shell bypass 403
a
٠�g}. � @ st d dl Z d dlZd dlZd dlmZ ddlmZ G dd� de�ZG dd� de�ZG d d
� d
e�Z d d � Z
d
d� Z dS )� N)�mkstemp� )�ConfigGeneratorc @ s� e Zd Zdddddddddddddd d
dddddd d �Zd
dddddd�Zddddddd�Zddd d d d d d!d"d#d$�
Zd%d&d'�Zd(d)d*d+d,d-d.d/�Zd0d1d2d3d4d5d6d7d8d9d:�
Z d;d<d=d>d?d@dAdBdCdDd:�
Z
e dEdF� �Z dGS )H�OpenSSHGeneratorz[email protected]
aes256-ctr� z
aes192-ctrz[email protected]
aes128-ctrz [email protected]
aes256-cbcz
aes192-cbcz
aes128-cbcz3des-cbc)z AES-256-GCMz AES-256-CTRz AES-192-GCMz AES-192-CTRz AES-128-GCMz AES-128-CTRzCHACHA20-POLY1305zCAMELLIA-256-GCMz AES-256-CCMz AES-192-CCMz AES-128-CCMzCAMELLIA-128-GCMz AES-256-CBCz AES-192-CBCz AES-128-CBCzCAMELLIA-256-CBCzCAMELLIA-128-CBCzRC4-128zDES-CBCzCAMELLIA-128-CTSz3DES-CBCz[email protected][email protected][email protected][email protected] [email protected] [email protected])zHMAC-MD5zUMAC-64zUMAC-128z HMAC-SHA1z
HMAC-SHA2-256z
HMAC-SHA2-512zhmac-md5z[email protected][email protected] hmac-sha1z
hmac-sha2-256z
hmac-sha2-512zecdh-sha2-nistp521zecdh-sha2-nistp384zecdh-sha2-nistp256z.curve25519-sha256,[email protected]diffie-hellman-group1-sha1zdiffie-hellman-group14-sha1z diffie-hellman-group14-sha256z diffie-hellman-group16-sha512z diffie-hellman-group18-sha512z"[email protected])
zECDHE-SECP521R1-SHA2-512zECDHE-SECP384R1-SHA2-384zECDHE-SECP256R1-SHA2-256zECDHE-X25519-SHA2-256zDHE-FFDHE-1024-SHA1zDHE-FFDHE-2048-SHA1zDHE-FFDHE-2048-SHA2-256zDHE-FFDHE-4096-SHA2-512zDHE-FFDHE-8192-SHA2-512zSNTRUP-X25519-SHA2-512z"diffie-hellman-group-exchange-sha1z$diffie-hellman-group-exchange-sha256)zDHE-SHA1z DHE-SHA2-256z
gss-gex-sha1-zgss-group1-sha1-zgss-group14-sha1-zgss-group14-sha256-zgss-nistp256-sha256-zgss-curve25519-sha256-zgss-group16-sha512-)z DHE-GSS-SHA1zDHE-GSS-FFDHE-1024-SHA1zDHE-GSS-FFDHE-2048-SHA1zDHE-GSS-FFDHE-2048-SHA2-256z ECDHE-GSS-SECP256R1-SHA2-256zECDHE-GSS-X25519-SHA2-256zDHE-GSS-FFDHE-4096-SHA2-512zssh-rsazssh-dssz rsa-sha2-256z rsa-sha2-512zecdsa-sha2-nistp256z"[email protected]ecdsa-sha2-nistp384zecdsa-sha2-nistp521z ssh-ed25519z[email protected])
zRSA-SHA1zDSA-SHA1z RSA-SHA2-256z RSA-SHA2-512zECDSA-SHA2-256zECDSA-SHA2-256-FIDOzECDSA-SHA2-384zECDSA-SHA2-512z
EDDSA-ED25519zEDDSA-ED25519-FIDOz [email protected] [email protected][email protected][email protected]([email protected][email protected]([email protected]([email protected] [email protected]#[email protected] C s� |j }d}d}d}|d D ]0} z| �|| j| |�}W q tyH Y q0 q|r`|d|� d�7 }d}|jd dkr�|d D ]0} z| �|| j| |�}W qz ty� Y qz0 qz|jd d kr�|d D ]0} z| �|| j| |�}W q� ty� Y q�0 q�|�r
|d
|� d�7 }d}d}
|d D �]&} |d D �]} |jd
�r�z$| j| d | }
| �||
|�}W n t�yr Y n0 z"|| d | }
| �|
|
|�}
W n t�y� Y n0 |d D ]�}z*|| d | d | }
| �||
|�}W n t�y� Y n0 z*|| d | d | }
| �|
|
|�}
W n t�y6 Y n0 �q��q(�q|
�r\|d|
� d�7 }n|d7 }|�rz|d|� d�7 }d}|d D ]n} z| �|| j | |�}W n t�y� Y n0 |jd �r�z| �|| j
| |�}W n t�y� Y n0 �q�|�r"|�r|d|� d�7 }|d|� d�7 }d}|d D ]4} z| �|| j | |�}W n t�y^ Y n0 �q.|�rz|d|� d�7 }|jd dk�r�t � }|d u�r�||� d|jd � d�7 }|S )Nr �,ZcipherzCiphers �
ZetmZ DISABLE_ETMZmacZDISABLE_NON_ETMzMACs Z key_exchange�hashZarbitrary_dh_groups�-�groupzGSSAPIKexAlgorithms zGSSAPIKeyExchange no
zKexAlgorithms �signZ ssh_certszHostKeyAlgorithms zPubkeyAcceptedAlgorithms zCASignatureAlgorithms Z min_rsa_sizer � ) Zenabled�append�
cipher_map�KeyErrorZenums� mac_map_etm�mac_mapZintegers�gx_map�sign_map�sign_map_certs�_min_rsa_size_option)�cls�policy� local_kx_map�local_gss_kx_map� do_host_key�pZcfg�sep�s�iZgssZkx�h�val�gZmin_rsa_optname� r# �=/usr/share/crypto-policies/python/policygenerators/openssh.py�generate_optionsr s�
z!OpenSSHGenerator.generate_optionsN)
�__name__�
__module__� __qualname__r r r �kx_mapr �
gss_kx_mapr r � classmethodr% r# r# r# r$ r s� ��
�
��� ��
r c @ s0 e Zd ZdZh d�Zedd� �Zedd� �ZdS )�OpenSSHClientGenerator�openssh> zopenssh-client�sshr- c C s& t | j�}t | j�}| j|||dd�S )NF�r )�dictr) r* r% )r r r r r# r# r$ �generate_config� s
�z&OpenSSHClientGenerator.generate_configc C s
t �d�dkrdS t �dt j�s$dS t �d�dkrHt�t� � d�d|�}t� \}}d}z~t �|d ��}|� |� W d � n1 s�0 Y zt
j d
|� d �dd �}W n t
j y� | �
d
� Y n0 W t �|� n t �|� 0 |�r| �
d� | �
d|� �� dS dS )N� OLD_OPENSSH�1T� /usr/bin/ssh�OPENSSH_MIN_RSA_SIZE_FORCE�.*r � �wz/usr/bin/ssh -G -F z bogus654_server >/dev/null��shellz /usr/bin/ssh: Execution failed�4There is an error in OpenSSH server generated policy�Policy:
F)�os�getenv�access�X_OK�re�subr r �fdopen�write�
subprocess�call�CalledProcessError�eprint�unlink)r �config�fd�path�ret�fr# r# r$ � test_config� s.
(�
z"OpenSSHClientGenerator.test_configN)r& r' r( � CONFIG_NAME�SCOPESr+ r1 rO r# r# r# r$ r, � s
r, c @ sL e Zd ZdZh d�ZdZedd� �Zedd� �Zedd � �Z ed
d � �Z
d S )
�OpenSSHServerGeneratorZ
opensshserver> r. r- zopenssh-serverz4systemctl try-restart sshd.service 2>/dev/null || :
c C s | j || j| jdd�S )NTr/ )r% r) r* )r r r# r# r$ r1 s �z&OpenSSHServerGenerator.generate_configc C sh t � \}}t�|� d}ztjd|� d�dd�}W n tjyP | �d� Y n0 |rd| �d� dS |S ) Nr7 z&/usr/bin/ssh-keygen -t rsa -b 3072 -f z -N "" >/dev/nullTr9 z%/usr/bin/ssh-keygen: Execution failedz4SSH Keygen failed when testing OpenSSH server policyr )r r= rI rE rF rG rH )r Z_fdrL rM r# r# r$ � _test_setup s
��
z"OpenSSHServerGenerator._test_setupc C s |rt �|� d S �N)r= rI )r rL r# r# r$ �
_test_cleanup% s z$OpenSSHServerGenerator._test_cleanupc C s4 t �d�dkrdS t �dt j�s$dS t �d�dkrHt�t� � d�d|�}| �� }|sXdS t� \}}d }z�t � |d
��}|�
|� W d � n1 s�0 Y z t j d |� d |� d
�dd�}W n t j
y� | �d� Y n0 W t �|� | �|� nt �|� | �|� 0 |�r0| �d� | �d|� �� dS dS )Nr2 r3 Tz/usr/sbin/sshdr5 r6 r Fr7 r8 z/usr/sbin/sshd -T -h z -f z >/dev/nullr9 z /usr/sbin/sshd: Execution failedr; r< )r= r> r? r@ rA rB r rS r rC rD rE rF rG rH rI rU )r rJ Zhost_key_filenamerK rL rM rN r# r# r$ rO * sB
(���
�
z"OpenSSHServerGenerator.test_configN) r& r' r( rP rQ Z
RELOAD_CMDr+ r1 rS rU rO r# r# r# r$ rR s
rR c C sf zHt jddgdt jd�j�� } t�d| �}|rFtdd� |�� D ��W S W n t t
fy` Y d S 0 d S )Nr4 z-VF)�check�stderrzOpenSSH_(\d+).(\d+)p.*c s s | ]}t |�V qd S rT )�int)�.0�nr# r# r$ � <genexpr>V � z#_openssh_version.<locals>.<genexpr>) rE �run�PIPErW �decoderA �match�tuple�groups�FileNotFoundError�PermissionError)Z ssh_versionZverr# r# r$ �_openssh_versionP s � re c C sB d} t �d| �}|dkr d S |dkr>t� }|r:|dkr:dS d S |S )NZRequiredRSASizeZOPENSSH_MIN_RSA_SIZEZnone�auto)� r )r= r> re )ZMIN_RSA_DEFAULTZmin_rsa_size_forceZopenssh_versionr# r# r$ r \ s r ) r= rA rE Ztempfiler Zconfiggeneratorr r r, rR re r r# r# r# r$ �<module> s P+H