解决 Jumpserver coco 使用登录用户(ldap)进行SSH连接目标主机，忽略系统用户

前言

　　Jumpserver 作为国内流行的开源堡垒机，很多公司都在尝试使用，同时 Jumpserver 为了契合众多公司的用户认证，也提供了 LDAP 的用户认证方式，作为 Jumpserver 的用户，大家可能知道了 Jumpserver 的 LDAP 认证方式，仅是作为 登录Jumpserver Web UI、登录 Jumpserver 终端(COCO) 的用户认证，进入 Jumpserver 终端（COCO）后，再而跳到目标主机，却需要使用Jumpserver 创建的系统用户，也就是 登录Jumpserver 和 Jumpserver登录目标主机 是需要两个完全没有关系的用户，对于很多基于LDAP用户登录主机的场景，Jumpserver 这种双用户认证概念显得有点鸡肋，既然接入了 LDAP, 我们希望做到 登录Jumpserver 和 Jumpserver跳转主机都使用 LDAP 完成认证登录，带着这一想法，便开始了对 Jumpserver 终端核心 COCO 进行了部分修改。

COCO前后对比

注：LDAP 用户登录Jumpserver coco、选择登录主机后，直接使用登录coco 的用户进行登录主机，取消了选择系统用户的步骤。

详细流程

注1：用户名密码登录 Jumpserver 时，COCO 处理线程存储用户名密码，用于SSH 连接目标主机；

注2：公钥登录 Jumpserver 时，COCO 处理线程存储用户名和空密码，SSH 连接目标主机时，根据用户名从COCO本地查找密码，有则使用，无则提示输出密码；

注3：SSH 连接认证失败可尝试输入密码尝试三次，认证成功则向本地存储最近一次连接成功的加密密码。

代码实现

修改 coco/models.py，添加 password 参数

 class Request:
     def __init__(self, addr):
         self.type = []
         self.meta = {"width": 80, "height": 24}
         self.user = None
         self.password = ''     # @ 周旺
         self.addr = addr
         self.remote_ip = self.addr[0]
         self.change_size_event = threading.Event()
         self.date_start = datetime.datetime.now()

 class Client:
     def __init__(self, chan, request):
         self.chan = chan
         self.request = request
         self.user = request.user
         self.password = request.password    # @ 周旺
         self.addr = request.addr

修改 coco/interface.py， 赋值 request.password 

 class SSHInterface(paramiko.ServerInterface):
     def validate_auth(self, username, password="", public_key=""):
         info = app_service.authenticate(
             username, password=password, public_key=public_key,
             remote_addr=self.request.remote_ip
         )
         user = info.get('user', None)
         if user:
             self.request.user = user
             self.request.password = password   # request password 赋值 @ 周旺
             self.info = info

         seed = info.get('seed', None)
         token = info.get('token', None)
         if seed and not token:
             self.otp_auth = True

         return user

修改 coco/interactive.py 

 class InteractiveServer:
     def display_search_result(self):
         sort_by = current_app.config["ASSET_LIST_SORT_BY"]
         self.search_result = sort_assets(self.search_result, sort_by)
         fake_data = [_("ID"), _("Hostname"), _("IP"), _("LoginAs")]
         id_length = max(len(str(len(self.search_result))), 4)
         hostname_length = item_max_length(self.search_result, 15,
                                           key=lambda x: x.hostname)
         sysuser_length = item_max_length(self.search_result,
                                          key=lambda x: x.system_users_name_list)
         size_list = [id_length, hostname_length, 16, sysuser_length]
         header_without_comment = format_with_zh(size_list, *fake_data)
         comment_length = max(
             self.request.meta["width"] -
             size_of_str_with_zh(header_without_comment) - 1,
             2
         )
         size_list.append(comment_length)
         fake_data.append(_("Comment"))
         self.client.send(wr(title(format_with_zh(size_list, *fake_data))))
         for index, asset in enumerate(self.search_result, 1):
             # data = [                                      # 注释主机显示列表  @ 周旺
             #     index, asset.hostname, asset.ip,
             #     asset.system_users_name_list, asset.comment
             # ]

             data = [                                        # 主机显示列表 @ 周旺
                 index, asset.hostname, asset.ip,
                 self.client.user.username, asset.comment
             ]

             self.client.send(wr(format_with_zh(size_list, *data)))
         self.client.send(wr(_("总共: {} 匹配: {}").format(
             len(self.assets), len(self.search_result)), before=1)
         )

     def proxy(self, asset):
         # system_user = self.choose_system_user(asset.system_users_granted)   # 注释 @ 周旺
         # if system_user is None:
         #     self.client.send(_("没有系统用户"))
         #     return
         system_user = self.client.user      # 修改系统用户为登录用户 @ 周旺   注： 仍保持system_user 变量名，后面所有 system_user 皆是登录用户
         password = self.client.password     # 密码 @ 周旺   --> by client -> by request
         forwarder = ProxyServer(self.client)
         forwarder.proxy(asset, system_user, password)  # password @ 周旺

修改 coco/proxy.py

 class ProxyServer:
     def proxy(self, asset, system_user, password=''):  # 添加 password 参数 @ 周旺
         #self.get_system_user_auth(system_user)        # 注释 @ 周旺

         if not password:                                # 添加46-74行 @ 周旺
             with open('/opt/pwd/%s.pwd' % system_user.username, 'ab+') as pwd:    # 查找本地缓存密码
                 pwd.seek(0)
                 try:
                     password = base64.b64decode(pwd.read().strip()).decode().strip()
                     # password = pwd.read().strip()
                 except:
                     password = ''

             if not password:
                 prompt = "{}@{} password: ".format(system_user.username, asset.ip)
                 password = net_input(self.client, prompt=prompt, sensitive=True)

         for n in range(4):
             self.connecting = True
             self.send_connecting_message(asset, system_user)
             self.server = self.get_server_conn(asset, system_user, password)
             if self.server:
                 with open('/opt/pwd/%s.pwd' % system_user.username, 'wb') as pwd:    # 保存最后一次的正确密码
                     pwd.write(base64.b64encode(password.encode(encoding='utf-8')))
                     #pwd.write(password)
                 break

             if n < 3:
                 prompt = "{}@{} password({}/3): ".format(system_user.username, asset.ip, n+1)
                 password = net_input(self.client, prompt=prompt, sensitive=True)
         else:
             return False

         # self.send_connecting_message(asset, system_user)                  # 注释 @ 周旺
         # self.server = self.get_server_conn(asset, system_user, password)

         command_recorder = current_app.new_command_recorder()
         replay_recorder = current_app.new_replay_recorder()
         session = Session(
             self.client, self.server,
             command_recorder=command_recorder,
             replay_recorder=replay_recorder,
         )
         current_app.add_session(session)
         self.watch_win_size_change_async()
         session.bridge()
         self.stop_event.set()
         self.end_watch_win_size_change()
         current_app.remove_session(session)

     def get_server_conn(self, asset, system_user, password=''):  # 添加 password 参数 @ 周旺
         logger.info("Connect to {}".format(asset.hostname))
         # if not self.validate_permission(asset, system_user):    # 注释 @ 周旺
         #     self.client.send(warning('No permission'))
         #     return None
         # if True:
         #     server = self.get_ssh_server_conn(asset, system_user)
         # else:
         #     server = self.get_ssh_server_conn(asset, system_user)
 
         server = self.get_ssh_server_conn(asset, system_user, password) # password @ 周旺
         return server

     def get_ssh_server_conn(self, asset, system_user, password=''): # 添加 password 参数 @ 周旺
         request = self.client.request
         term = request.meta.get('term', 'xterm')
         width = request.meta.get('width', 80)
         height = request.meta.get('height', 24)
         ssh = SSHConnection()
         chan, sock, msg = ssh.get_channel(
             asset, system_user, term=term, width=width, height=height, password=password)   # password @ 周旺
         if not chan:
             self.client.send(warning(wr(msg, before=1, after=0)))
             server = None
         else:
             server = Server(chan, sock, asset, system_user)
         self.connecting = False
         self.client.send(b'\r\n')
         return server

     def send_connecting_message(self, asset, system_user):
         def func():
             delay = 0.0
             self.client.send('Connecting to {}@{} {:.1f}'.format(
                 system_user.username, asset.ip, delay)          # 修改为 用户名，ip地址 @ 周旺
             )
             while self.connecting and delay < TIMEOUT:
                 self.client.send('\x08\x08\x08{:.1f}'.format(delay).encode())
                 time.sleep(0.1)
                 delay += 0.1
         thread = threading.Thread(target=func)
         thread.start()

 修改 coco/connection.py

 class SSHConnection:
     def get_ssh_client(self, asset, system_user, password=''):  # 添加 password 参数 @ 周旺
         ssh = paramiko.SSHClient()
         ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
         sock = None

         # if not system_user.password and not system_user.private_key:    # 注释 @ 周旺
         #     self.get_system_user_auth(system_user)

         if asset.domain:
             sock = self.get_proxy_sock_v2(asset)
         try:
             ssh.connect(
                 asset.ip, port=asset.port, username=system_user.username,
                 #password=system_user.password, pkey=system_user.private_key,  # 注释 @ 周旺
                 password=password,                                             # password @ 周旺
                 timeout=TIMEOUT, compress=True, auth_timeout=TIMEOUT,
                 look_for_keys=False, sock=sock
             )
         except (paramiko.AuthenticationException,
                 paramiko.BadAuthenticationType,
                 SSHException) as e:
             # password_short = "None"                                       # 注释 @ 周旺  注：感觉没啥用
             # key_fingerprint = "None"
             # if system_user.password:
             #     password_short = system_user.password[:5] + \
             #                      (len(system_user.password) - 5) * '*'
             # if system_user.private_key:
             #     key_fingerprint = get_private_key_fingerprint(
             #         system_user.private_key
             #     )
             #
             # logger.error("Connect {}@{}:{} auth failed, password: \
             #                      {}, key: {}".format(
             #     system_user.username, asset.ip, asset.port,
             #     password_short, key_fingerprint,
             # ))
             return None, None, str(e)
         except (socket.error, TimeoutError) as e:
             return None, None, str(e)
         return ssh, sock, None

     def get_channel(self, asset, system_user, term="xterm", width=80, height=24, password=''):  # password 参数 @ 周旺
         ssh, sock, msg = self.get_ssh_client(asset, system_user, password) # password @ 周旺
         if ssh:
             chan = ssh.invoke_shell(term, width=width, height=height)
             return chan, sock, None
         else:
             return None, sock, msg

效果展示

后记

　　以上仅适用 jumpserver 终端命令行，没有涉及对jumpserver web 终端及SFTP的修改。

谢 jumpserver 团队：http://www.jumpserver.org/