解决 Jumpserver coco 使用登录用户(ldap)进行SSH连接目标主机，忽略系统用户

前言

　　Jumpserver 作为国内流行的开源堡垒机，很多公司都在尝试使用，同时 Jumpserver 为了契合众多公司的用户认证，也提供了 LDAP 的用户认证方式，作为 Jumpserver 的用户，大家可能知道了 Jumpserver 的 LDAP 认证方式，仅是作为 登录Jumpserver Web UI、登录 Jumpserver 终端(COCO) 的用户认证，进入 Jumpserver 终端（COCO）后，再而跳到目标主机，却需要使用Jumpserver 创建的系统用户，也就是 登录Jumpserver 和 Jumpserver登录目标主机 是需要两个完全没有关系的用户，对于很多基于LDAP用户登录主机的场景，Jumpserver 这种双用户认证概念显得有点鸡肋，既然接入了 LDAP, 我们希望做到 登录Jumpserver 和 Jumpserver跳转主机都使用 LDAP 完成认证登录，带着这一想法，便开始了对 Jumpserver 终端核心 COCO 进行了部分修改。

COCO前后对比

注：LDAP 用户登录Jumpserver coco、选择登录主机后，直接使用登录coco 的用户进行登录主机，取消了选择系统用户的步骤。

详细流程

注1：用户名密码登录 Jumpserver 时，COCO 处理线程存储用户名密码，用于SSH 连接目标主机；

注2：公钥登录 Jumpserver 时，COCO 处理线程存储用户名和空密码，SSH 连接目标主机时，根据用户名从COCO本地查找密码，有则使用，无则提示输出密码；

注3：SSH 连接认证失败可尝试输入密码尝试三次，认证成功则向本地存储最近一次连接成功的加密密码。

代码实现

修改 coco/models.py，添加 password 参数

class Request:
    def __init__(self, addr):
        self.type = []
        self.meta = {"width": 80, "height": 24}
        self.user = None
        self.password = ''     # @ 周旺
        self.addr = addr
        self.remote_ip = self.addr[0]
        self.change_size_event = threading.Event()
        self.date_start = datetime.datetime.now()
    

class Client:
    def __init__(self, chan, request):
        self.chan = chan
        self.request = request
        self.user = request.user
        self.password = request.password    # @ 周旺
        self.addr = request.addr

修改 coco/interface.py， 赋值 request.password 

class SSHInterface(paramiko.ServerInterface):
    def validate_auth(self, username, password="", public_key=""):
        info = app_service.authenticate(
            username, password=password, public_key=public_key,
            remote_addr=self.request.remote_ip
        )
        user = info.get('user', None)
        if user:
            self.request.user = user
            self.request.password = password   # request password 赋值 @ 周旺
            self.info = info

        seed = info.get('seed', None)
        token = info.get('token', None)
        if seed and not token:
            self.otp_auth = True

        return user

修改 coco/interactive.py 

class InteractiveServer:
    def display_search_result(self):
        sort_by = current_app.config["ASSET_LIST_SORT_BY"]
        self.search_result = sort_assets(self.search_result, sort_by)
        fake_data = [_("ID"), _("Hostname"), _("IP"), _("LoginAs")]
        id_length = max(len(str(len(self.search_result))), 4)
        hostname_length = item_max_length(self.search_result, 15,
                                          key=lambda x: x.hostname)
        sysuser_length = item_max_length(self.search_result,
                                         key=lambda x: x.system_users_name_list)
        size_list = [id_length, hostname_length, 16, sysuser_length]
        header_without_comment = format_with_zh(size_list, *fake_data)
        comment_length = max(
            self.request.meta["width"] -
            size_of_str_with_zh(header_without_comment) - 1,
            2
        )
        size_list.append(comment_length)
        fake_data.append(_("Comment"))
        self.client.send(wr(title(format_with_zh(size_list, *fake_data))))
        for index, asset in enumerate(self.search_result, 1):
            # data = [                                      # 注释主机显示列表  @ 周旺
            #     index, asset.hostname, asset.ip,
            #     asset.system_users_name_list, asset.comment
            # ]

            data = [                                        # 主机显示列表 @ 周旺
                index, asset.hostname, asset.ip,
                self.client.user.username, asset.comment
            ]

            self.client.send(wr(format_with_zh(size_list, *data)))
        self.client.send(wr(_("总共: {} 匹配: {}").format(
            len(self.assets), len(self.search_result)), before=1)
        )

    def proxy(self, asset):
        # system_user = self.choose_system_user(asset.system_users_granted)   # 注释 @ 周旺
        # if system_user is None:
        #     self.client.send(_("没有系统用户"))
        #     return
        system_user = self.client.user      # 修改系统用户为登录用户 @ 周旺   注： 仍保持system_user 变量名，后面所有 system_user 皆是登录用户
        password = self.client.password     # 密码 @ 周旺   --> by client -> by request
        forwarder = ProxyServer(self.client)
        forwarder.proxy(asset, system_user, password)  # password @ 周旺

修改 coco/proxy.py

class ProxyServer:
    def proxy(self, asset, system_user, password=''):  # 添加 password 参数 @ 周旺
        #self.get_system_user_auth(system_user)        # 注释 @ 周旺

        if not password:                                # 添加46-74行 @ 周旺
            with open('/opt/pwd/%s.pwd' % system_user.username, 'ab+') as pwd:    # 查找本地缓存密码
                pwd.seek(0)
                try:
                    password = base64.b64decode(pwd.read().strip()).decode().strip()
                    # password = pwd.read().strip()
                except:
                    password = ''

            if not password:
                prompt = "{}@{} password: ".format(system_user.username, asset.ip)
                password = net_input(self.client, prompt=prompt, sensitive=True)

        for n in range(4):
            self.connecting = True
            self.send_connecting_message(asset, system_user)
            self.server = self.get_server_conn(asset, system_user, password)
            if self.server:
                with open('/opt/pwd/%s.pwd' % system_user.username, 'wb') as pwd:    # 保存最后一次的正确密码
                    pwd.write(base64.b64encode(password.encode(encoding='utf-8')))
                    #pwd.write(password)
                break

            if n < 3:
                prompt = "{}@{} password({}/3): ".format(system_user.username, asset.ip, n+1)
                password = net_input(self.client, prompt=prompt, sensitive=True)
        else:
            return False


        # self.send_connecting_message(asset, system_user)                  # 注释 @ 周旺
        # self.server = self.get_server_conn(asset, system_user, password)

        command_recorder = current_app.new_command_recorder()
        replay_recorder = current_app.new_replay_recorder()
        session = Session(
            self.client, self.server,
            command_recorder=command_recorder,
            replay_recorder=replay_recorder,
        )
        current_app.add_session(session)
        self.watch_win_size_change_async()
        session.bridge()
        self.stop_event.set()
        self.end_watch_win_size_change()
        current_app.remove_session(session)

    def get_server_conn(self, asset, system_user, password=''):  # 添加 password 参数 @ 周旺
        logger.info("Connect to {}".format(asset.hostname))
        # if not self.validate_permission(asset, system_user):    # 注释 @ 周旺
        #     self.client.send(warning('No permission'))
        #     return None
        # if True:
        #     server = self.get_ssh_server_conn(asset, system_user)
        # else:
        #     server = self.get_ssh_server_conn(asset, system_user)

        server = self.get_ssh_server_conn(asset, system_user, password) # password @ 周旺
        return server

    def get_ssh_server_conn(self, asset, system_user, password=''): # 添加 password 参数 @ 周旺
        request = self.client.request
        term = request.meta.get('term', 'xterm')
        width = request.meta.get('width', 80)
        height = request.meta.get('height', 24)
        ssh = SSHConnection()
        chan, sock, msg = ssh.get_channel(
            asset, system_user, term=term, width=width, height=height, password=password)   # password @ 周旺
        if not chan:
            self.client.send(warning(wr(msg, before=1, after=0)))
            server = None
        else:
            server = Server(chan, sock, asset, system_user)
        self.connecting = False
        self.client.send(b'
')
        return server

    def send_connecting_message(self, asset, system_user):
        def func():
            delay = 0.0
            self.client.send('Connecting to {}@{} {:.1f}'.format(
                system_user.username, asset.ip, delay)          # 修改为 用户名，ip地址 @ 周旺
            )
            while self.connecting and delay < TIMEOUT:
                self.client.send('x08x08x08{:.1f}'.format(delay).encode())
                time.sleep(0.1)
                delay += 0.1
        thread = threading.Thread(target=func)
        thread.start()

 修改 coco/connection.py

class SSHConnection:
    def get_ssh_client(self, asset, system_user, password=''):  # 添加 password 参数 @ 周旺
        ssh = paramiko.SSHClient()
        ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
        sock = None

        # if not system_user.password and not system_user.private_key:    # 注释 @ 周旺
        #     self.get_system_user_auth(system_user)

        if asset.domain:
            sock = self.get_proxy_sock_v2(asset)
        try:
            ssh.connect(
                asset.ip, port=asset.port, username=system_user.username,
                #password=system_user.password, pkey=system_user.private_key,  # 注释 @ 周旺
                password=password,                                             # password @ 周旺
                timeout=TIMEOUT, compress=True, auth_timeout=TIMEOUT,
                look_for_keys=False, sock=sock
            )
        except (paramiko.AuthenticationException,
                paramiko.BadAuthenticationType,
                SSHException) as e:
            # password_short = "None"                                       # 注释 @ 周旺  注：感觉没啥用
            # key_fingerprint = "None"
            # if system_user.password:
            #     password_short = system_user.password[:5] + 
            #                      (len(system_user.password) - 5) * '*'
            # if system_user.private_key:
            #     key_fingerprint = get_private_key_fingerprint(
            #         system_user.private_key
            #     )
            #
            # logger.error("Connect {}@{}:{} auth failed, password: 
            #                      {}, key: {}".format(
            #     system_user.username, asset.ip, asset.port,
            #     password_short, key_fingerprint,
            # ))
            return None, None, str(e)
        except (socket.error, TimeoutError) as e:
            return None, None, str(e)
        return ssh, sock, None

    def get_channel(self, asset, system_user, term="xterm", width=80, height=24, password=''):  # password 参数 @ 周旺
        ssh, sock, msg = self.get_ssh_client(asset, system_user, password) # password @ 周旺
        if ssh:
            chan = ssh.invoke_shell(term, width=width, height=height)
            return chan, sock, None
        else:
            return None, sock, msg

效果展示

 后记

　　以上仅适用 jumpserver 终端命令行，没有涉及对jumpserver web 终端及SFTP的修改。

      谢 jumpserver 团队：http://www.jumpserver.org/