feat: 拉起ssh api

apps/authentication/api/connection_token.py

@@ -159,6 +159,25 @@ class ClientProtocolMixin:
             content += f'{k}:{v}\n'
         return name, content
 
+    def get_ssh_token(self, serializer):
+        asset, application, system_user, user = self.get_request_resource(serializer)
+        token, secret = self.create_token(user, asset, application, system_user)
+        if asset:
+            name = asset.hostname
+        elif application:
+            name = application.name
+        else:
+            name = '*'
+
+        content = {
+            'ip': settings.TERMINAL_KOKO_HOST,
+            'port': str(settings.TERMINAL_KOKO_SSH_PORT),
+            'username': f'JMS-{token}',
+            'password': secret
+        }
+        token = json.dumps(content)
+        return name, token
+
     def get_encrypt_cmdline(self, app: Application):
         parameters = app.get_rdp_remote_app_setting()['parameters']
         parameters = parameters.encode('ascii')
@@ -200,13 +219,11 @@ class ClientProtocolMixin:
         asset, application, system_user, user = self.get_request_resource(serializer)
         protocol = system_user.protocol
         username = user.username
-
+        config, token = '', ''
         if protocol == 'rdp':
             name, config = self.get_rdp_file_content(serializer)
         elif protocol == 'ssh':
-            # Todo:
-            name = ''
-            config = 'ssh://system_user@asset@user@jumpserver-ssh'
+            name, token = self.get_ssh_token(serializer)
         else:
             raise ValueError('Protocol not support: {}'.format(protocol))
 
@@ -215,6 +232,7 @@ class ClientProtocolMixin:
             "filename": filename,
             "protocol": system_user.protocol,
             "username": username,
+            "token": token,
             "config": config
         }
         return data

apps/jumpserver/conf.py

@@ -311,6 +311,8 @@ class Config(dict):
         'TERMINAL_COMMAND_STORAGE': {},
         'TERMINAL_RDP_ADDR': lambda: urlparse(settings.SITE_URL).hostname + ':3389',
         'XRDP_ENABLED': True,
+        'TERMINAL_KOKO_HOST': lambda: urlparse(settings.SITE_URL).hostname,
+        'TERMINAL_KOKO_SSH_PORT': 2222,
 
         'TERMINAL_MAGNUS_ENABLED': True,
         'TERMINAL_MAGNUS_HOST': lambda: urlparse(settings.SITE_URL).hostname,

apps/jumpserver/settings/custom.py

@@ -140,6 +140,9 @@ CLOUD_SYNC_TASK_EXECUTION_KEEP_DAYS = CONFIG.CLOUD_SYNC_TASK_EXECUTION_KEEP_DAYS
 
 XRDP_ENABLED = CONFIG.XRDP_ENABLED
 
+TERMINAL_KOKO_HOST = CONFIG.TERMINAL_KOKO_HOST
+TERMINAL_KOKO_SSH_PORT = CONFIG.TERMINAL_KOKO_SSH_PORT
+
 # SMS enabled
 SMS_ENABLED = CONFIG.SMS_ENABLED
 SMS_BACKEND = CONFIG.SMS_BACKEND

apps/locale/zh/LC_MESSAGES/django.po

@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: JumpServer 0.3.3\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2022-03-23 15:35+0800\n"
+"POT-Creation-Date: 2022-03-29 12:58+0800\n"
 "PO-Revision-Date: 2021-05-20 10:54+0800\n"
 "Last-Translator: ibuler <ibuler@qq.com>\n"
 "Language-Team: JumpServer team<ibuler@qq.com>\n"
@@ -22,7 +22,7 @@ msgid "Acls"
 msgstr "访问控制"
 
 #: acls/models/base.py:25 acls/serializers/login_asset_acl.py:47
-#: applications/models/application.py:213 assets/models/asset.py:138
+#: applications/models/application.py:211 assets/models/asset.py:138
 #: assets/models/base.py:175 assets/models/cluster.py:18
 #: assets/models/cmd_filter.py:27 assets/models/domain.py:23
 #: assets/models/group.py:20 assets/models/label.py:18 ops/mixin.py:24
@@ -30,7 +30,7 @@ msgstr "访问控制"
 #: settings/models.py:29 settings/serializers/sms.py:6
 #: terminal/models/storage.py:23 terminal/models/task.py:16
 #: terminal/models/terminal.py:100 users/forms/profile.py:32
-#: users/models/group.py:15 users/models/user.py:655
+#: users/models/group.py:15 users/models/user.py:659
 #: users/templates/users/_select_user_modal.html:13
 #: users/templates/users/user_asset_permission.html:37
 #: users/templates/users/user_asset_permission.html:154
@@ -56,7 +56,7 @@ msgstr "优先级可选范围为 1-100 (数值越小越优先)"
 msgid "Active"
 msgstr "激活中"
 
-#: acls/models/base.py:32 applications/models/application.py:226
+#: acls/models/base.py:32 applications/models/application.py:224
 #: assets/models/asset.py:143 assets/models/asset.py:231
 #: assets/models/backup.py:54 assets/models/base.py:180
 #: assets/models/cluster.py:29 assets/models/cmd_filter.py:48
@@ -66,7 +66,7 @@ msgstr "激活中"
 #: perms/models/base.py:93 rbac/models/role.py:37 settings/models.py:34
 #: terminal/models/storage.py:26 terminal/models/terminal.py:114
 #: tickets/models/comment.py:24 tickets/models/ticket.py:154
-#: users/models/group.py:16 users/models/user.py:692
+#: users/models/group.py:16 users/models/user.py:696
 #: xpack/plugins/change_auth_plan/models/base.py:44
 #: xpack/plugins/cloud/models.py:35 xpack/plugins/cloud/models.py:116
 #: xpack/plugins/gathered_user/models.py:26
@@ -94,8 +94,8 @@ msgstr "登录复核"
 #: terminal/backends/command/models.py:19
 #: terminal/backends/command/serializers.py:12 terminal/models/session.py:42
 #: terminal/notifications.py:91 terminal/notifications.py:139
-#: tickets/models/comment.py:17 users/const.py:14 users/models/user.py:880
-#: users/models/user.py:911 users/serializers/group.py:19
+#: tickets/models/comment.py:17 users/const.py:14 users/models/user.py:884
+#: users/models/user.py:915 users/serializers/group.py:19
 #: users/templates/users/user_asset_permission.html:38
 #: users/templates/users/user_asset_permission.html:64
 #: users/templates/users/user_database_app_permission.html:37
@@ -169,7 +169,7 @@ msgstr "格式为逗号分隔的字符串, * 表示匹配所有. "
 #: authentication/forms.py:15 authentication/forms.py:17
 #: authentication/templates/authentication/_msg_different_city.html:9
 #: authentication/templates/authentication/_msg_oauth_bind.html:9
-#: ops/models/adhoc.py:159 users/forms/profile.py:31 users/models/user.py:653
+#: ops/models/adhoc.py:159 users/forms/profile.py:31 users/models/user.py:657
 #: users/templates/users/_msg_user_created.html:12
 #: users/templates/users/_select_user_modal.html:14
 #: xpack/plugins/change_auth_plan/models/asset.py:34
@@ -274,7 +274,7 @@ msgstr "远程应用"
 msgid "Custom"
 msgstr "自定义"
 
-#: applications/models/account.py:12 applications/models/application.py:230
+#: applications/models/account.py:12 applications/models/application.py:228
 #: assets/models/backup.py:32 assets/models/cmd_filter.py:45
 #: perms/models/application_permission.py:28
 msgid "Application"
@@ -314,7 +314,7 @@ msgstr "可以查看应用账号密码"
 msgid "Can change application account secret"
 msgstr "可以查看应用账号密码"
 
-#: applications/models/application.py:215
+#: applications/models/application.py:213
 #: applications/serializers/application.py:99 assets/models/label.py:21
 #: perms/models/application_permission.py:21
 #: perms/serializers/application/user_permission.py:33
@@ -323,7 +323,7 @@ msgstr "可以查看应用账号密码"
 msgid "Category"
 msgstr "类别"
 
-#: applications/models/application.py:218
+#: applications/models/application.py:216
 #: applications/serializers/application.py:101 assets/models/backup.py:49
 #: assets/models/cmd_filter.py:82 assets/models/user.py:246
 #: perms/models/application_permission.py:24
@@ -336,21 +336,21 @@ msgstr "类别"
 msgid "Type"
 msgstr "类型"
 
-#: applications/models/application.py:222 assets/models/asset.py:217
+#: applications/models/application.py:220 assets/models/asset.py:217
 #: assets/models/domain.py:29 assets/models/domain.py:63
 msgid "Domain"
 msgstr "网域"
 
-#: applications/models/application.py:224 xpack/plugins/cloud/models.py:33
+#: applications/models/application.py:222 xpack/plugins/cloud/models.py:33
 #: xpack/plugins/cloud/serializers/account.py:58
 msgid "Attrs"
 msgstr "属性"
 
-#: applications/models/application.py:234
+#: applications/models/application.py:232
 msgid "Can match application"
 msgstr "匹配应用"
 
-#: applications/models/application.py:282
+#: applications/models/application.py:280
 msgid "Application user"
 msgstr "应用用户"
 
@@ -379,7 +379,7 @@ msgstr "类型名称"
 #: assets/serializers/cmd_filter.py:49 common/db/models.py:113
 #: common/mixins/models.py:50 ops/models/adhoc.py:39 ops/models/command.py:30
 #: orgs/models.py:67 orgs/models.py:217 perms/models/base.py:92
-#: users/models/group.py:18 users/models/user.py:912
+#: users/models/group.py:18 users/models/user.py:916
 #: xpack/plugins/cloud/models.py:125
 msgid "Date created"
 msgstr "创建日期"
@@ -631,7 +631,7 @@ msgstr "标签管理"
 #: assets/models/cluster.py:28 assets/models/cmd_filter.py:52
 #: assets/models/cmd_filter.py:99 assets/models/group.py:21
 #: common/db/models.py:111 common/mixins/models.py:49 orgs/models.py:66
-#: orgs/models.py:219 perms/models/base.py:91 users/models/user.py:700
+#: orgs/models.py:219 perms/models/base.py:91 users/models/user.py:704
 #: users/serializers/group.py:33
 #: xpack/plugins/change_auth_plan/models/base.py:48
 #: xpack/plugins/cloud/models.py:122 xpack/plugins/gathered_user/models.py:30
@@ -780,7 +780,7 @@ msgstr "校验日期"
 
 #: assets/models/base.py:177 audits/signal_handlers.py:68
 #: authentication/forms.py:22
-#: authentication/templates/authentication/login.html:178
+#: authentication/templates/authentication/login.html:181
 #: settings/serializers/auth/ldap.py:44 users/forms/profile.py:21
 #: users/templates/users/_msg_user_created.html:13
 #: users/templates/users/user_password_update.html:43
@@ -812,7 +812,7 @@ msgstr "带宽"
 msgid "Contact"
 msgstr "联系人"
 
-#: assets/models/cluster.py:22 users/models/user.py:675
+#: assets/models/cluster.py:22 users/models/user.py:679
 msgid "Phone"
 msgstr "手机"
 
@@ -838,7 +838,7 @@ msgid "Default"
 msgstr "默认"
 
 #: assets/models/cluster.py:36 assets/models/label.py:14 rbac/const.py:6
-#: users/models/user.py:897
+#: users/models/user.py:901
 msgid "System"
 msgstr "系统"
 
@@ -847,7 +847,7 @@ msgid "Default Cluster"
 msgstr "默认Cluster"
 
 #: assets/models/cmd_filter.py:34 perms/models/base.py:86
-#: users/models/group.py:31 users/models/user.py:661
+#: users/models/group.py:31 users/models/user.py:665
 #: users/templates/users/_select_user_modal.html:16
 #: users/templates/users/user_asset_permission.html:39
 #: users/templates/users/user_asset_permission.html:67
@@ -1502,7 +1502,7 @@ msgstr "用户代理"
 
 #: audits/models.py:124
 #: authentication/templates/authentication/_mfa_confirm_modal.html:14
-#: users/forms/profile.py:64 users/models/user.py:678
+#: users/forms/profile.py:64 users/models/user.py:682
 #: users/serializers/profile.py:121
 msgid "MFA"
 msgstr "MFA"
@@ -1580,13 +1580,13 @@ msgstr "认证令牌"
 
 #: audits/signal_handlers.py:71 authentication/notifications.py:73
 #: authentication/views/login.py:164 authentication/views/wecom.py:158
-#: notifications/backends/__init__.py:11 users/models/user.py:714
+#: notifications/backends/__init__.py:11 users/models/user.py:718
 msgid "WeCom"
 msgstr "企业微信"
 
 #: audits/signal_handlers.py:72 authentication/views/dingtalk.py:160
 #: authentication/views/login.py:170 notifications/backends/__init__.py:12
-#: users/models/user.py:715
+#: users/models/user.py:719
 msgid "DingTalk"
 msgstr "钉钉"
 
@@ -1759,7 +1759,7 @@ msgstr "{ApplicationPermission} 添加 {SystemUser}"
 msgid "{ApplicationPermission} REMOVE {SystemUser}"
 msgstr "{ApplicationPermission} 移除 {SystemUser}"
 
-#: authentication/api/connection_token.py:296
+#: authentication/api/connection_token.py:313
 msgid "Invalid token"
 msgstr "无效的令牌"
 
@@ -2117,14 +2117,14 @@ msgid "Show"
 msgstr "显示"
 
 #: authentication/templates/authentication/_access_key_modal.html:66
-#: settings/serializers/security.py:39 users/models/user.py:550
+#: settings/serializers/security.py:39 users/models/user.py:554
 #: users/serializers/profile.py:111 users/templates/users/mfa_setting.html:61
 #: users/templates/users/user_verify_mfa.html:36
 msgid "Disable"
 msgstr "禁用"
 
 #: authentication/templates/authentication/_access_key_modal.html:67
-#: users/models/user.py:551 users/serializers/profile.py:112
+#: users/models/user.py:555 users/serializers/profile.py:112
 #: users/templates/users/mfa_setting.html:26
 #: users/templates/users/mfa_setting.html:68
 msgid "Enable"
@@ -2172,7 +2172,7 @@ msgstr "代码错误"
 #: authentication/templates/authentication/_msg_reset_password.html:3
 #: authentication/templates/authentication/_msg_rest_password_success.html:2
 #: authentication/templates/authentication/_msg_rest_public_key_success.html:2
-#: jumpserver/conf.py:293 ops/tasks.py:145 ops/tasks.py:148
+#: jumpserver/conf.py:295 ops/tasks.py:145 ops/tasks.py:148
 #: perms/templates/perms/_msg_item_permissions_expire.html:3
 #: perms/templates/perms/_msg_permed_items_expire.html:3
 #: users/templates/users/_msg_account_expire_reminder.html:4
@@ -2254,22 +2254,22 @@ msgid ""
 "security issues"
 msgstr "如果这次公钥更新不是由你发起的，那么你的账号可能存在安全问题"
 
-#: authentication/templates/authentication/login.html:170
+#: authentication/templates/authentication/login.html:173
 msgid "Welcome back, please enter username and password to login"
 msgstr "欢迎回来，请输入用户名和密码登录"
 
-#: authentication/templates/authentication/login.html:206
+#: authentication/templates/authentication/login.html:209
 #: users/templates/users/forgot_password.html:15
 #: users/templates/users/forgot_password.html:16
 msgid "Forgot password"
 msgstr "忘记密码"
 
-#: authentication/templates/authentication/login.html:213
-#: templates/_header_bar.html:83
+#: authentication/templates/authentication/login.html:216
+#: templates/_header_bar.html:89
 msgid "Login"
 msgstr "登录"
 
-#: authentication/templates/authentication/login.html:220
+#: authentication/templates/authentication/login.html:223
 msgid "More login options"
 msgstr "更多登录方式"
 
@@ -2373,7 +2373,7 @@ msgid "The FeiShu is already bound to another user"
 msgstr "该飞书已经绑定其他用户"
 
 #: authentication/views/feishu.py:148 authentication/views/login.py:176
-#: notifications/backends/__init__.py:14 users/models/user.py:716
+#: notifications/backends/__init__.py:14 users/models/user.py:720
 msgid "FeiShu"
 msgstr "飞书"
 
@@ -2624,11 +2624,11 @@ msgstr "不能包含特殊字符"
 msgid "The mobile phone number format is incorrect"
 msgstr "手机号格式不正确"
 
-#: jumpserver/conf.py:292
+#: jumpserver/conf.py:294
 msgid "Create account successfully"
 msgstr "创建账号成功"
 
-#: jumpserver/conf.py:294
+#: jumpserver/conf.py:296
 msgid "Your account has been created successfully"
 msgstr "你的账号已创建成功"
 
@@ -2668,7 +2668,7 @@ msgid "Notifications"
 msgstr "通知"
 
 #: notifications/backends/__init__.py:10 users/forms/profile.py:101
-#: users/models/user.py:657
+#: users/models/user.py:661
 msgid "Email"
 msgstr "邮件"
 
@@ -2894,7 +2894,7 @@ msgid "Can view root org"
 msgstr "可以查看全局组织"
 
 #: orgs/models.py:216 rbac/models/role.py:46 rbac/models/rolebinding.py:43
-#: users/models/user.py:665 users/templates/users/_select_user_modal.html:15
+#: users/models/user.py:669 users/templates/users/_select_user_modal.html:15
 msgid "Role"
 msgstr "角色"
 
@@ -2981,7 +2981,7 @@ msgstr "剪贴板复制粘贴"
 #: perms/models/base.py:90
 #: tickets/serializers/ticket/meta/ticket_type/apply_application.py:58
 #: tickets/serializers/ticket/meta/ticket_type/apply_asset.py:60
-#: users/models/user.py:697
+#: users/models/user.py:701
 msgid "Date expired"
 msgstr "失效日期"
 
@@ -4207,30 +4207,38 @@ msgid "Enable XRDP"
 msgstr "启用 XRDP 服务"
 
 #: settings/serializers/terminal.py:42
+msgid "Koko host"
+msgstr "KOKO 主机地址"
+
+#: settings/serializers/terminal.py:43
+msgid "Koko ssh port"
+msgstr "KOKO ssh 端口"
+
+#: settings/serializers/terminal.py:45
 msgid "Enable database proxy"
 msgstr "启用数据库组件"
 
-#: settings/serializers/terminal.py:44
+#: settings/serializers/terminal.py:47
 msgid "Database proxy host"
 msgstr "数据库主机地址"
 
-#: settings/serializers/terminal.py:45
+#: settings/serializers/terminal.py:48
 msgid "Database proxy host, eg: dev.jumpserver.org"
 msgstr "数据库组件地址, 如: dev.jumpserver.org (没有端口, 不同协议端口不同)"
 
-#: settings/serializers/terminal.py:48
+#: settings/serializers/terminal.py:51
 msgid "MySQL port"
 msgstr "MySQL 协议端口"
 
-#: settings/serializers/terminal.py:49
+#: settings/serializers/terminal.py:52
 msgid "Database proxy MySQL protocol port"
 msgstr "数据库组件 MySQL 协议监听的端口"
 
-#: settings/serializers/terminal.py:52
+#: settings/serializers/terminal.py:55
 msgid "PostgreSQL port"
 msgstr "PostgreSQL 端口"
 
-#: settings/serializers/terminal.py:53
+#: settings/serializers/terminal.py:56
 msgid "Database proxy PostgreSQL port"
 msgstr "数据库组件 PostgreSQL 协议监听的端口"
 
@@ -4383,24 +4391,24 @@ msgstr "文档"
 msgid "Commercial support"
 msgstr "商业支持"
 
-#: templates/_header_bar.html:70 users/forms/profile.py:43
+#: templates/_header_bar.html:76 users/forms/profile.py:43
 #: users/templates/users/user_password_update.html:39
 msgid "Profile"
 msgstr "个人信息"
 
-#: templates/_header_bar.html:73
+#: templates/_header_bar.html:79
 msgid "Admin page"
 msgstr "管理页面"
 
-#: templates/_header_bar.html:75
+#: templates/_header_bar.html:81
 msgid "User page"
 msgstr "用户页面"
 
-#: templates/_header_bar.html:78
+#: templates/_header_bar.html:84
 msgid "API Key"
 msgstr "API Key"
 
-#: templates/_header_bar.html:79
+#: templates/_header_bar.html:85
 msgid "Logout"
 msgstr "注销登录"
 
@@ -5051,7 +5059,7 @@ msgstr "端点无效: 移除路径 `{}`"
 msgid "Bucket"
 msgstr "桶名称"
 
-#: terminal/serializers/storage.py:34 users/models/user.py:689
+#: terminal/serializers/storage.py:34 users/models/user.py:693
 msgid "Secret key"
 msgstr "密钥"
 
@@ -5654,68 +5662,68 @@ msgstr "不能和原来的密钥相同"
 msgid "Not a valid ssh public key"
 msgstr "SSH密钥不合法"
 
-#: users/forms/profile.py:160 users/models/user.py:686
+#: users/forms/profile.py:160 users/models/user.py:690
 #: users/templates/users/user_password_update.html:48
 msgid "Public key"
 msgstr "SSH公钥"
 
-#: users/models/user.py:552
+#: users/models/user.py:556
 msgid "Force enable"
 msgstr "强制启用"
 
-#: users/models/user.py:619
+#: users/models/user.py:623
 msgid "Local"
 msgstr "数据库"
 
-#: users/models/user.py:667 users/serializers/user.py:140
+#: users/models/user.py:671 users/serializers/user.py:140
 msgid "Is service account"
 msgstr "服务账号"
 
-#: users/models/user.py:669
+#: users/models/user.py:673
 msgid "Avatar"
 msgstr "头像"
 
-#: users/models/user.py:672
+#: users/models/user.py:676
 msgid "Wechat"
 msgstr "微信"
 
-#: users/models/user.py:683
+#: users/models/user.py:687
 msgid "Private key"
 msgstr "ssh私钥"
 
-#: users/models/user.py:705
+#: users/models/user.py:709
 msgid "Source"
 msgstr "来源"
 
-#: users/models/user.py:709
+#: users/models/user.py:713
 msgid "Date password last updated"
 msgstr "最后更新密码日期"
 
-#: users/models/user.py:712
+#: users/models/user.py:716
 msgid "Need update password"
 msgstr "需要更新密码"
 
-#: users/models/user.py:882
+#: users/models/user.py:886
 msgid "Can invite user"
 msgstr "可以邀请用户"
 
-#: users/models/user.py:883
+#: users/models/user.py:887
 msgid "Can remove user"
 msgstr "可以移除用户"
 
-#: users/models/user.py:884
+#: users/models/user.py:888
 msgid "Can match user"
 msgstr "可以匹配用户"
 
-#: users/models/user.py:893
+#: users/models/user.py:897
 msgid "Administrator"
 msgstr "管理员"
 
-#: users/models/user.py:896
+#: users/models/user.py:900
 msgid "Administrator is the super user of system"
 msgstr "Administrator是初始的超级管理员"
 
-#: users/models/user.py:921
+#: users/models/user.py:925
 msgid "User password history"
 msgstr "用户密码历史"
 

apps/settings/api/public.py

@@ -64,6 +64,8 @@ class PublicSettingApi(generics.RetrieveAPIView):
                 "AUTH_FEISHU": settings.AUTH_FEISHU,
                 # Terminal
                 "XRDP_ENABLED": settings.XRDP_ENABLED,
+                "TERMINAL_KOKO_HOST": settings.TERMINAL_KOKO_HOST,
+                "TERMINAL_KOKO_SSH_PORT": settings.TERMINAL_KOKO_SSH_PORT,
                 "TERMINAL_MAGNUS_ENABLED": settings.TERMINAL_MAGNUS_ENABLED,
                 "TERMINAL_MAGNUS_HOST": settings.TERMINAL_MAGNUS_HOST,
                 "TERMINAL_MAGNUS_MYSQL_PORT": settings.TERMINAL_MAGNUS_MYSQL_PORT,

apps/settings/serializers/terminal.py

@@ -39,6 +39,9 @@ class TerminalSettingSerializer(serializers.Serializer):
     )
     XRDP_ENABLED = serializers.BooleanField(label=_("Enable XRDP"))
 
+    TERMINAL_KOKO_HOST = serializers.BooleanField(label=_("Koko host"))
+    TERMINAL_KOKO_SSH_PORT = serializers.BooleanField(label=_("Koko ssh port"))
+
     TERMINAL_MAGNUS_ENABLED = serializers.BooleanField(label=_("Enable database proxy"))
     TERMINAL_MAGNUS_HOST = serializers.CharField(
         required=False, label=_("Database proxy host"), max_length=1024, allow_blank=True,