github/jumpserver
1
0
Fork 0
mirror of https://github.com/jumpserver/jumpserver.git synced 2025-06-25 22:42:05 +00:00
Code Issues Projects Releases Wiki Activity

feat: 系统设置-安全设置 支持配置 作业中心命令黑名单

Browse Source
This commit is contained in:
fangfangdong 2023-05-31 17:16:48 +08:00 committed by Jiangjie.Bai
parent 51d6090fdc
commit a0bb25e558
7 changed files with 1089 additions and 1339 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
apps/jumpserver/conf.py
View File

@ -452,6 +452,9 @@ class Config(dict):
'SECURITY_MFA_AUTH': 0, # 0 不开启 1 全局开启 2 管理员开启 'SECURITY_MFA_AUTH': 0, # 0 不开启 1 全局开启 2 管理员开启
'SECURITY_MFA_AUTH_ENABLED_FOR_THIRD_PARTY': True, 'SECURITY_MFA_AUTH_ENABLED_FOR_THIRD_PARTY': True,
'SECURITY_COMMAND_EXECUTION': True, 'SECURITY_COMMAND_EXECUTION': True,
'SECURITY_COMMAND_BLACKLIST': [
'reboot', 'shutdown', 'poweroff', 'halt', 'dd', 'half', 'top'
],
'SECURITY_SERVICE_ACCOUNT_REGISTRATION': True, 'SECURITY_SERVICE_ACCOUNT_REGISTRATION': True,
'SECURITY_VIEW_AUTH_NEED_MFA': True, 'SECURITY_VIEW_AUTH_NEED_MFA': True,
'SECURITY_MAX_IDLE_TIME': 30, 'SECURITY_MAX_IDLE_TIME': 30,

1
apps/jumpserver/settings/custom.py
View File

@ -35,6 +35,7 @@ SECURITY_MFA_AUTH = CONFIG.SECURITY_MFA_AUTH
SECURITY_MFA_AUTH_ENABLED_FOR_THIRD_PARTY = CONFIG.SECURITY_MFA_AUTH_ENABLED_FOR_THIRD_PARTY SECURITY_MFA_AUTH_ENABLED_FOR_THIRD_PARTY = CONFIG.SECURITY_MFA_AUTH_ENABLED_FOR_THIRD_PARTY
SECURITY_MAX_IDLE_TIME = CONFIG.SECURITY_MAX_IDLE_TIME # Unit: minute SECURITY_MAX_IDLE_TIME = CONFIG.SECURITY_MAX_IDLE_TIME # Unit: minute
SECURITY_COMMAND_EXECUTION = CONFIG.SECURITY_COMMAND_EXECUTION SECURITY_COMMAND_EXECUTION = CONFIG.SECURITY_COMMAND_EXECUTION
SECURITY_COMMAND_BLACKLIST = CONFIG.SECURITY_COMMAND_BLACKLIST
SECURITY_PASSWORD_EXPIRATION_TIME = CONFIG.SECURITY_PASSWORD_EXPIRATION_TIME # Unit: day SECURITY_PASSWORD_EXPIRATION_TIME = CONFIG.SECURITY_PASSWORD_EXPIRATION_TIME # Unit: day
SECURITY_PASSWORD_MIN_LENGTH = CONFIG.SECURITY_PASSWORD_MIN_LENGTH # Unit: bit SECURITY_PASSWORD_MIN_LENGTH = CONFIG.SECURITY_PASSWORD_MIN_LENGTH # Unit: bit
SECURITY_ADMIN_USER_PASSWORD_MIN_LENGTH = CONFIG.SECURITY_ADMIN_USER_PASSWORD_MIN_LENGTH # Unit: bit SECURITY_ADMIN_USER_PASSWORD_MIN_LENGTH = CONFIG.SECURITY_ADMIN_USER_PASSWORD_MIN_LENGTH # Unit: bit

1217
apps/locale/ja/LC_MESSAGES/django.po
View File

File diff suppressed because it is too large Load Diff

1196
apps/locale/zh/LC_MESSAGES/django.po
View File

File diff suppressed because it is too large Load Diff

5
apps/ops/ansible/runner.py
View File

@ -9,9 +9,6 @@ from .callback import DefaultCallback
class AdHocRunner: class AdHocRunner:
cmd_modules_choices = ('shell', 'raw', 'command', 'script', 'win_shell') cmd_modules_choices = ('shell', 'raw', 'command', 'script', 'win_shell')
cmd_blacklist = [
"reboot", 'shutdown', 'poweroff', 'halt', 'dd', 'half', 'top'
]
def __init__(self, inventory, module, module_args='', pattern='*', project_dir='/tmp/', extra_vars={}, def __init__(self, inventory, module, module_args='', pattern='*', project_dir='/tmp/', extra_vars={},
dry_run=False, timeout=-1): dry_run=False, timeout=-1):
@ -30,7 +27,7 @@ class AdHocRunner:
def check_module(self): def check_module(self):
if self.module not in self.cmd_modules_choices: if self.module not in self.cmd_modules_choices:
return return
if self.module_args and self.module_args.split()[0] in self.cmd_blacklist: if self.module_args and self.module_args.split()[0] in settings.SECURITY_COMMAND_BLACKLIST:
raise Exception("command not allowed: {}".format(self.module_args[0])) raise Exception("command not allowed: {}".format(self.module_args[0]))
def run(self, verbosity=0, **kwargs): def run(self, verbosity=0, **kwargs):

1
apps/settings/serializers/public.py
View File

@ -21,6 +21,7 @@ class PrivateSettingSerializer(PublicSettingSerializer):
SECURITY_VIEW_AUTH_NEED_MFA = serializers.BooleanField() SECURITY_VIEW_AUTH_NEED_MFA = serializers.BooleanField()
SECURITY_MFA_VERIFY_TTL = serializers.IntegerField() SECURITY_MFA_VERIFY_TTL = serializers.IntegerField()
SECURITY_COMMAND_EXECUTION = serializers.BooleanField() SECURITY_COMMAND_EXECUTION = serializers.BooleanField()
SECURITY_COMMAND_BLACKLIST = serializers.ListField()
SECURITY_PASSWORD_EXPIRATION_TIME = serializers.IntegerField() SECURITY_PASSWORD_EXPIRATION_TIME = serializers.IntegerField()
SECURITY_LUNA_REMEMBER_AUTH = serializers.BooleanField() SECURITY_LUNA_REMEMBER_AUTH = serializers.BooleanField()
SECURITY_WATERMARK_ENABLED = serializers.BooleanField() SECURITY_WATERMARK_ENABLED = serializers.BooleanField()

5
apps/settings/serializers/security.py
View File

@ -179,6 +179,11 @@ class SecuritySettingSerializer(SecurityPasswordRuleSerializer, SecurityAuthSeri
required=False, label=_('Operation center'), required=False, label=_('Operation center'),
help_text=_('Allow user run batch command or not using ansible') help_text=_('Allow user run batch command or not using ansible')
) )
SECURITY_COMMAND_BLACKLIST = serializers.ListField(
child=serializers.CharField(max_length=1024, ),
label=_('Operation center command blacklist'),
help_text=_("Commands that are not allowed execute.")
)
SECURITY_SESSION_SHARE = serializers.BooleanField( SECURITY_SESSION_SHARE = serializers.BooleanField(
required=True, label=_('Session share'), required=True, label=_('Session share'),
help_text=_("Enabled, Allows user active session to be shared with other users") help_text=_("Enabled, Allows user active session to be shared with other users")