mirror of https://github.com/jumpserver/jumpserver
555 lines
19 KiB
Python
555 lines
19 KiB
Python
# coding: utf-8
|
||
|
||
import sys
|
||
|
||
reload(sys)
|
||
sys.setdefaultencoding('utf8')
|
||
|
||
import os
|
||
import re
|
||
import time
|
||
import datetime
|
||
import textwrap
|
||
import getpass
|
||
import readline
|
||
import django
|
||
from multiprocessing import Pool
|
||
import paramiko
|
||
import struct, fcntl, signal, socket, select, fnmatch
|
||
|
||
os.environ['DJANGO_SETTINGS_MODULE'] = 'jumpserver.settings'
|
||
if django.get_version() != '1.6':
|
||
django.setup()
|
||
from jumpserver.api import ServerError, User, Asset, AssetGroup, get_object
|
||
from jumpserver.api import logger, is_dir, Log, TtyLog
|
||
from jumpserver.settings import log_dir
|
||
|
||
try:
|
||
import termios
|
||
import tty
|
||
except ImportError:
|
||
print '\033[1;31m仅支持类Unix系统 Only unix like supported.\033[0m'
|
||
time.sleep(3)
|
||
sys.exit()
|
||
|
||
VIM_FLAG = False
|
||
VIM_COMMAND = ''
|
||
SSH_TTY = ''
|
||
login_user = get_object(User, username=getpass.getuser())
|
||
|
||
|
||
def color_print(msg, color='red', exits=False):
|
||
"""
|
||
Print colorful string.
|
||
颜色打印字符或者退出
|
||
"""
|
||
color_msg = {'blue': '\033[1;36m%s\033[0m',
|
||
'green': '\033[1;32m%s\033[0m',
|
||
'red': '\033[1;31m%s\033[0m'}
|
||
|
||
print color_msg.get(color, 'blue') % msg
|
||
if exits:
|
||
time.sleep(2)
|
||
sys.exit()
|
||
|
||
|
||
def verify_connect(user, option):
|
||
"""
|
||
Check user was permed or not . Check ip is unique or not.
|
||
鉴定用户是否有该主机权限 或 匹配到的ip是否唯一
|
||
"""
|
||
ip_matched = []
|
||
try:
|
||
assets_info = login_user.get_asset_info()
|
||
except ServerError, e:
|
||
color_print(e, 'red')
|
||
return False
|
||
|
||
for ip, asset_info in assets_info.items():
|
||
if option in asset_info[1:] and option:
|
||
ip_matched = [asset_info[1]]
|
||
break
|
||
|
||
for info in asset_info[1:]:
|
||
if option in info:
|
||
ip_matched.append(ip)
|
||
|
||
logger.debug('%s matched input %s: %s' % (login_user.username, option, ip_matched))
|
||
ip_matched = list(set(ip_matched))
|
||
|
||
if len(ip_matched) > 1: # 如果匹配ip不唯一
|
||
ip_comment = {}
|
||
for ip in ip_matched:
|
||
ip_comment[ip] = assets_info[ip][2]
|
||
|
||
for ip in sorted(ip_comment):
|
||
if ip_comment[ip]:
|
||
print '%-15s -- %s' % (ip, ip_comment[ip])
|
||
else:
|
||
print '%-15s' % ip
|
||
print ''
|
||
elif len(ip_matched) < 1: # 如果没匹配到
|
||
color_print('没有该主机，或者您没有该主机的权限 No Permission or No host.', 'red')
|
||
else: # 恰好是1个
|
||
asset = get_object(Asset, ip=ip_matched[0])
|
||
jtty = Jtty(user, asset)
|
||
jtty.connect()
|
||
|
||
|
||
def check_vim_status(command, ssh):
|
||
global SSH_TTY
|
||
print command
|
||
if command == '':
|
||
return True
|
||
else:
|
||
command_str= 'ps -ef |grep "%s" | grep "%s"|grep -v grep |wc -l' % (command,SSH_TTY)
|
||
print command_str
|
||
stdin, stdout, stderr = ssh.exec_command(command_str)
|
||
ps_num = stdout.read()
|
||
print ps_num
|
||
if int(ps_num) == 0:
|
||
return True
|
||
else:
|
||
return False
|
||
|
||
|
||
def deal_command(str_r, ssh):
|
||
|
||
"""
|
||
处理命令中特殊字符
|
||
"""
|
||
str_r = re.sub('\x07','',str_r) #删除响铃
|
||
patch_char = re.compile('\x08\x1b\[C') #删除方向左右一起的按键
|
||
while patch_char.search(str_r):
|
||
str_r = patch_char.sub('', str_r.rstrip())
|
||
|
||
result_command = '' #最后的结果
|
||
pattern_str = '' #模式中间中的字符串
|
||
backspace_num = 0 #光标移动的个数
|
||
reach_backspace_flag = False #没有检测到光标键则为true
|
||
end_flag = False
|
||
while str_r:
|
||
tmp = re.match(r'\w', str_r)
|
||
if tmp:
|
||
if reach_backspace_flag:
|
||
pattern_str += str(tmp.group(0))
|
||
str_r = str_r[1:]
|
||
continue
|
||
else:
|
||
result_command += str(tmp.group(0))
|
||
str_r = str_r[1:]
|
||
continue
|
||
|
||
tmp = re.match(r'\x1b\[K[\x08]*', str_r)
|
||
if tmp:
|
||
if backspace_num > 0:
|
||
if backspace_num > len(result_command) :
|
||
result_command += pattern_str
|
||
result_command = result_command[0:-backspace_num]
|
||
else:
|
||
result_command = result_command[0:-backspace_num]
|
||
result_command += pattern_str
|
||
del_len = len(str(tmp.group(0)))-3
|
||
if del_len > 0:
|
||
result_command = result_command[0:-del_len]
|
||
reach_backspace_flag = False
|
||
backspace_num =0
|
||
pattern_str=''
|
||
str_r = str_r[len(str(tmp.group(0))):]
|
||
continue
|
||
if re.match(r'\x08', str_r):
|
||
backspace_num += 1
|
||
reach_backspace_flag = True
|
||
str_r = str_r[1:]
|
||
if len(str_r) == 0:
|
||
end_flag = True
|
||
continue
|
||
if reach_backspace_flag :
|
||
pattern_str += str_r[0]
|
||
else :
|
||
result_command += str_r[0]
|
||
str_r = str_r[1:]
|
||
|
||
if backspace_num > 0 and not end_flag:
|
||
result_command = result_command[:-backspace_num]
|
||
result_command += pattern_str
|
||
|
||
|
||
|
||
control_char = re.compile(r"""
|
||
\x1b[ #%()*+\-.\/]. |
|
||
\r | #匹配 回车符(CR)
|
||
(?:\x1b\[|\x9b) [ -?]* [@-~] | #匹配 控制顺序描述符(CSI)... Cmd
|
||
(?:\x1b\]|\x9d) .*? (?:\x1b\\|[\a\x9c]) | \x07 | #匹配 操作系统指令(OSC)...终止符或振铃符(ST|BEL)
|
||
(?:\x1b[P^_]|[\x90\x9e\x9f]) .*? (?:\x1b\\|\x9c) | #匹配 设备控制串或私讯或应用程序命令(DCS|PM|APC)...终止符(ST)
|
||
\x1b. #匹配 转义过后的字符
|
||
[\x80-\x9f] #匹配 所有控制字符
|
||
""", re.X)
|
||
result_command = control_char.sub('', result_command.strip())
|
||
global VIM_FLAG
|
||
global VIM_COMMAND
|
||
if not VIM_FLAG:
|
||
if result_command.startswith('vim') or result_command.startswith('vi') :
|
||
VIM_FLAG = True
|
||
VIM_COMMAND = result_command
|
||
return result_command.decode('utf8',"ignore")
|
||
else:
|
||
if check_vim_status(VIM_COMMAND, ssh):
|
||
VIM_FLAG = False
|
||
VIM_COMMAND=''
|
||
return result_command.decode('utf8',"ignore")
|
||
else:
|
||
return ''
|
||
|
||
|
||
def newline_code_in(strings):
|
||
for i in ['\r', '\r\n', '\n']:
|
||
if i in strings:
|
||
#print "new line"
|
||
return True
|
||
return False
|
||
|
||
|
||
class Tty(object):
|
||
"""
|
||
A virtual tty class
|
||
一个虚拟终端类，实现连接ssh和记录日志，基类
|
||
"""
|
||
def __init__(self, username, asset_name):
|
||
self.username = username
|
||
self.asset_name = asset_name
|
||
self.ip = None
|
||
self.port = 22
|
||
self.channel = None
|
||
self.user = None
|
||
self.asset = None
|
||
self.role = None
|
||
self.ssh = None
|
||
self.connect_info = None
|
||
self.login_type = 'ssh'
|
||
|
||
@staticmethod
|
||
def is_output(strings):
|
||
newline_char = ['\n', '\r', '\r\n']
|
||
for char in newline_char:
|
||
if char in strings:
|
||
return True
|
||
return False
|
||
|
||
@staticmethod
|
||
def remove_control_char(str_r):
|
||
"""
|
||
处理日志特殊字符
|
||
"""
|
||
control_char = re.compile(r"""
|
||
\x1b[ #%()*+\-.\/]. |
|
||
\r | #匹配 回车符(CR)
|
||
(?:\x1b\[|\x9b) [ -?]* [@-~] | #匹配 控制顺序描述符(CSI)... Cmd
|
||
(?:\x1b\]|\x9d) .*? (?:\x1b\\|[\a\x9c]) | \x07 | #匹配 操作系统指令(OSC)...终止符或振铃符(ST|BEL)
|
||
(?:\x1b[P^_]|[\x90\x9e\x9f]) .*? (?:\x1b\\|\x9c) | #匹配 设备控制串或私讯或应用程序命令(DCS|PM|APC)...终止符(ST)
|
||
\x1b. #匹配 转义过后的字符
|
||
[\x80-\x9f] #匹配 所有控制字符
|
||
""", re.X)
|
||
backspace = re.compile(r"[^\b][\b]")
|
||
line_filtered = control_char.sub('', str_r.rstrip())
|
||
while backspace.search(line_filtered):
|
||
line_filtered = backspace.sub('', line_filtered)
|
||
|
||
return line_filtered
|
||
|
||
def get_log_file(self):
|
||
"""
|
||
Logging user command and output.
|
||
记录用户的日志
|
||
"""
|
||
tty_log_dir = os.path.join(log_dir, 'tty')
|
||
timestamp_start = int(time.time())
|
||
date_start = time.strftime('%Y%m%d', time.localtime(timestamp_start))
|
||
time_start = time.strftime('%H%M%S', time.localtime(timestamp_start))
|
||
today_connect_log_dir = os.path.join(tty_log_dir, date_start)
|
||
log_file_path = os.path.join(today_connect_log_dir, '%s_%s_%s' % (self.username, self.asset_name, time_start))
|
||
|
||
try:
|
||
is_dir(today_connect_log_dir, mode=0777)
|
||
except OSError:
|
||
raise ServerError('Create %s failed, Please modify %s permission.' % (today_connect_log_dir, tty_log_dir))
|
||
|
||
try:
|
||
log_file_f = open(log_file_path + '.log', 'a')
|
||
log_time_f = open(log_file_path + '.time', 'a')
|
||
except IOError:
|
||
raise ServerError('Create logfile failed, Please modify %s permission.' % today_connect_log_dir)
|
||
|
||
if self.login_type == 'ssh':
|
||
pid = os.getpid()
|
||
remote_ip = os.popen("who -m | awk '{ print $5 }'").read().strip('()\n')
|
||
log = Log(user=self.username, host=self.asset_name, remote_ip=remote_ip,
|
||
log_path=log_file_path, start_time=datetime.datetime.now(), pid=pid)
|
||
else:
|
||
remote_ip = 'Web'
|
||
log = Log(user=self.username, host=self.asset_name, remote_ip=remote_ip,
|
||
log_path=log_file_path, start_time=datetime.datetime.now(), pid=0)
|
||
log.save()
|
||
log.pid = log.id
|
||
log.save()
|
||
|
||
log_file_f.write('Start at %s\n' % datetime.datetime.now())
|
||
log.save()
|
||
return log_file_f, log_time_f, log
|
||
|
||
def get_connect_info(self):
|
||
"""
|
||
获取需要登陆的主机的信息和映射用户的账号密码
|
||
"""
|
||
|
||
# 1. get ip, port
|
||
# 2. get 映射用户
|
||
# 3. get 映射用户的账号，密码或者key
|
||
# self.connect_info = {'user': '', 'asset': '', 'ip': '', 'port': 0, 'role_name': '', 'role_pass': '', 'role_key': ''}
|
||
self.connect_info = {'user': 'a', 'asset': 'b', 'ip': '127.0.0.1', 'port': 22, 'role_name': 'root', 'role_pass': '', 'role_key': '/root/.ssh/id_rsa.bak'}
|
||
return self.connect_info
|
||
|
||
def get_connection(self):
|
||
"""
|
||
获取连接成功后的ssh
|
||
"""
|
||
connect_info = self.get_connect_info()
|
||
|
||
# 发起ssh连接请求 Make a ssh connection
|
||
ssh = paramiko.SSHClient()
|
||
ssh.load_system_host_keys()
|
||
ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
|
||
try:
|
||
if connect_info.get('role_pass'):
|
||
ssh.connect(connect_info.get('ip'),
|
||
port=connect_info.get('port'),
|
||
username=connect_info.get('role_name'),
|
||
password=connect_info.get('role_pass'),
|
||
look_for_keys=False)
|
||
else:
|
||
ssh.connect(connect_info.get('ip'),
|
||
port=connect_info.get('port'),
|
||
username=connect_info.get('role_name'),
|
||
key_filename=connect_info.get('role_key'),
|
||
look_for_keys=False)
|
||
|
||
except paramiko.ssh_exception.AuthenticationException, paramiko.ssh_exception.SSHException:
|
||
raise ServerError('认证失败 Authentication Error.')
|
||
except socket.error:
|
||
raise ServerError('端口可能不对 Connect SSH Socket Port Error, Please Correct it.')
|
||
else:
|
||
self.ssh = ssh
|
||
return ssh
|
||
|
||
|
||
class SshTty(Tty):
|
||
"""
|
||
A virtual tty class
|
||
一个虚拟终端类，实现连接ssh和记录日志
|
||
"""
|
||
|
||
@staticmethod
|
||
def get_win_size():
|
||
"""
|
||
This function use to get the size of the windows!
|
||
获得terminal窗口大小
|
||
"""
|
||
if 'TIOCGWINSZ' in dir(termios):
|
||
TIOCGWINSZ = termios.TIOCGWINSZ
|
||
else:
|
||
TIOCGWINSZ = 1074295912L
|
||
s = struct.pack('HHHH', 0, 0, 0, 0)
|
||
x = fcntl.ioctl(sys.stdout.fileno(), TIOCGWINSZ, s)
|
||
return struct.unpack('HHHH', x)[0:2]
|
||
|
||
def set_win_size(self, sig, data):
|
||
"""
|
||
This function use to set the window size of the terminal!
|
||
设置terminal窗口大小
|
||
"""
|
||
try:
|
||
win_size = self.get_win_size()
|
||
self.channel.resize_pty(height=win_size[0], width=win_size[1])
|
||
except Exception:
|
||
pass
|
||
|
||
def posix_shell(self):
|
||
"""
|
||
Use paramiko channel connect server interactive.
|
||
使用paramiko模块的channel，连接后端，进入交互式
|
||
"""
|
||
log_file_f, log_time_f, log = self.get_log_file()
|
||
old_tty = termios.tcgetattr(sys.stdin)
|
||
pre_timestamp = time.time()
|
||
input_r = ''
|
||
input_mode = False
|
||
|
||
try:
|
||
tty.setraw(sys.stdin.fileno())
|
||
tty.setcbreak(sys.stdin.fileno())
|
||
self.channel.settimeout(0.0)
|
||
|
||
while True:
|
||
try:
|
||
r, w, e = select.select([self.channel, sys.stdin], [], [])
|
||
except Exception:
|
||
pass
|
||
|
||
if self.channel in r:
|
||
try:
|
||
x = self.channel.recv(1024)
|
||
if len(x) == 0:
|
||
break
|
||
sys.stdout.write(x)
|
||
sys.stdout.flush()
|
||
now_timestamp = time.time()
|
||
log_time_f.write('%s %s\n' % (round(now_timestamp-pre_timestamp, 4), len(x)))
|
||
log_file_f.write(x)
|
||
pre_timestamp = now_timestamp
|
||
log_file_f.flush()
|
||
log_time_f.flush()
|
||
|
||
if input_mode and not self.is_output(x):
|
||
input_r += x
|
||
|
||
except socket.timeout:
|
||
pass
|
||
|
||
if sys.stdin in r:
|
||
x = os.read(sys.stdin.fileno(), 1)
|
||
if not input_mode:
|
||
input_mode = True
|
||
|
||
if str(x) in ['\r', '\n', '\r\n']:
|
||
# input_r = deal_command(input_r,ssh)
|
||
input_r = self.remove_control_char(input_r)
|
||
|
||
TtyLog(log=log, datetime=datetime.datetime.now(), cmd=input_r).save()
|
||
input_r = ''
|
||
input_mode = False
|
||
|
||
if len(x) == 0:
|
||
break
|
||
self.channel.send(x)
|
||
|
||
finally:
|
||
termios.tcsetattr(sys.stdin, termios.TCSADRAIN, old_tty)
|
||
log_file_f.write('End time is %s' % datetime.datetime.now())
|
||
log_file_f.close()
|
||
log.is_finished = True
|
||
log.end_time = datetime.datetime.now()
|
||
log.save()
|
||
|
||
def connect(self):
|
||
"""
|
||
Connect server.
|
||
连接服务器
|
||
"""
|
||
ps1 = "PS1='[\u@%s \W]\$ '\n" % self.ip
|
||
login_msg = "clear;echo -e '\\033[32mLogin %s done. Enjoy it.\\033[0m'\n" % self.ip
|
||
|
||
# 发起ssh连接请求 Make a ssh connection
|
||
ssh = self.get_connection()
|
||
|
||
# 获取连接的隧道并设置窗口大小 Make a channel and set windows size
|
||
global channel
|
||
win_size = self.get_win_size()
|
||
self.channel = channel = ssh.invoke_shell(height=win_size[0], width=win_size[1], term='xterm')
|
||
try:
|
||
signal.signal(signal.SIGWINCH, self.set_win_size)
|
||
except:
|
||
pass
|
||
|
||
# 设置PS1并提示 Set PS1 and msg it
|
||
#channel.send(ps1)
|
||
#channel.send(login_msg)
|
||
# channel.send('echo ${SSH_TTY}\n')
|
||
# global SSH_TTY
|
||
# while not channel.recv_ready():
|
||
# time.sleep(1)
|
||
# tmp = channel.recv(1024)
|
||
#print 'ok'+tmp+'ok'
|
||
# SSH_TTY = re.search(r'(?<=/dev/).*', tmp).group().strip()
|
||
# SSH_TTY = ''
|
||
channel.send('clear\n')
|
||
# Make ssh interactive tunnel
|
||
self.posix_shell()
|
||
|
||
# Shutdown channel socket
|
||
channel.close()
|
||
ssh.close()
|
||
|
||
def execute(self, cmd):
|
||
"""
|
||
execute cmd on the asset
|
||
执行命令
|
||
"""
|
||
pass
|
||
|
||
|
||
def print_prompt():
|
||
"""
|
||
Print prompt
|
||
打印提示导航
|
||
"""
|
||
msg = """\033[1;32m### Welcome Use JumpServer To Login. ### \033[0m
|
||
1) Type \033[32mIP or Part IP, Host Alias or Comments \033[0m To Login.
|
||
2) Type \033[32mP/p\033[0m To Print The Servers You Available.
|
||
3) Type \033[32mG/g\033[0m To Print The Server Groups You Available.
|
||
4) Type \033[32mG/g(1-N)\033[0m To Print The Server Group Hosts You Available.
|
||
5) Type \033[32mE/e\033[0m To Execute Command On Several Servers.
|
||
6) Type \033[32mQ/q\033[0m To Quit.
|
||
"""
|
||
print textwrap.dedent(msg)
|
||
|
||
|
||
def main():
|
||
"""
|
||
he he
|
||
主程序
|
||
"""
|
||
if not login_user: # 判断用户是否存在
|
||
color_print(u'没有该用户，或许你是以root运行的 No that user.', exits=True)
|
||
|
||
print_prompt()
|
||
gid_pattern = re.compile(r'^g\d+$')
|
||
|
||
try:
|
||
while True:
|
||
try:
|
||
option = raw_input("\033[1;32mOpt or IP>:\033[0m ")
|
||
except EOFError:
|
||
print_prompt()
|
||
continue
|
||
except KeyboardInterrupt:
|
||
sys.exit(0)
|
||
if option in ['P', 'p']:
|
||
login_user.get_asset_info(printable=True)
|
||
continue
|
||
elif option in ['G', 'g']:
|
||
login_user.get_asset_group_info(printable=True)
|
||
continue
|
||
elif gid_pattern.match(option):
|
||
gid = option[1:].strip()
|
||
asset_group = get_object(AssetGroup, id=gid)
|
||
if asset_group and asset_group.is_permed(user=login_user):
|
||
asset_group.get_asset_info(printable=True)
|
||
continue
|
||
elif option in ['E', 'e']:
|
||
# exec_cmd_servers(login_name)
|
||
pass
|
||
elif option in ['Q', 'q', 'exit']:
|
||
sys.exit()
|
||
else:
|
||
try:
|
||
verify_connect(login_user, option)
|
||
except ServerError, e:
|
||
color_print(e, 'red')
|
||
except IndexError:
|
||
pass
|
||
|
||
if __name__ == '__main__':
|
||
main()
|
||
|
||
|