zscams 2.0.11__tar.gz → 2.0.13__tar.gz

{zscams-2.0.11 → zscams-2.0.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: zscams
-Version: 2.0.11
+Version: 2.0.13
 Summary: Async TLS tunnel client with SNI routing, auto-reconnect, and health checks
 Author: OCD - Cairo Software Team
 Maintainer: OCD - Cairo Software Team

{zscams-2.0.11 → zscams-2.0.13}/pyproject.toml

@@ -3,7 +3,7 @@ name = "zscams_agent"
 
 [tool.poetry]
 name = "zscams"
-version = "2.0.11"
+version = "2.0.13"
 description = "Async TLS tunnel client with SNI routing, auto-reconnect, and health checks"
 authors = ["OCD - Cairo Software Team"]
 maintainers = ["OCD - Cairo Software Team"]

zscams-2.0.13/zscams/agent/configuration/freebsd_service.j2

@@ -0,0 +1,18 @@
+#!/bin/sh
+
+# PROVIDE: zscams
+# REQUIRE: NETWORKING
+# KEYWORD: shutdown
+
+. /etc/rc.subr
+
+name="zscams"
+rcvar="zscams_enable"
+
+command="/usr/sbin/daemon"
+command_args="-f -p /var/run/${name}.pid -u {user_to_run_as} {python_exec} -m zscams"
+
+pidfile="/var/run/${name}.pid"
+
+load_rc_config $name
+run_rc_command "$1"

{zscams-2.0.11 → zscams-2.0.13}/zscams/agent/src/core/backend/bootstrap.py

@@ -10,6 +10,7 @@ from zscams.agent.src.support.os import (
     install_service,
     is_freebsd,
     is_linux,
+    set_directory_ownership_and_permissions,
 )
 from zscams.agent.src.support.ssh import add_to_authorized_keys
 from zscams.agent.src.support.cli import ensure_config_value, prompt, prompt_auth_info
@@ -76,6 +77,16 @@ def bootstrap():
     create_system_user(sys_user)
     add_to_authorized_keys(sys_user, cm_info.get("server_ssh_pub_key"))
     install_zscams_systemd_service(sys_user)
+    set_dirs_permissions()
+
+
+def set_dirs_permissions():
+    paths = [
+        ROOT_PATH.joinpath("certificates"),
+        ROOT_PATH.joinpath("keys"),
+    ]
+    for path in paths:
+        set_directory_ownership_and_permissions(path, "zscams", 0o400)
 
 
 def install_zscams_systemd_service(user_to_run_as: str):

{zscams-2.0.11 → zscams-2.0.13}/zscams/agent/src/core/backend/client.py

@@ -1,6 +1,5 @@
 import json
 import os
-from pathlib import Path
 import requests
 
 from typing import Optional, cast
@@ -184,16 +183,14 @@ class BackendClient:
 
     def _write_certificates(self, ca_chain: list[str], cert: str):
         if cert:
-            cert_path = os.path.join(
-                str(ROOT_PATH), self.remote_config.get("client_cert")
-            )
+            cert_path = ROOT_PATH.joinpath(self.remote_config.get("client_cert", ""))
 
             self.logger.info("Writing signed certificate to %s", cert_path)
             with open(cert_path, "w", encoding="utf-8") as cert_file:
                 cert_file.write(cert)
 
         if ca_chain:
-            ca_chain_path = os.path.join(ROOT_PATH, self.remote_config.get("ca_chain"))
+            ca_chain_path = ROOT_PATH.joinpath(self.remote_config.get("ca_chain", ""))
 
             self.logger.info("Writing CA chain to %s", ca_chain_path)
             with open(ca_chain_path, "w", encoding="utf-8") as ca_chain_file:

{zscams-2.0.11 → zscams-2.0.13}/zscams/agent/src/core/services.py

@@ -6,6 +6,7 @@ Service launcher utilities for TLS Tunnel Client
 - Supports both Python scripts and executables
 """
 
+import sys
 import asyncio
 import json
 import os
@@ -53,7 +54,7 @@ async def start_service(service_cfg, config_dir=None):
         # Pass generic parameters to the service via JSON environment variable
         env["SERVICE_PARAMS"] = json.dumps(params)
 
-    cmd = ["python", script_path] + service_cfg.get("args", [])
+    cmd = [sys.executable, script_path] + service_cfg.get("args", [])
     logger.info(
         "Starting service %s on port %d: %s",
         service_cfg.get("name"),

{zscams-2.0.11 → zscams-2.0.13}/zscams/agent/src/services/ssh_forwarder.py

@@ -45,7 +45,6 @@ async def run():
 
     # Add additional SSH options
     ssh_cmd += SSH_OPTIONS
-    os.chmod(PRIVATE_KEY, 0o700)
     logger.info(f"Starting reverse SSH tunnel: {' '.join(ssh_cmd)}")
 
     while True:

{zscams-2.0.11 → zscams-2.0.13}/zscams/agent/src/support/configuration.py

@@ -3,8 +3,9 @@ Configuration loader module
 """
 
 import os
+import shutil
 from pathlib import Path
-from typing import Optional, Type, TypedDict, cast
+from typing import Optional, Type, TypeVar, TypedDict, cast
 import yaml
 
 import zscams
@@ -13,6 +14,8 @@ from zscams.agent.src.support.yaml import YamlIndentedListsDumper, resolve_place
 ROOT_PATH = Path(zscams.__file__).resolve().parent.joinpath("agent")
 CONFIG_PATH = os.path.join(ROOT_PATH.absolute(), "config.yaml")
 
+GetReturnT = TypeVar("GetReturnT")
+
 
 class MissingConfiguration(BaseException):
     """Error when the requisted key is not found"""
@@ -33,8 +36,12 @@ class Configuration:
         return cls.__instance
 
     def __load_config(self):
-        with open(CONFIG_PATH, "r", encoding="utf-8") as f:
-            self.__config = yaml.safe_load(f)
+        try:
+            with open(CONFIG_PATH, "r", encoding="utf-8") as f:
+                self.__config = yaml.safe_load(f)
+        except FileNotFoundError:
+            shutil.copyfile(ROOT_PATH.joinpath("configuration/config.j2"), CONFIG_PATH)
+            self.__load_config()
 
     def override_config(self, new_config: dict):
         """
@@ -56,13 +63,13 @@ class Configuration:
     def to_dict(self):
         return self.__config
 
-    def get[T](
+    def get(
         self,
         key: str,
-        default: Optional[T] = None,
+        default: Optional[GetReturnT] = None,
         must_resolve=False,
-        valtyp: Type[T] = str,
-    ) -> T:
+        valtyp: Type[GetReturnT] = str,
+    ) -> GetReturnT:
         """
         Returns the configuration value.
 
@@ -90,7 +97,7 @@ class Configuration:
                 val = None
                 break
 
-        return cast(T, val)
+        return cast(GetReturnT, val)
 
     def has(self, key: str):
         try:

{zscams-2.0.11 → zscams-2.0.13}/zscams/agent/src/support/os.py

@@ -3,6 +3,7 @@ from pathlib import Path
 import sys
 import subprocess
 import platform
+from typing import Optional
 from zscams.agent.src.support.logger import get_logger
 from zscams.agent.src.support.mac import get_mac_address
 
@@ -22,6 +23,37 @@ def is_freebsd():
     )
 
 
+def set_directory_ownership_and_permissions(
+    directory_path: str | Path,
+    owner_user: Optional[str] = None,
+    mod: Optional[int] = None,
+):
+    if not is_linux() and not is_freebsd():
+        logger.error("Unsupported OS to change directory owner or mod.")
+        return
+
+    if not owner_user and not mod:
+        raise ValueError("You have to provide a user or mod")
+
+    for root, _dirs, files in os.walk(directory_path):
+        if owner_user:
+            os.chown(root, owner_user)
+        if mod:
+            os.chmod(root, mod)
+
+        for name in files:
+            file_path = os.path.join(root, name)
+            if owner_user:
+                os.chown(file_path, owner_user)
+            if mod:
+                os.chmod(file_path, mod)
+
+    if owner_user:
+        os.chown(directory_path, owner_user)
+    if mod:
+        os.chmod(directory_path, mod)
+
+
 def system_user_exists(username: str):
     try:
         subprocess.run(

zscams-2.0.13/zscams/agent/src/support/ssh.py

@@ -0,0 +1,29 @@
+from zscams.agent.src.support.filesystem import append_to_file
+from zscams.agent.src.support.logger import get_logger
+
+
+logger = get_logger("ssh_support")
+
+
+def add_to_known_hosts(user: str, hostname: str, pub_key: str):
+    try:
+        logger.debug("Appending '%s' to known hosts...", pub_key)
+        append_to_file(
+            f"/home/{user}/.ssh/known_hosts",
+            f"{hostname} {pub_key}\n",
+        )
+        logger.debug("Appended key to known hosts")
+    except:
+        pass
+
+
+def add_to_authorized_keys(user: str, pub_key: str):
+    logger.debug(f"Appending to public key to {user}")
+    key = pub_key.split(" ")[1] if len(pub_key.split(" ")) >= 2 else pub_key
+    try:
+        append_to_file(
+            f"/home/{user}/.ssh/authorized_keys",
+            f"ssh-rsa {key} zscams@orangecyberdefense\n",
+        )
+    except:
+        pass

zscams-2.0.11/zscams/agent/configuration/freebsd_service.j2

@@ -1,20 +0,0 @@
-#!/bin/sh
-
-# PROVIDE: zscams
-# REQUIRE: NETWORKING
-# KEYWORD: shutdown
-
-. /etc/rc.subr
-
-name="zscams"
-rcvar="zscams_enable"
-
-# Execution command and arguments
-command="{python_exec}"
-command_args="-m zscams"
-
-# User to run the process
-zscams_user="{user_to_run_as}"
-
-load_rc_config $name
-run_rc_command "$1"

zscams-2.0.11/zscams/agent/src/support/ssh.py

@@ -1,23 +0,0 @@
-from zscams.agent.src.support.filesystem import append_to_file
-from zscams.agent.src.support.logger import get_logger
-
-
-logger = get_logger("ssh_support")
-
-
-def add_to_known_hosts(user: str, hostname: str, pub_key: str):
-    logger.debug("Appending '%s' to known hosts...", pub_key)
-    append_to_file(
-        f"/home/{user}/.ssh/known_hosts",
-        f"{hostname} {pub_key}\n",
-    )
-    logger.debug("Appended key to known hosts")
-
-
-def add_to_authorized_keys(user: str, pub_key: str):
-    logger.debug(f"Appending to public key to {user}")
-    key = pub_key.split(" ")[1] if len(pub_key.split(" ")) >= 2 else pub_key
-    append_to_file(
-        f"/home/{user}/.ssh/authorized_keys",
-        f"ssh-rsa {key} zscams@orangecyberdefense\n",
-    )