Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Removing default karaf.key #901

Merged
merged 1 commit into from
Jul 30, 2019
Merged

Removing default karaf.key #901

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion assemblies/features/base/src/main/resources/resources/etc/keys.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@
#

#
# For security reason, the default auto-signed key is disabled.
# This is an example of how to associate a public key with a user.
# The user guide describes how to generate/update the key.
#
#karaf=AAAAB3NzaC1kc3MAAACBAP1/U4EddRIpUt9KnC7s5Of2EbdSPO9EAMMeP4C2USZpRV1AIlH7WT2NWPq/xfW6MPbLm1Vs14E7gB00b/JmYLdrmVClpJ+f6AR7ECLCT7up1/63xhv4O1fnxqimFQ8E+4P208UewwI1VBNaFpEy9nXzrith1yrv8iIDGZ3RSAHHAAAAFQCXYFCPFSMLzLKSuYKi64QL8Fgc9QAAAIEA9+GghdabPd7LvKtcNrhXuXmUr7v6OuqC+VdMCz0HgmdRWVeOutRZT+ZxBxCBgLRJFnEj6EwoFhO3zwkyjMim4TwWeotUfI0o4KOuHiuzpnWRbqN/C/ohNWLx+2J6ASQ7zKTxvqhRkImog9/hWuWfBpKLZl6Ae1UlZAFMO/7PSSoAAACBAKKSU2PFl/qOLxIwmBZPPIcJshVe7bVUpFvyl3BbJDow8rXfskl8wO63OzP/qLmcJM0+JbcRU/53JjTuyk31drV2qxhIOsLDC9dGCWj47Y7TyhPdXh/0dthTRBy6bqGtRPxGa7gJov1xm/UuYYXPIUR/3x9MAZvZ5xvE0kYXO+rx,_g_:admingroup
Expand Down
22 changes: 0 additions & 22 deletions client/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,35 +87,13 @@
META-INF;-split-package:=merge-first
</Private-Package>
<Include-Resource>
../shell/ssh/src/main/resources/karaf.key,
{maven-resources}
</Include-Resource>
<Import-Package>!*</Import-Package>
</instructions>
<unpackBundle>true</unpackBundle>
</configuration>
</plugin>
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>build-helper-maven-plugin</artifactId>
<executions>
<execution>
<id>attach-artifacts</id>
<phase>package</phase>
<goals>
<goal>attach-artifact</goal>
</goals>
<configuration>
<artifacts>
<artifact>
<file>target/classes/karaf.key</file>
<type>key</type>
</artifact>
</artifacts>
</configuration>
</execution>
</executions>
</plugin>
</plugins>
</build>
</project>
32 changes: 6 additions & 26 deletions client/src/main/java/org/apache/karaf/client/Main.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,10 +25,8 @@
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.io.ObjectInputStream;
import java.io.Reader;
import java.lang.reflect.Proxy;
import java.net.URL;
import java.nio.charset.Charset;
import java.nio.file.Paths;
import java.security.KeyPair;
Expand Down Expand Up @@ -141,7 +139,7 @@ public String getUpdatedPassword(ClientSession session, String prompt, String la
}
});
}

if (config.getUser()==null || config.getUser().isEmpty()) {
while (true) {
String user = console.readLine("Enter user: ");
Expand All @@ -157,7 +155,7 @@ public String getUpdatedPassword(ClientSession session, String prompt, String la
else if (console != null) {
console.printf("Logging in as %s\n", config.getUser());
}

setupAgent(config.getUser(), config.getKeyFile(), client, passwordProvider);

// define hearbeat (for the keep alive) and timeouts
Expand Down Expand Up @@ -216,7 +214,7 @@ else if (console != null) {
if (channel.getExitStatus() != null) {
exitStatus = channel.getExitStatus();
}

} else {
ChannelShell channel = session.createShellChannel();
Attributes attributes = terminal.enterRawMode();
Expand Down Expand Up @@ -354,8 +352,7 @@ private static int getFlag(Attributes attributes, LocalFlag flag) {

private static void setupAgent(String user, String keyFile, SshClient client, FilePasswordProvider passwordProvider) {
SshAgent agent;
URL builtInPrivateKey = Main.class.getClassLoader().getResource("karaf.key");
agent = startAgent(user, builtInPrivateKey, keyFile, passwordProvider);
agent = startAgent(user, keyFile, passwordProvider);
client.setAgentFactory(new LocalAgentFactory(agent));
client.getProperties().put(SshAgent.SSH_AUTHSOCKET_ENV_NAME, "local");
}
Expand All @@ -380,40 +377,23 @@ private static ClientSession connectWithRetries(SshClient client, ClientConfig c
return session;
}

private static SshAgent startAgent(String user, URL privateKeyUrl, String keyFile, FilePasswordProvider passwordProvider) {
InputStream is = null;
private static SshAgent startAgent(String user, String keyFile, FilePasswordProvider passwordProvider) {
try {
SshAgent agent = new AgentImpl();
is = privateKeyUrl.openStream();
ObjectInputStream r = new ObjectInputStream(is);
KeyPair keyPair = (KeyPair) r.readObject();
is.close();
agent.addIdentity(keyPair, user);
if (keyFile != null) {
FileKeyPairProvider fileKeyPairProvider = new FileKeyPairProvider(Paths.get(keyFile));
fileKeyPairProvider.setPasswordFinder(passwordProvider);
for (KeyPair key : fileKeyPairProvider.loadKeys()) {
agent.addIdentity(key, user);
agent.addIdentity(key, user);
}
}
return agent;
} catch (Throwable e) {
close(is);
System.err.println("Error starting ssh agent for: " + e.getMessage());
return null;
}
}

private static void close(Closeable is) {
if (is != null) {
try {
is.close();
} catch (IOException e1) {
// Ignore
}
}
}

private static void registerSignalHandler(final Terminal terminal, final PtyCapableChannelSession channel) {
try {
Class<?> signalClass = Class.forName("sun.misc.Signal");
Expand Down
Binary file removed client/src/main/key/karaf.key
View file
Open in desktop
Binary file not shown.
12 changes: 0 additions & 12 deletions manual/src/main/asciidoc/user-guide/security.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -360,18 +360,6 @@ The keys allowed to connect are stored in `etc/keys.properties` file, following
user=key,role
----

By default, Karaf allows a key for the karaf user:

----
#karaf=AAAAB3NzaC1kc3MAAACBAP1/U4EddRIpUt9KnC7s5Of2EbdSPO9EAMMeP4C2USZpRV1AIlH7WT2NWPq/xfW6MPbLm1Vs14E7gB00b/JmYLdrmVClpJ+f6AR7ECLCT7up1/63xhv4O1fnxqimFQ8E+4P208UewwI1VBNaFpEy9nXzrith1yrv8iIDGZ3RSAHHAAAAFQCXYFCPFSMLzLKSuYKi64QL8Fgc9QAAAIEA9+GghdabPd7LvKtcNrhXuXmUr7v6OuqC+VdMCz0HgmdRWVeOutRZT+ZxBxCBgLRJFnEj6EwoFhO3zwkyjMim4TwWeotUfI0o4KOuHiuzpnWRbqN/C/ohNWLx+2J6ASQ7zKTxvqhRkImog9/hWuWfBpKLZl6Ae1UlZAFMO/7PSSoAAACBAKKSU2PFl/qOLxIwmBZPPIcJshVe7bVUpFvyl3BbJDow8rXfskl8wO63OzP/qLmcJM0+JbcRU/53JjTuyk31drV2qxhIOsLDC9dGCWj47Y7TyhPdXh/0dthTRBy6bqGtRPxGa7gJov1xm/UuYYXPIUR/3x9MAZvZ5xvE0kYXO+rx,_g_:admingroup
_g_\:admingroup = group,admin,manager,viewer,systembundles,ssh
----

[NOTE]
====
For security reason, this key is disabled. We encourage to create the keys pair per client and update the `etc/keys.properties` file.
====

The easiest way to create key pair is to use OpenSSH.

You can create a key pair using:
Expand Down
9 changes: 0 additions & 9 deletions shell/ssh/src/main/java/org/apache/karaf/shell/ssh/KarafAgentFactory.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,10 +19,6 @@
package org.apache.karaf.shell.ssh;

import java.io.IOException;
import java.io.InputStream;
import java.io.ObjectInputStream;
import java.net.URL;
import java.security.KeyPair;
import java.util.List;
import java.util.Map;
import java.util.concurrent.ConcurrentHashMap;
Expand Down Expand Up @@ -105,11 +101,6 @@ public void registerSession(org.apache.karaf.shell.api.console.Session session)
try {
String user = (String) session.get("USER");
SshAgent agent = new AgentImpl();
URL url = getClass().getClassLoader().getResource("karaf.key");
InputStream is = url.openStream();
ObjectInputStream r = new ObjectInputStream(is);
KeyPair keyPair = (KeyPair) r.readObject();
agent.addIdentity(keyPair, "karaf");
String agentId = "local:" + user;
session.put(SshAgent.SSH_AUTHSOCKET_ENV_NAME, agentId);
locals.put(agentId, agent);
Expand Down
Binary file removed shell/ssh/src/main/resources/karaf.key
View file
Open in desktop
Binary file not shown.
14 changes: 3 additions & 11 deletions tooling/karaf-maven-plugin/src/main/java/org/apache/karaf/tooling/client/ClientMojo.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,11 +46,8 @@
import java.io.FileReader;
import java.io.IOError;
import java.io.IOException;
import java.io.InputStream;
import java.io.ObjectInputStream;
import java.io.PrintWriter;
import java.io.StringWriter;
import java.net.URL;
import java.security.KeyPair;
import java.util.Comparator;
import java.util.EnumSet;
Expand Down Expand Up @@ -236,20 +233,15 @@ public String getUpdatedPassword(ClientSession session, String prompt, String la
}

private void setupAgent(String user, File keyFile, SshClient client) {
URL builtInPrivateKey = ClientMojo.class.getClassLoader().getResource("karaf.key");
SshAgent agent = startAgent(user, builtInPrivateKey, keyFile);
SshAgent agent = startAgent(user, keyFile);
client.setAgentFactory( new LocalAgentFactory(agent));
client.getProperties().put(SshAgent.SSH_AUTHSOCKET_ENV_NAME, "local");
}

private SshAgent startAgent(String user, URL privateKeyUrl, File keyFile) {
try (InputStream is = privateKeyUrl.openStream())
private SshAgent startAgent(String user, File keyFile) {
try
{
SshAgent agent = new AgentImpl();
ObjectInputStream r = new ObjectInputStream(is);
KeyPair keyPair = (KeyPair) r.readObject();
is.close();
agent.addIdentity(keyPair, user);
if (keyFile != null) {
FileKeyPairProvider fileKeyPairProvider = new FileKeyPairProvider(keyFile.getAbsoluteFile().toPath());
for (KeyPair key : fileKeyPairProvider.loadKeys()) {
Expand Down
15 changes: 3 additions & 12 deletions tooling/karaf-maven-plugin/src/main/java/org/apache/karaf/tooling/client/DeployMojo.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,11 +50,8 @@
import java.io.File;
import java.io.IOError;
import java.io.IOException;
import java.io.InputStream;
import java.io.ObjectInputStream;
import java.io.PrintWriter;
import java.io.StringWriter;
import java.net.URL;
import java.security.KeyPair;
import java.util.ArrayList;
import java.util.EnumSet;
Expand Down Expand Up @@ -240,20 +237,14 @@ public String getUpdatedPassword(ClientSession session, String prompt, String la
}

private void setupAgent(String user, File keyFile, SshClient client) {
URL builtInPrivateKey = ClientMojo.class.getClassLoader().getResource("karaf.key");
SshAgent agent = startAgent(user, builtInPrivateKey, keyFile);
SshAgent agent = startAgent(user, keyFile);
client.setAgentFactory( new LocalAgentFactory(agent));
client.getProperties().put(SshAgent.SSH_AUTHSOCKET_ENV_NAME, "local");
}

private SshAgent startAgent(String user, URL privateKeyUrl, File keyFile) {
try (InputStream is = privateKeyUrl.openStream())
{
private SshAgent startAgent(String user, File keyFile) {
try {
SshAgent agent = new AgentImpl();
ObjectInputStream r = new ObjectInputStream(is);
KeyPair keyPair = (KeyPair) r.readObject();
is.close();
agent.addIdentity(keyPair, user);
if (keyFile != null) {
FileKeyPairProvider fileKeyPairProvider = new FileKeyPairProvider(keyFile.getAbsoluteFile().toPath());
for (KeyPair key : fileKeyPairProvider.loadKeys()) {
Expand Down