AUTH-1941: Adds initial SSH server implementation

sshserver/sshserver.go

@@ -0,0 +1,168 @@
+package sshserver
+
+import (
+	"bufio"
+	"fmt"
+	"github.com/pkg/errors"
+	"io"
+	"os"
+	"os/exec"
+	"os/user"
+	"strconv"
+	"syscall"
+	"unsafe"
+
+	"github.com/creack/pty"
+	"github.com/gliderlabs/ssh"
+	"github.com/sirupsen/logrus"
+)
+
+type SSHServer struct {
+	ssh.Server
+	logger    *logrus.Logger
+	shutdownC chan struct{}
+}
+
+const DefaultShellPrompt = `\e[0;31m[\u@\h \W]\$ \e[m `
+
+func New(logger *logrus.Logger, address string, shutdownC chan struct{}) (*SSHServer, error) {
+	currentUser, err := user.Current()
+	if err != nil {
+		return nil, err
+	}
+	if currentUser.Uid != "0" {
+		return nil, errors.New("cloudflared ssh server needs to run as root")
+	}
+
+	sshServer := SSHServer{ssh.Server{Addr: address}, logger, shutdownC}
+	return &sshServer, nil
+}
+
+func (s *SSHServer) Start() error {
+	s.logger.Infof("Starting SSH server at %s", s.Addr)
+
+	go func() {
+		<-s.shutdownC
+		if err := s.Close(); err != nil {
+			s.logger.WithError(err).Error("Cannot close SSH server")
+		}
+	}()
+
+	s.Handle(s.connectionHandler)
+	return s.ListenAndServe()
+}
+
+func (s *SSHServer) connectionHandler(session ssh.Session) {
+
+	// Get uid and gid of user attempting to login
+	uid, gid, err := getUser(session.User())
+	if err != nil {
+		if _, err := io.WriteString(session, "Invalid credentials\n"); err != nil {
+			s.logger.WithError(err).Error("Invalid credentials: Failed to write to SSH session")
+		}
+		if err := session.Exit(1); err != nil {
+			s.logger.WithError(err).Error("Failed to close SSH session")
+		}
+		return
+	}
+
+	// Spawn shell under user
+	cmd := exec.Command("/bin/bash")
+	cmd.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: uid, Gid: gid}}
+
+	ptyReq, winCh, isPty := session.Pty()
+	if !isPty {
+		if _, err := io.WriteString(session, "No PTY requested.\n"); err != nil {
+			s.logger.WithError(err).Error("No PTY requested: Failed to write to SSH session")
+		}
+
+		if err := session.Exit(1); err != nil {
+			s.logger.WithError(err).Error("Failed to close SSH session")
+		}
+		return
+	}
+
+	cmd.Env = append(cmd.Env, fmt.Sprintf("TERM=%s", ptyReq.Term))
+	cmd.Env = append(cmd.Env, fmt.Sprintf("PS1=%s", DefaultShellPrompt))
+	psuedoTTY, err := pty.Start(cmd)
+	if err != nil {
+		s.logger.WithError(err).Error("Failed to start pty session")
+		if err := session.Exit(1); err != nil {
+			s.logger.WithError(err).Error("Failed to close SSH session")
+		}
+		close(s.shutdownC)
+		return
+	}
+
+	// Handle terminal window size changes
+	go func() {
+		for win := range winCh {
+			if errNo := setWinsize(psuedoTTY, win.Width, win.Height); errNo != 0 {
+				s.logger.WithError(err).Error("Failed to set pty window size: ", err.Error())
+				if err := session.Exit(1); err != nil {
+					s.logger.WithError(err).Error("Failed to close SSH session")
+				}
+				close(s.shutdownC)
+				return
+			}
+		}
+	}()
+
+	// Write incoming commands to PTY
+	go func() {
+		if _, err := io.Copy(psuedoTTY, session); err != nil {
+			s.logger.WithError(err).Error("Failed to write incoming command to pty")
+		}
+	}()
+	pr, pw := io.Pipe()
+	scanner := bufio.NewScanner(pr)
+	go func() {
+		for scanner.Scan() {
+			s.logger.Info(scanner.Text())
+		}
+	}()
+
+	// Write outgoing command output to both the command recorder, and remote user
+	mw := io.MultiWriter(pw, session)
+	if _, err := io.Copy(mw, psuedoTTY); err != nil {
+		s.logger.WithError(err).Error("Failed to write command output to user")
+	}
+
+	if err := pw.Close(); err != nil {
+		s.logger.WithError(err).Error("Failed to close pipe writer")
+	}
+
+	if err := pr.Close(); err != nil {
+		s.logger.WithError(err).Error("Failed to close pipe reader")
+	}
+
+	// Wait for all resources associated with cmd to be released
+	// Returns error if shell exited with a non-zero status or received a signal
+	if err := cmd.Wait(); err != nil {
+		s.logger.WithError(err).Debug("Shell did not close correctly")
+	}
+}
+
+// Sets PTY window size for terminal
+func setWinsize(f *os.File, w, h int) syscall.Errno {
+	_, _, errNo := syscall.Syscall(syscall.SYS_IOCTL, f.Fd(), uintptr(syscall.TIOCSWINSZ),
+		uintptr(unsafe.Pointer(&struct{ h, w, x, y uint16 }{uint16(h), uint16(w), 0, 0})))
+	return errNo
+}
+
+// Only works on POSIX systems
+func getUser(username string) (uint32, uint32, error) {
+	sshUser, err := user.Lookup(username)
+	if err != nil {
+		return 0, 0, err
+	}
+	uid, err := strconv.ParseUint(sshUser.Uid, 10, 32)
+	if err != nil {
+		return 0, 0, err
+	}
+	gid, err := strconv.ParseUint(sshUser.Gid, 10, 32)
+	if err != nil {
+		return 0, 0, err
+	}
+	return uint32(uid), uint32(gid), nil
+}