A SSH client (sudo capable) as a REST service to execute remote recipes (sequence of commands) by SSH, included SUDO commands. It also returns the stdout and stderr filled for these commands executed in the target server. This service does not require any kind of "agent" installed in the target servers
APACHE-2.0 License
This is a service to execute receipts (sequence of shell commands) to remote servers by ssh. Included sudo commands !!! In addition, it returns in its response the standard-output, as well as the standard-error for each executed command. Every call to the service can launch so many commands as it's required.
To make it work, you don't need to install any agents in the target servers. The only you have to do is create a user account in target servers. In addition, if the recipes you want to execute in these servers include sudo commands, this user account must have sudo privileges. Basically, Sudo privileges are required only if you want to execute a recipe that includes sudo commands. Done that, the service will use this user account to connect by SSH to the remote server, It also will be used to make the remote sudo if the executing command requires it.
By using SSH to make the recipes remotely, you have all security context SSH provides. To make a remote server able to be operated by this service, it must to have the user account the SSH Executor service uses to connect. In addition, if the recipes to be executed in this server include sudo commands, the user account has to be suoder.
On another hand, future versions of this service will allow the use of key exchange as password method replacement. It's pending to be coded.
Saying that still is necessary to fill the SSH user password as an environment variable for the service. You should inject it into the container when it starts in a safe way.
It's not supported the shell commands with 'su', like 'sudo su another user'. It's because the 'su' command starts a new shell process for the new user. When that occurs, these new shell has its own stdout,stdin and stderr. Which can't be captured by the ssh client. From there execution flux is lost and the recipe hangs.
There are six environment variables which must be set to make the service run:
This service published two endpoints:
The rq message is a JSON message with these fields:
The rq message is a JSON message with these fields:
Rq:
{
"host":"myhost.mydomain.com",
"port":22,
"recipe":[
"date",
"uname -a",
"df -h > myfile.txt",
"cat myfile.txt"
]
}
Rs:
{
"response": [
"dv jun 21 03:50:55 CEST 2019\r\n",
"Linux mx 4.19.0-5-amd64 #1 SMP Debian 4.19.37-2~mx17+1 (2019-05-15) x86_64 GNU/Linux\r\n",
"",
"S. fitxers Mida En s Lliure %s Muntat a\r\nudev 3,8G 0 3,8G 0% /dev\r\ntmpfs 777M 1,4M 776M 1% /run\r\n/dev/mapper/rootfs 108G 7,3G 95G 8% /\r\ntmpfs 5,0M 4,0K 5,0M 1% /run/lock\r\ntmpfs 1,6G 58M 1,5G 4% /run/shm\r\n/dev/sda1 487M 82M 376M 18% /boot\r\ncgroup 12K 0 12K 0% /sys/fs/cgroup\r\ntmpfs 777M 4,0K 777M 1% /run/user/115\r\ntmpfs 777M 24K 777M 1% /run/user/1000\r\n"
],
"responseErr": "",
"error": ""
}
Rq:
{
"host":"192.168.1.39",
"port":22,
"recipe":[
"sudo ls -lart /root/.bashrc",
"sudo date > myfile.txt",
"sudo cat myfile.txt"
]
}
Rs:
{
"response": [
"-rw-r--r-- 1 root root 570 gen 31 2010 /root/.bashrc\r\n",
"",
"dv jun 21 04:04:40 CEST 2019\r\n"
],
"responseErr": "",
"error": ""
}
The service is dockerized. So if you start it as a Docker container, only need to do:
make docker-build
docker-compose up
Alternatively, you also can run as a local service. In this case, you must do:
make build
cmd
This service has been coded using gin-gonic to build the REST API, and the ssh Go package to build the SSH logic.
I've also used Alpine Linux to build the Docker images, achieving really light ones:
docker image list
REPOSITORY TAG IMAGE ID CREATED SIZE
sshexecutor latest de80807f2fc3 18 hours ago 23.8MB
These are the packages that conforms the service:
The Go version employed has been go1.12.6 with modules enabled
Think and build this tool, has taken part of my time and effort. If you find it useful, and you think I deserve it, you can invite me a coffee :-)