Add permissioning to SSH, add publicKey return for SSH CA, polish

backend/src/ee/services/permission/org-permission.ts

@@ -7,6 +7,15 @@ export enum OrgPermissionActions {
   Delete = "delete"
 }
 
+export enum OrgPermissionSshCertificateTemplateActions {
+  Read = "read",
+  Create = "create",
+  Edit = "edit",
+  Delete = "delete",
+  SignSshKey = "sign-ssh-key",
+  IssueSshCredentials = "issue-ssh-credentials"
+}
+
 export enum OrgPermissionAdminConsoleAction {
   AccessAllProjects = "access-all-projects"
 }
@@ -50,7 +59,7 @@ export type OrgPermissionSet =
   | [OrgPermissionActions, OrgPermissionSubjects.ProjectTemplates]
   | [OrgPermissionAdminConsoleAction, OrgPermissionSubjects.AdminConsole]
   | [OrgPermissionActions, OrgPermissionSubjects.SshCertificateAuthorities]
-  | [OrgPermissionActions, OrgPermissionSubjects.SshCertificateTemplates];
+  | [OrgPermissionSshCertificateTemplateActions, OrgPermissionSubjects.SshCertificateTemplates];
 
 const buildAdminPermission = () => {
   const { can, rules } = new AbilityBuilder<MongoAbility<OrgPermissionSet>>(createMongoAbility);
@@ -132,10 +141,17 @@ const buildAdminPermission = () => {
   can(OrgPermissionActions.Edit, OrgPermissionSubjects.SshCertificateAuthorities);
   can(OrgPermissionActions.Delete, OrgPermissionSubjects.SshCertificateAuthorities);
 
-  can(OrgPermissionActions.Read, OrgPermissionSubjects.SshCertificateTemplates);
-  can(OrgPermissionActions.Create, OrgPermissionSubjects.SshCertificateTemplates);
-  can(OrgPermissionActions.Edit, OrgPermissionSubjects.SshCertificateTemplates);
-  can(OrgPermissionActions.Delete, OrgPermissionSubjects.SshCertificateTemplates);
+  can(
+    [
+      OrgPermissionSshCertificateTemplateActions.Read,
+      OrgPermissionSshCertificateTemplateActions.Create,
+      OrgPermissionSshCertificateTemplateActions.Edit,
+      OrgPermissionSshCertificateTemplateActions.Delete,
+      OrgPermissionSshCertificateTemplateActions.SignSshKey,
+      OrgPermissionSshCertificateTemplateActions.IssueSshCredentials
+    ],
+    OrgPermissionSubjects.SshCertificateTemplates
+  );
 
   can(OrgPermissionAdminConsoleAction.AccessAllProjects, OrgPermissionSubjects.AdminConsole);
 
@@ -168,7 +184,9 @@ const buildMemberPermission = () => {
   can(OrgPermissionActions.Read, OrgPermissionSubjects.AuditLogs);
 
   can(OrgPermissionActions.Read, OrgPermissionSubjects.SshCertificateAuthorities);
-  can(OrgPermissionActions.Read, OrgPermissionSubjects.SshCertificateTemplates);
+  can(OrgPermissionSshCertificateTemplateActions.Read, OrgPermissionSubjects.SshCertificateTemplates);
+  can(OrgPermissionSshCertificateTemplateActions.SignSshKey, OrgPermissionSubjects.SshCertificateTemplates);
+  can(OrgPermissionSshCertificateTemplateActions.IssueSshCredentials, OrgPermissionSubjects.SshCertificateTemplates);
 
   return rules;
 };

backend/src/ee/services/ssh-certificate-template/ssh-certificate-template-dal.ts

@@ -34,5 +34,30 @@ export const sshCertificateTemplateDALFactory = (db: TDbClient) => {
     }
   };
 
-  return { ...sshCertificateTemplateOrm, getById };
+  const getByName = async (name: string, orgId: string, tx?: Knex) => {
+    try {
+      const certTemplate = await (tx || db.replicaNode())(TableName.SshCertificateTemplate)
+        .join(
+          TableName.SshCertificateAuthority,
+          `${TableName.SshCertificateAuthority}.id`,
+          `${TableName.SshCertificateTemplate}.sshCaId`
+        )
+        .join(TableName.Organization, `${TableName.Organization}.id`, `${TableName.SshCertificateAuthority}.orgId`)
+        .where(`${TableName.SshCertificateTemplate}.name`, "=", name)
+        .where(`${TableName.Organization}.id`, "=", orgId)
+        .select(selectAllTableCols(TableName.SshCertificateTemplate))
+        .select(
+          db.ref("orgId").withSchema(TableName.SshCertificateAuthority),
+          db.ref("friendlyName").as("caName").withSchema(TableName.SshCertificateAuthority),
+          db.ref("status").as("caStatus").withSchema(TableName.SshCertificateAuthority)
+        )
+        .first();
+
+      return certTemplate;
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Get SSH certificate template by name" });
+    }
+  };
+
+  return { ...sshCertificateTemplateOrm, getById, getByName };
 };

backend/src/ee/services/ssh-certificate-template/ssh-certificate-template-service.ts

@@ -1,7 +1,10 @@
 import { ForbiddenError } from "@casl/ability";
 import ms from "ms";
 
-import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
+import {
+  OrgPermissionSshCertificateTemplateActions,
+  OrgPermissionSubjects
+} from "@app/ee/services/permission/org-permission";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 
@@ -58,10 +61,17 @@ export const sshCertificateTemplateServiceFactory = ({
     );
 
     ForbiddenError.from(permission).throwUnlessCan(
-      OrgPermissionActions.Create,
+      OrgPermissionSshCertificateTemplateActions.Create,
       OrgPermissionSubjects.SshCertificateTemplates
     );
 
+    const existingTemplate = await sshCertificateTemplateDAL.getByName(name, ca.orgId);
+    if (existingTemplate) {
+      throw new BadRequestError({
+        message: `SSH certificate template with name ${name} already exists`
+      });
+    }
+
     if (ms(ttl) > ms(maxTTL)) {
       throw new BadRequestError({
         message: "TTL cannot be greater than max TTL"
@@ -114,10 +124,19 @@ export const sshCertificateTemplateServiceFactory = ({
     );
 
     ForbiddenError.from(permission).throwUnlessCan(
-      OrgPermissionActions.Edit,
-      OrgPermissionSubjects.SshCertificateAuthorities
+      OrgPermissionSshCertificateTemplateActions.Edit,
+      OrgPermissionSubjects.SshCertificateTemplates
     );
 
+    if (name) {
+      const existingTemplate = await sshCertificateTemplateDAL.getByName(name, actorOrgId);
+      if (existingTemplate) {
+        throw new BadRequestError({
+          message: `SSH certificate template with name ${name} already exists`
+        });
+      }
+    }
+
     if (ms(ttl || certTemplate.ttl) > ms(maxTTL || certTemplate.maxTTL)) {
       throw new BadRequestError({
         message: "TTL cannot be greater than max TTL"
@@ -164,8 +183,8 @@ export const sshCertificateTemplateServiceFactory = ({
     );
 
     ForbiddenError.from(permission).throwUnlessCan(
-      OrgPermissionActions.Delete,
-      OrgPermissionSubjects.SshCertificateAuthorities
+      OrgPermissionSshCertificateTemplateActions.Delete,
+      OrgPermissionSubjects.SshCertificateTemplates
     );
 
     await sshCertificateTemplateDAL.deleteById(certificateTemplate.id);
@@ -190,8 +209,8 @@ export const sshCertificateTemplateServiceFactory = ({
     );
 
     ForbiddenError.from(permission).throwUnlessCan(
-      OrgPermissionActions.Read,
-      OrgPermissionSubjects.SshCertificateAuthorities
+      OrgPermissionSshCertificateTemplateActions.Read,
+      OrgPermissionSubjects.SshCertificateTemplates
     );
 
     return certTemplate;

backend/src/ee/services/ssh/ssh-certificate-authority-fns.ts

@@ -67,6 +67,32 @@ export const createSshKeyPair = (keyAlgorithm: CertKeyAlgorithm, comment: string
   return { publicKey, privateKey };
 };
 
+/**
+ * Return the SSH public key for the given SSH private key.
+ * @param privateKey - The SSH private key to get the public key for
+ */
+export const getSshPublicKey = (privateKey: string) => {
+  const uniqueId = crypto.randomBytes(8).toString("hex");
+  const privateKeyFile = `ssh_key_${uniqueId}`;
+  const publicKeyFile = `${privateKeyFile}.pub`;
+
+  if (fs.existsSync(publicKeyFile)) fs.unlinkSync(publicKeyFile);
+  if (fs.existsSync(privateKeyFile)) fs.unlinkSync(privateKeyFile);
+
+  fs.writeFileSync(privateKeyFile, privateKey);
+  fs.chmodSync(privateKeyFile, 0o600);
+
+  const command = `ssh-keygen -y -f ${privateKeyFile} > ${publicKeyFile}`;
+  execSync(command);
+
+  const publicKey = fs.readFileSync(publicKeyFile, "utf8");
+
+  fs.unlinkSync(privateKeyFile);
+  fs.unlinkSync(publicKeyFile);
+
+  return publicKey;
+};
+
 /**
  * Validate the requested SSH certificate type based on the SSH certificate template configuration.
  * @param template - The SSH certificate template configuration
@@ -160,9 +186,11 @@ export const createSshCert = ({ caPrivateKey, userPublicKey, keyId, principals,
   const uniqueId = crypto.randomBytes(8).toString("hex");
   const publicKeyFile = `user_key_${uniqueId}.pub`;
   const privateKeyFile = `ssh_ca_key_${uniqueId}`;
+  const signedPublicKeyFile = `user_key_${uniqueId}-cert.pub`;
 
   if (fs.existsSync(publicKeyFile)) fs.unlinkSync(publicKeyFile);
   if (fs.existsSync(privateKeyFile)) fs.unlinkSync(privateKeyFile);
+  if (fs.existsSync(signedPublicKeyFile)) fs.unlinkSync(signedPublicKeyFile);
 
   // write public and private keys to temp files
   fs.writeFileSync(publicKeyFile, userPublicKey);
@@ -170,7 +198,6 @@ export const createSshCert = ({ caPrivateKey, userPublicKey, keyId, principals,
   fs.chmodSync(privateKeyFile, 0o600);
 
   const serialNumber = createSshCertSerialNumber();
-  console.log("signSshKey serialNumber: ", serialNumber);
 
   const certOptions = [
     `-s ${privateKeyFile}`, // path to SSH CA private key
@@ -189,10 +216,11 @@ export const createSshCert = ({ caPrivateKey, userPublicKey, keyId, principals,
   // Execute the signing process
   execSync(command);
 
-  const signedPublicKey = fs.readFileSync(publicKeyFile, "utf8");
+  const signedPublicKey = fs.readFileSync(signedPublicKeyFile, "utf8");
 
   fs.unlinkSync(publicKeyFile);
   fs.unlinkSync(privateKeyFile);
+  fs.unlinkSync(signedPublicKeyFile);
 
   return { serialNumber, signedPublicKey };
 };

backend/src/ee/services/ssh/ssh-certificate-authority-service.ts

@@ -1,6 +1,10 @@
 import { ForbiddenError } from "@casl/ability";
 
-import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
+import {
+  OrgPermissionActions,
+  OrgPermissionSshCertificateTemplateActions,
+  OrgPermissionSubjects
+} from "@app/ee/services/permission/org-permission";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { TSshCertificateAuthorityDALFactory } from "@app/ee/services/ssh/ssh-certificate-authority-dal";
 import { TSshCertificateAuthoritySecretDALFactory } from "@app/ee/services/ssh/ssh-certificate-authority-secret-dal";
@@ -12,6 +16,7 @@ import { TProjectDALFactory } from "@app/services/project/project-dal";
 import {
   createSshCert,
   createSshKeyPair,
+  getSshPublicKey,
   validateSshCertificatePrincipals,
   validateSshCertificateTtl,
   validateSshCertificateType
@@ -33,7 +38,7 @@ type TSshCertificateAuthorityServiceFactoryDep = {
     "transaction" | "create" | "findById" | "updateById" | "deleteById" | "findOne"
   >;
   sshCertificateAuthoritySecretDAL: Pick<TSshCertificateAuthoritySecretDALFactory, "create" | "findOne">;
-  sshCertificateTemplateDAL: Pick<TSshCertificateTemplateDALFactory, "find" | "findOne">;
+  sshCertificateTemplateDAL: Pick<TSshCertificateTemplateDALFactory, "find" | "getByName">;
   projectDAL: Pick<TProjectDALFactory, "findProjectBySlug" | "findOne" | "updateById" | "findById" | "transaction">;
   kmsService: Pick<TKmsServiceFactory, "generateKmsKey" | "encryptWithKmsKey" | "decryptWithKmsKey" | "getOrgKmsKeyId">;
   permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
@@ -76,14 +81,14 @@ export const sshCertificateAuthorityServiceFactory = ({
       const ca = await sshCertificateAuthorityDAL.create(
         {
           orgId: actorOrgId,
-          friendlyName: friendlyName || "",
+          friendlyName,
           status: SshCaStatus.ACTIVE,
           keyAlgorithm
         },
         tx
       );
 
-      const { privateKey } = createSshKeyPair(keyAlgorithm, ca.friendlyName);
+      const { publicKey, privateKey } = createSshKeyPair(keyAlgorithm, ca.friendlyName);
 
       const orgKmsKeyId = await kmsService.getOrgKmsKeyId(actorOrgId);
       const kmsEncryptor = await kmsService.encryptWithKmsKey({
@@ -102,7 +107,7 @@ export const sshCertificateAuthorityServiceFactory = ({
         tx
       );
 
-      return ca;
+      return { ...ca, publicKey };
     });
 
     return newCa;
@@ -118,7 +123,7 @@ export const sshCertificateAuthorityServiceFactory = ({
     const { permission } = await permissionService.getOrgPermission(
       actor,
       actorId,
-      actorOrgId,
+      ca.orgId,
       actorAuthMethod,
       actorOrgId
     );
@@ -128,21 +133,43 @@ export const sshCertificateAuthorityServiceFactory = ({
       OrgPermissionSubjects.SshCertificateAuthorities
     );
 
-    return ca;
+    const sshCaSecret = await sshCertificateAuthoritySecretDAL.findOne({ sshCaId: ca.id });
+
+    // decrypt secret
+    const orgKmsKeyId = await kmsService.getOrgKmsKeyId(actorOrgId);
+    const kmsDecryptor = await kmsService.decryptWithKmsKey({
+      kmsId: orgKmsKeyId
+    });
+
+    const decryptedCaPrivateKey = await kmsDecryptor({
+      cipherTextBlob: sshCaSecret.encryptedPrivateKey
+    });
+
+    const publicKey = getSshPublicKey(decryptedCaPrivateKey.toString("utf-8"));
+
+    return { ...ca, publicKey };
   };
 
   /**
    * Update SSH CA with id [caId]
    * Note: Used to enable/disable CA
    */
-  const updateSshCaById = async ({ caId, status, actor, actorId, actorAuthMethod, actorOrgId }: TUpdateSshCaDTO) => {
+  const updateSshCaById = async ({
+    caId,
+    friendlyName,
+    status,
+    actor,
+    actorId,
+    actorAuthMethod,
+    actorOrgId
+  }: TUpdateSshCaDTO) => {
     const ca = await sshCertificateAuthorityDAL.findById(caId);
     if (!ca) throw new NotFoundError({ message: `SSH CA with ID '${caId}' not found` });
 
     const { permission } = await permissionService.getOrgPermission(
       actor,
       actorId,
-      actorOrgId,
+      ca.orgId,
       actorAuthMethod,
       actorOrgId
     );
@@ -152,9 +179,23 @@ export const sshCertificateAuthorityServiceFactory = ({
       OrgPermissionSubjects.SshCertificateAuthorities
     );
 
-    const updatedCa = await sshCertificateAuthorityDAL.updateById(caId, { status });
+    const updatedCa = await sshCertificateAuthorityDAL.updateById(caId, { friendlyName, status });
 
-    return updatedCa;
+    const sshCaSecret = await sshCertificateAuthoritySecretDAL.findOne({ sshCaId: ca.id });
+
+    // decrypt secret
+    const orgKmsKeyId = await kmsService.getOrgKmsKeyId(actorOrgId);
+    const kmsDecryptor = await kmsService.decryptWithKmsKey({
+      kmsId: orgKmsKeyId
+    });
+
+    const decryptedCaPrivateKey = await kmsDecryptor({
+      cipherTextBlob: sshCaSecret.encryptedPrivateKey
+    });
+
+    const publicKey = getSshPublicKey(decryptedCaPrivateKey.toString("utf-8"));
+
+    return { ...updatedCa, publicKey };
   };
 
   /**
@@ -167,7 +208,7 @@ export const sshCertificateAuthorityServiceFactory = ({
     const { permission } = await permissionService.getOrgPermission(
       actor,
       actorId,
-      actorOrgId,
+      ca.orgId,
       actorAuthMethod,
       actorOrgId
     );
@@ -184,10 +225,10 @@ export const sshCertificateAuthorityServiceFactory = ({
 
   /**
    * Return SSH certificate and corresponding new SSH public-private key pair where
-   * SSH public key is signed using CA behind SSH certificate with name [name].
+   * SSH public key is signed using CA behind SSH certificate with name [templateName].
    */
   const issueSshCreds = async ({
-    name,
+    templateName,
     keyAlgorithm,
     certType,
     principals,
@@ -198,7 +239,13 @@ export const sshCertificateAuthorityServiceFactory = ({
     actorAuthMethod,
     actorOrgId
   }: TIssueSshCredsDTO) => {
-    // TODO: proper permission check
+    const sshCertificateTemplate = await sshCertificateTemplateDAL.getByName(templateName, actorOrgId);
+    if (!sshCertificateTemplate) {
+      throw new NotFoundError({
+        message: "No SSH certificate template found with specified name"
+      });
+    }
+
     const { permission } = await permissionService.getOrgPermission(
       actor,
       actorId,
@@ -208,13 +255,10 @@ export const sshCertificateAuthorityServiceFactory = ({
     );
 
     ForbiddenError.from(permission).throwUnlessCan(
-      OrgPermissionActions.Create,
+      OrgPermissionSshCertificateTemplateActions.IssueSshCredentials,
       OrgPermissionSubjects.SshCertificateTemplates
     );
 
-    // TODO: adjust to find within org
-    const sshCertificateTemplate = await sshCertificateTemplateDAL.findOne({ name });
-
     // validate if the requested [certType] is allowed under the template configuration
     validateSshCertificateType(sshCertificateTemplate, certType);
 
@@ -266,10 +310,10 @@ export const sshCertificateAuthorityServiceFactory = ({
 
   /**
    * Return SSH certificate by signing SSH public key [publicKey]
-   * using CA behind SSH certificate template with name [name]
+   * using CA behind SSH certificate template with name [templateName]
    */
   const signSshKey = async ({
-    name,
+    templateName,
     publicKey,
     certType,
     principals,
@@ -280,7 +324,13 @@ export const sshCertificateAuthorityServiceFactory = ({
     actorAuthMethod,
     actorOrgId
   }: TSignSshKeyDTO) => {
-    // TODO: proper permission check
+    const sshCertificateTemplate = await sshCertificateTemplateDAL.getByName(templateName, actorOrgId);
+    if (!sshCertificateTemplate) {
+      throw new NotFoundError({
+        message: "No SSH certificate template found with specified name"
+      });
+    }
+
     const { permission } = await permissionService.getOrgPermission(
       actor,
       actorId,
@@ -290,13 +340,10 @@ export const sshCertificateAuthorityServiceFactory = ({
     );
 
     ForbiddenError.from(permission).throwUnlessCan(
-      OrgPermissionActions.Create,
+      OrgPermissionSshCertificateTemplateActions.SignSshKey,
       OrgPermissionSubjects.SshCertificateTemplates
     );
 
-    // TODO: adjust to find within org
-    const sshCertificateTemplate = await sshCertificateTemplateDAL.findOne({ name });
-
     // validate if the requested [certType] is allowed under the template configuration
     validateSshCertificateType(sshCertificateTemplate, certType);
 
@@ -354,7 +401,7 @@ export const sshCertificateAuthorityServiceFactory = ({
     );
 
     ForbiddenError.from(permission).throwUnlessCan(
-      OrgPermissionActions.Read,
+      OrgPermissionSshCertificateTemplateActions.Read,
       OrgPermissionSubjects.SshCertificateTemplates
     );
 

backend/src/ee/services/ssh/ssh-certificate-authority-types.ts

@@ -12,7 +12,7 @@ export enum SshCertType {
 }
 
 export type TCreateSshCaDTO = {
-  friendlyName?: string;
+  friendlyName: string;
   keyAlgorithm: CertKeyAlgorithm;
 } & Omit<TOrgPermission, "orgId">;
 
@@ -22,6 +22,7 @@ export type TGetSshCaDTO = {
 
 export type TUpdateSshCaDTO = {
   caId: string;
+  friendlyName?: string;
   status?: SshCaStatus;
 } & Omit<TOrgPermission, "orgId">;
 
@@ -30,7 +31,7 @@ export type TDeleteSshCaDTO = {
 } & Omit<TOrgPermission, "orgId">;
 
 export type TIssueSshCredsDTO = {
-  name: string; // name of SSH certificate template
+  templateName: string;
   keyAlgorithm: CertKeyAlgorithm;
   certType: SshCertType;
   principals: string[];
@@ -39,7 +40,7 @@ export type TIssueSshCredsDTO = {
 } & Omit<TOrgPermission, "orgId">;
 
 export type TSignSshKeyDTO = {
-  name: string; // name of SSH certificate template
+  templateName: string;
   publicKey: string;
   certType: SshCertType;
   principals: string[];