 12px; }
 .option .sub { grid-column: 1 / -1; margin-top: 6px; }
+.option.disabled { opacity: .5; cursor: not-allowed; }
 .option input[type=radio] { appearance: none; -webkit-appearance: none; width: 16px; height: 16px; margin: 0; border-radius: 50%; border: 1.5px solid var(--separator-strong); background: var(--glass-strong); }
 .option input[type=radio]:checked { border: 5px solid var(--blue); background: #fff; }
 .option input[type=checkbox] { appearance: none; -webkit-appearance: none; width: 36px; height: 22px; border-radius: 11px; background: var(--fill-strong); position: relative; margin: 0; cursor: pointer; transition: background .2s; flex: none; box-shadow: inset 0 1px 2px rgba(0,0,0,.12); }
@@ -338,6 +339,7 @@ td.fp, td.mono { font-family: var(--mono); font-size: 12px; }
 <script nonce="__NONCE__">
 "use strict";
 const TOKEN = "__TOKEN__";
+const LOCAL_OK = __LOCAL_OK__;
 history.replaceState(null, "", "/");
 
 const $ = (id) => document.getElementById(id);
@@ -654,6 +656,13 @@ $("prior").addEventListener("change", async (event) => {
 });
 for (const tab of document.querySelectorAll('[role="tab"]')) tab.addEventListener("click", () => showView(tab.dataset.view));
 for (const id of ["host", "inventory"]) $(id).addEventListener("focus", () => { $(id === "host" ? "t-host" : "t-inv").checked = true; });
+if (!LOCAL_OK) {
+  // sshd and the account database live on the server; a Windows desktop has neither.
+  $("t-local").disabled = true;
+  const row = $("t-local").closest(".option");
+  row.classList.add("disabled");
+  row.querySelector("small").textContent = "Not on Windows. Run Keywarden on the Linux server, or check it as One host.";
+}
 renderPush(); renderAll([]);
 </script>
 </body>
@@ -661,5 +670,10 @@ renderPush(); renderAll([]);
 """
 
 
-def render_page(nonce: str, token: str, version: str) -> str:
-    return PAGE.replace("__NONCE__", nonce).replace("__TOKEN__", token).replace("__VERSION__", version)
+def render_page(nonce: str, token: str, version: str, local_ok: bool = True) -> str:
+    return (
+        PAGE.replace("__NONCE__", nonce)
+        .replace("__TOKEN__", token)
+        .replace("__VERSION__", version)
+        .replace("__LOCAL_OK__", "true" if local_ok else "false")
+    )

{keywarden_ssh-0.3.0 → keywarden_ssh-0.3.1}/src/keywarden_ssh.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: keywarden-ssh
-Version: 0.3.0
+Version: 0.3.1
 Summary: Check SSH posture around the public keys you push. Never stores them.
 Author: Michael Waxman
 License-Expression: MIT
@@ -31,6 +31,15 @@ One command checks this machine, one host, or every host in an Ansible inventory
 
 `keywarden ui` on the built-in lab hosts. Screenshots: [findings, light](https://raw.githubusercontent.com/generalwax2018/keywarden/main/docs/screenshots/findings-light.webp) · [findings, dark](https://raw.githubusercontent.com/generalwax2018/keywarden/main/docs/screenshots/findings-dark.webp) · [access review](https://raw.githubusercontent.com/generalwax2018/keywarden/main/docs/screenshots/access-review.webp).
 
+## Try it in a minute
+
+```sh
+pip install keywarden-ssh
+keywarden ui
+```
+
+Your browser opens Keywarden. Press **Use Lab Keys**, then **Run Checks**, to see six made-up hosts with the kinds of problems real fleets have: a former employee's key on a shared admin account, a contractor key nobody uses, a root key that works from anywhere. Nothing is sent anywhere and nothing is stored. Then point it at a real host with **One host**.
+
 ## Install
 
 Python 3.9 or newer. No third-party packages. `--local` needs Linux or another POSIX system; the browser UI, `--host`, and `--inventory` also run on Windows using its built-in `ssh`.
@@ -42,7 +51,7 @@ python3 -m pip install keywarden-ssh
 Or straight from a tag:
 
 ```sh
-python3 -m pip install "git+https://github.com/generalwax2018/keywarden.git@v0.3.0"
+python3 -m pip install "git+https://github.com/generalwax2018/keywarden.git@v0.3.1"
 ```
 
 The distribution name is `keywarden-ssh`. The `keywarden` package on PyPI is an unrelated project; do not install it expecting this tool.

{keywarden_ssh-0.3.0 → keywarden_ssh-0.3.1}/src/keywarden_ssh.egg-info/SOURCES.txt

@@ -24,4 +24,5 @@ src/keywarden_ssh.egg-info/top_level.txt
 tests/test_access.py
 tests/test_evidence.py
 tests/test_keywarden.py
+tests/test_platform.py
 tests/test_ui.py

keywarden_ssh-0.3.1/tests/test_platform.py

@@ -0,0 +1,54 @@
+import subprocess
+import sys
+import unittest
+from contextlib import redirect_stderr, redirect_stdout
+from io import StringIO
+from pathlib import Path
+from unittest.mock import patch
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "src"))
+
+from keywarden import collect  # noqa: E402
+from keywarden.cli import main  # noqa: E402
+from keywarden.ui_page import render_page  # noqa: E402
+
+
+class WindowsTests(unittest.TestCase):
+    def test_local_check_explains_itself_off_posix(self):
+        with patch.object(collect, "LOCAL_SUPPORTED", False):
+            with self.assertRaises(ValueError) as caught:
+                collect.collect_local()
+            self.assertIn("--host", str(caught.exception))
+            err = StringIO()
+            with redirect_stderr(err), redirect_stdout(StringIO()):
+                code = main(["check", "--local"])
+        self.assertEqual(code, 2)
+        self.assertIn("Linux", err.getvalue())
+        self.assertNotIn("Traceback", err.getvalue())
+
+    def test_ui_disables_this_machine_off_posix(self):
+        self.assertIn("const LOCAL_OK = false;", render_page("n", "t", "0", False))
+        self.assertIn("const LOCAL_OK = true;", render_page("n", "t", "0", True))
+
+    def test_script_is_sent_as_bytes_so_newlines_survive_windows(self):
+        with patch("keywarden.collect.subprocess.run") as run:
+            run.return_value = subprocess.CompletedProcess([], 255, b"", b"ssh: connect to host x port 22: refused\r\n")
+            with self.assertRaises(RuntimeError) as caught:
+                collect.collect_remote("deploy@x")
+        sent = run.call_args.kwargs["input"]
+        self.assertIsInstance(sent, bytes)
+        self.assertNotIn(b"\r\n", sent)
+        self.assertNotIn("text", run.call_args.kwargs)
+        self.assertIn("refused", str(caught.exception))
+
+    def test_unexpected_errors_end_in_a_message(self):
+        err = StringIO()
+        with patch("keywarden.cli._check_one", side_effect=KeyError("boom")), redirect_stderr(err):
+            code = main(["check", "--local"])
+        self.assertEqual(code, 3)
+        self.assertIn("unexpected error", err.getvalue())
+
+
+if __name__ == "__main__":
+    unittest.main()