2011-07-22 10:17:57 -07:00
|
|
|
<?php
|
|
|
|
|
2012-08-13 12:37:26 -07:00
|
|
|
final class PhabricatorSettingsPanelSSHKeys
|
|
|
|
extends PhabricatorSettingsPanel {
|
2011-07-22 10:17:57 -07:00
|
|
|
|
2014-04-02 12:06:05 -07:00
|
|
|
public function isEditableByAdministrators() {
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2012-08-13 12:37:26 -07:00
|
|
|
public function getPanelKey() {
|
|
|
|
return 'ssh';
|
|
|
|
}
|
|
|
|
|
|
|
|
public function getPanelName() {
|
|
|
|
return pht('SSH Public Keys');
|
|
|
|
}
|
2011-07-22 10:17:57 -07:00
|
|
|
|
2012-08-13 12:37:26 -07:00
|
|
|
public function getPanelGroup() {
|
|
|
|
return pht('Authentication');
|
|
|
|
}
|
|
|
|
|
|
|
|
public function isEnabled() {
|
2013-10-26 14:32:47 -07:00
|
|
|
return true;
|
2011-07-24 11:02:08 -07:00
|
|
|
}
|
|
|
|
|
2012-08-13 12:37:26 -07:00
|
|
|
public function processRequest(AphrontRequest $request) {
|
2014-04-02 12:06:05 -07:00
|
|
|
$user = $this->getUser();
|
|
|
|
$viewer = $request->getUser();
|
2011-07-22 10:17:57 -07:00
|
|
|
|
Add a query/policy layer on top of SSH keys for Almanac
Summary:
Ref T5833. Currently, SSH keys are associated only with users, and are a bit un-modern. I want to let Almanac Devices have SSH keys so devices in a cluster can identify to one another.
For example, with hosted installs, initialization will go something like this:
- A request comes in for `company.phacility.com`.
- A SiteSource (from D10787) makes a Conduit call to Almanac on the master install to check if `company` is a valid install and pull config if it is.
- This call can be signed with an SSH key which identifies a trusted Almanac Device.
In the cluster case, a web host can make an authenticated call to a repository host with similar key signing.
To move toward this, put a proper Query class on top of SSH key access (this diff). In following diffs, I'll:
- Rename `userPHID` to `objectPHID`.
- Move this to the `auth` database.
- Provide UI for device/key association.
An alternative approach would be to build some kind of special token layer in Conduit, but I think that would be a lot harder to manage in the hosting case. This gives us a more direct attack on trusting requests from machines and recognizing machines as first (well, sort of second-class) actors without needing things like fake user accounts.
Test Plan:
- Added and removed SSH keys.
- Added and removed SSH keys from a bot account.
- Tried to edit an unonwned SSH key (denied).
- Ran `bin/ssh-auth`, got sensible output.
- Ran `bin/ssh-auth-key`, got sensible output.
Reviewers: btrahan
Reviewed By: btrahan
Subscribers: epriestley
Maniphest Tasks: T5833
Differential Revision: https://secure.phabricator.com/D10790
2014-11-06 12:37:02 -08:00
|
|
|
$keys = id(new PhabricatorAuthSSHKeyQuery())
|
|
|
|
->setViewer($viewer)
|
|
|
|
->withObjectPHIDs(array($user->getPHID()))
|
|
|
|
->execute();
|
2011-07-22 10:17:57 -07:00
|
|
|
|
|
|
|
$rows = array();
|
|
|
|
foreach ($keys as $key) {
|
|
|
|
$rows[] = array(
|
2014-11-11 08:18:26 -08:00
|
|
|
javelin_tag(
|
2011-07-22 10:17:57 -07:00
|
|
|
'a',
|
|
|
|
array(
|
2014-11-11 08:18:26 -08:00
|
|
|
'href' => '/auth/sshkey/edit/'.$key->getID().'/',
|
|
|
|
'sigil' => 'workflow',
|
2011-07-22 10:17:57 -07:00
|
|
|
),
|
2013-01-17 18:43:35 -08:00
|
|
|
$key->getName()),
|
2013-02-13 14:50:15 -08:00
|
|
|
$key->getKeyComment(),
|
|
|
|
$key->getKeyType(),
|
2014-04-02 12:06:05 -07:00
|
|
|
phabricator_date($key->getDateCreated(), $viewer),
|
|
|
|
phabricator_time($key->getDateCreated(), $viewer),
|
2013-01-25 12:57:17 -08:00
|
|
|
javelin_tag(
|
2011-07-22 10:17:57 -07:00
|
|
|
'a',
|
|
|
|
array(
|
2014-11-11 08:18:26 -08:00
|
|
|
'href' => '/auth/sshkey/delete/'.$key->getID().'/',
|
2011-07-22 10:17:57 -07:00
|
|
|
'class' => 'small grey button',
|
|
|
|
'sigil' => 'workflow',
|
|
|
|
),
|
2013-03-03 06:52:42 -08:00
|
|
|
pht('Delete')),
|
2011-07-22 10:17:57 -07:00
|
|
|
);
|
|
|
|
}
|
|
|
|
|
|
|
|
$table = new AphrontTableView($rows);
|
2013-03-03 06:52:42 -08:00
|
|
|
$table->setNoDataString(pht("You haven't added any SSH Public Keys."));
|
2011-07-22 10:17:57 -07:00
|
|
|
$table->setHeaders(
|
|
|
|
array(
|
2013-03-03 06:52:42 -08:00
|
|
|
pht('Name'),
|
|
|
|
pht('Comment'),
|
|
|
|
pht('Type'),
|
|
|
|
pht('Created'),
|
|
|
|
pht('Time'),
|
2011-07-22 10:17:57 -07:00
|
|
|
'',
|
|
|
|
));
|
|
|
|
$table->setColumnClasses(
|
|
|
|
array(
|
|
|
|
'wide pri',
|
|
|
|
'',
|
|
|
|
'',
|
|
|
|
'',
|
|
|
|
'right',
|
|
|
|
'action',
|
|
|
|
));
|
|
|
|
|
2014-01-07 16:16:30 -08:00
|
|
|
$panel = new PHUIObjectBoxView();
|
|
|
|
$header = new PHUIHeaderView();
|
|
|
|
|
2014-03-12 18:17:11 -07:00
|
|
|
$upload_icon = id(new PHUIIconView())
|
2014-05-12 10:08:32 -07:00
|
|
|
->setIconFont('fa-upload');
|
2014-03-12 18:17:11 -07:00
|
|
|
$upload_button = id(new PHUIButtonView())
|
|
|
|
->setText(pht('Upload Public Key'))
|
2014-11-11 08:18:26 -08:00
|
|
|
->setHref('/auth/sshkey/upload/?objectPHID='.$user->getPHID())
|
|
|
|
->setWorkflow(true)
|
2014-03-12 18:17:11 -07:00
|
|
|
->setTag('a')
|
|
|
|
->setIcon($upload_icon);
|
|
|
|
|
|
|
|
try {
|
|
|
|
PhabricatorSSHKeyGenerator::assertCanGenerateKeypair();
|
|
|
|
$can_generate = true;
|
|
|
|
} catch (Exception $ex) {
|
|
|
|
$can_generate = false;
|
|
|
|
}
|
2014-01-07 16:16:30 -08:00
|
|
|
|
2014-03-12 18:17:11 -07:00
|
|
|
$generate_icon = id(new PHUIIconView())
|
2014-05-12 10:08:32 -07:00
|
|
|
->setIconFont('fa-lock');
|
2014-03-12 18:17:11 -07:00
|
|
|
$generate_button = id(new PHUIButtonView())
|
|
|
|
->setText(pht('Generate Keypair'))
|
2014-11-11 08:18:26 -08:00
|
|
|
->setHref('/auth/sshkey/generate/?objectPHID='.$user->getPHID())
|
2014-03-12 18:17:11 -07:00
|
|
|
->setTag('a')
|
|
|
|
->setWorkflow(true)
|
|
|
|
->setDisabled(!$can_generate)
|
|
|
|
->setIcon($generate_icon);
|
2014-01-07 16:16:30 -08:00
|
|
|
|
|
|
|
$header->setHeader(pht('SSH Public Keys'));
|
2014-03-12 18:17:11 -07:00
|
|
|
$header->addActionLink($generate_button);
|
|
|
|
$header->addActionLink($upload_button);
|
2014-01-07 16:16:30 -08:00
|
|
|
|
|
|
|
$panel->setHeader($header);
|
2011-07-22 10:17:57 -07:00
|
|
|
$panel->appendChild($table);
|
|
|
|
|
|
|
|
return $panel;
|
|
|
|
}
|
|
|
|
|
|
|
|
}
|