cbas - command line interface to the c-bastion

About

This is the command line interface to the *c-bastion* jump host. It allows you to upload an ssh-key-file and create a user on the jump-host, so that you can log into it. It requires an initial connection to auth-server to obtain an (open-id-connect) access token.

The basic flow is as follows:

+-----------+   +-----------+   +-----------+
|           |   |           |   |           |
| developer |   |   auth    |   |   jump    |
|           |   |           |   |           |
+-----------+   +-----------+   +-----------+
      |               |               |
      |               |               |
      +--------------->               |
      | request token |               |
      |               |               |
      <---------------+               |
      | receive token |               |
      |               |               |
      +------------------------------->
      | upload ssh-key|and create user|
      |               |               |
      |               |               |
      +------------------------------->
      | ssh login     |               |
      |               |               |
      |               |               |
      +               +               +

Where developer is your local machine (desktop, laptop, etc..) auth is the auth-server and jump is the jump host. cbas takes care of obtaining the token and uploading the ssh-key.

Install

Use the Python standards, for example:

$ pip install cbas

Quickstart

Install the software.
Ask one of your colleagues for the auth-url, client-secret and jump-host parameters.

Then run the following to upload your key:

$ cbas -a <AUTH-URL> -s <CLIENT-SECRET> -h <JUMP-HOST> upload
...

Then you should be able to login, using:
```
$ ssh <JUMP-HOST>
...
```

Usage

$ cbas --help
Usage: cbas [OPTIONS] COMMAND [ARGS]...

Options:
  -v, --verbose                   Activate verbose mode.
  -c, --config <config_path>      Path to config file. Default: '~/.cbas'.
  -u, --username <username>       Username. Default: the logged in user.
  -k, --ssh-key-file <key-file>   SSH Identity to use. Default:
                                  '~/.ssh/id_rsa.pub'.
  -p, --password-provider <provider>
                                  Password provider. Default: 'prompt'.
  -a, --auth-url <auth_url>       Auth-server URL.
  -s, --client-secret <secret>    Special client secret, ask mum.
  -h, --jump-host <host>          Jump host to connect with.
  --version                       Print version and exit.
  --help                          Show this message and exit.

Commands:
  delete  Delete user.
  dry_run Dry run, sanitize all config only.
  upload  Upload ssh-key and create user.

Options

verbose: This switch activates verbose output, useful in case you are debugging
config: The path to the config file. Note, since we are using the yamlreader package, this could also be a directory with multiple config files. Also, the config is in YAML syntax, see below.
username: The username when communicating with the auth-server. Note that the returned token contains the authenticated username which is subsequently sent to the jump-host. Thus you will not be able to create arbitrary users on the jump-host
ssh-key-file: Path to the public ssh-key-file. This will be uploaded to the jump-host.
password-provider: Where to get the password from. Valid values are prompt and keyring (and testing). prompt will always ask for a password, whereas keyring will ask exactly once and then store the password in the system keyring.
auth-url: The URL to access the auth-server and obtain the token. E.g. https://auth-server.example/oauth/token. (Note that this includes the protocol.
client-secret: A special client secret string needed when communicating with the auth-server.
jump-host: The hostname of the jump-host. E.g. jump-host.example. (Note that this excludes the protocol.)
version: Display version number and exit.
help: Display help and exit.

Subcommands

upload: Upload ssh-key-file and create user.
dry_run: Sanitize and aggregate all options from config-file and command-line. Don’t connect to anything.
delete: Delete your user again. For example: if you uploaded the wrong ssh-key-file.

Config-File

cbas is equipped with a powerful configuration mechanism. All relevant parameters that can be supplied on the command-line can also be supplied in the config-file, for example:

username: acid_burn
ssh-key-file: ~/.ssh/mykey_rsa.pub
auth-url: https://auth-server.example/oauth/token
client-secret: mysupersecret
password-provider: keyring
jump-host: jump-host.example

Please note that, any parameters supplied on the command line will take precedence over those supplied via the config-file. If in doubt, try using the --verbose switch.

License

Licensed under the Apache License, Version 2.0 (the “License”); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Release files for cbas 130

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for cbas 130
File	Size	Uploaded
cbas-130.tar.gz	6.8 kB	Mar 3, 2016	Details

Release files / cbas-130.tar.gz

Download URL	cbas-130.tar.gz
Size	6.8 kB
Tags	Source
SHA-256 checksum How to use checksums	`0d1545031ccc60a6f23f25bfeb41cb5593c4ec20b05e62d1127b91b28d2b8e18`
BLAKE2b-256 checksum How to use checksums	`726eafe5aea750944326215d4cc17cb20db9736f53e9e60984a6d639a211b973`
Upload date	Mar 3, 2016
Uploaded using Trusted Publishing? What is trusted publishing?	No