ARCv2
view release on metacpan or search on metacpan
Revision history for Perl extension ARCv2.
1.05- Tue Mar 22 2005
- fixed authentication/decryption problem, which lead to
staling connections when the client thought it is authenticated,
but the server doesn't know that
- correct the exit-code handling in the arcx-client-script
- another patch by Tony Fraser (ACLs, CheckCmd for the Server-Connection)
- command-server-mapping-file for arcx-client-script
1.04 Tue Jan 04 2005
- Fixed timeout again
- command error handling improved, passed to the client separatly now
1.03 Tue Dec 02 2004
##eg> $this->_Debug("hello","world"); # message will be "hello world"
sub _Debug
{
my $this = shift;
$this->Log(LOG_DEBUG,@_);
}
## Log function.
## Logs messages to 'logdestination' if 'loglevel' is is set appropriatly.
## loglevel behaviour has changed in the 1.0 release of ARCv2, the "Arc"-class can export
## LOG_AUTH (authentication information), LOG_USER (connection information), LOG_ERR (errors),
## LOG_CMD (ARCv2 addition internal command information), LOG_SIDE (verbose client/server-specific
## information), LOG_DEBUG (verbose debug information). It possible to combine the
## levels with or (resp. +) to allow a message to appear when not all loglevels are
## requested by the user.
## Commonly used for logging errors from application level.
##in> $facility, ... (message)
##out> always false
##eg> return $arc->Log(LOG_ERR,"Message");
sub Log
{
lib/Arc.pod view on Meta::CPAN
ARC allows non-privileged users to run privileged commands on the server.
The server decides if the user is allowed to run this command through ACL.
This file is a part of the Perl ARCv2 module suite. ARCv2 is a
rewrite of ARC by R.Toebbicke, CERN, Switzerland in Perl.
=head1 ABSTRACT
From ARC by R. Toebbicke, modified by me:
User requests are shipped from a client machine to a server using a
SASL-authenticated socket connection. The purpose is to convey
requests such as privileged commands (e.g. AFS, Crontab) to be executed on the
server under appropriate privileges. Given that all privileges are
confined to the server and the server can be programmed as to filter and
check the command to be executed, the client machine can be less trusted
than the server.
Because ARC-v1-Commands are written in perl anyway, implementing the client/server
in perl makes sense. Platform-independence and "easy-to-read" source code are welcome
too. This package provides two perl command line scripts (arcx, arcxd). They can
be used for working with the ARC server from the command line, resp. to start the
lib/Arc.pod view on Meta::CPAN
B<Example:>
unless (my $err = $arc->IsError()) { .. } else { print STDERR $err; }
=item Log ( $facility, ... (message) )
B<Description>: Log function.
Logs messages to 'logdestination' if 'loglevel' is is set appropriatly.
loglevel behaviour has changed in the 1.0 release of ARCv2, the "Arc"-class can export
LOG_AUTH (authentication information), LOG_USER (connection information), LOG_ERR (errors),
LOG_CMD (ARCv2 addition internal command information), LOG_SIDE (verbose client/server-specific
information), LOG_DEBUG (verbose debug information). It possible to combine the
levels with or (resp. +) to allow a message to appear when not all loglevels are
requested by the user.
Commonly used for logging errors from application level.
B<Returns:> always false
lib/Arc/Command.pm view on Meta::CPAN
# Friend class Arc::Connection::Server;
sub members
{
my $this = shift;
return { %{$this->SUPER::members},
# private:
# protected:
_commands => {}, # the "available commands"-hash from the server,
_username => "", # user, who has authenticated against ARCv2 Server by using SASL
_realm => "", # the name of the realm, to which the user belongs (SASL)
_mech => undef, # user uses this authentication mechanism (e.g. GSSAPI)
_peeraddr => undef, # users ip address
_peername => undef, # users host address in sockaddr_in format
_peerport => undef, # users port
_cmd => undef, # user runs this command
# public:
logfileprefix => "command",
};
}
lib/Arc/Command.pod view on Meta::CPAN
ARC allows non-privileged users to run privileged commands on the server.
The server decides if the user is allowed to run this command through ACL.
This file is a part of the Perl ARCv2 module suite. ARCv2 is a
rewrite of ARC by R.Toebbicke, CERN, Switzerland in Perl.
=head1 ABSTRACT
From ARC by R. Toebbicke, modified by me:
User requests are shipped from a client machine to a server using a
SASL-authenticated socket connection. The purpose is to convey
requests such as privileged commands (e.g. AFS, Crontab) to be executed on the
server under appropriate privileges. Given that all privileges are
confined to the server and the server can be programmed as to filter and
check the command to be executed, the client machine can be less trusted
than the server.
Because ARC-v1-Commands are written in perl anyway, implementing the client/server
in perl makes sense. Platform-independence and "easy-to-read" source code are welcome
too. This package provides two perl command line scripts (arcx, arcxd). They can
be used for working with the ARC server from the command line, resp. to start the
lib/Arc/Command.pod view on Meta::CPAN
'pv' => 'Arc::Command::Pv'
}
}
)
resp.
$arc->{connection_vars}->{commands}
This hash describes the assignment of B<Command Name> and B<Command Class>.
When a client has authenticated and wants to run a command, it will send
the B<Command Name> and suitable, optional parameters. The server will look into
the commands hash and creates an object of the B<Command Class>
associated with B<Command Name>.
my $perlcmd = $this->{commands}->{$cmd};
[..]
eval "require $perlcmd;"
[..]
(fork)
my $ret = eval
lib/Arc/Command.pod view on Meta::CPAN
B<Default value>: undef
=item _commands
B<Description>: the "available commands"-hash from the server,
B<Default value>: {}
=item _mech
B<Description>: user uses this authentication mechanism (e.g. GSSAPI)
B<Default value>: undef
=item _peeraddr
B<Description>: users ip address
B<Default value>: undef
=item _peername
lib/Arc/Command.pod view on Meta::CPAN
B<Default value>: undef
=item _realm
B<Description>: the name of the realm, to which the user belongs (SASL)
B<Default value>: ""
=item _username
B<Description>: user, who has authenticated against ARCv2 Server by using SASL
B<Default value>: ""
=back
=over 2
=item _error I<inherited from Arc>
B<Description>: contains the error message
lib/Arc/Command.pod view on Meta::CPAN
B<Example:>
unless (my $err = $arc->IsError()) { .. } else { print STDERR $err; }
=item Log ( $facility, ... (message) ) I<inherited from Arc>
B<Description>: Log function.
Logs messages to 'logdestination' if 'loglevel' is is set appropriatly.
loglevel behaviour has changed in the 1.0 release of ARCv2, the "Arc"-class can export
LOG_AUTH (authentication information), LOG_USER (connection information), LOG_ERR (errors),
LOG_CMD (ARCv2 addition internal command information), LOG_SIDE (verbose client/server-specific
information), LOG_DEBUG (verbose debug information). It possible to combine the
levels with or (resp. +) to allow a message to appear when not all loglevels are
requested by the user.
Commonly used for logging errors from application level.
B<Returns:> always false
lib/Arc/Connection.pm view on Meta::CPAN
return { %{$this->SUPER::members},
# private:
__sasl => undef, # Authen::SASL Handle
__linequeue => [], # internal line buffer (idea From Net::Cmd)
__partial => "", # a partial line (idea From Net::Cmd)
# protected:
_connection => undef, # IO::Socket for the ARCv2 Connection
_cmdclientsock => undef, # IO::Socket for the command connection (encrypted)
_select => undef, # IO::Select for the ARCv2 Connection
_authenticated => 0, # Are we authenticated
#_sasl => undef, # Authen::SASL::Cyrus Handle
#_saslmech => "", # SASL mechnanism used at authentication
_cmdparameter => undef, # parameter after the command
_expectedcmds => undef, # array, which ARCv2 protocol commands are allowed to come next
_connected => 0, # are we connected
_username => "anonymous", # username extracted from SASL
# public:
protocol => undef, # Which protocol is used (0 = ARC/2.0, 1 = ARC/2.1)
timeout => undef, # timeout for all connections (ARCv2 and command) in seconds
lib/Arc/Connection.pm view on Meta::CPAN
my $this = shift;
return $this->_SetError("Initialization failed.") unless $this->SUPER::_Init(@_);
# timeout
# unless (defined $this->{timeout}) {
# $this->Log(LOG_SIDE,"Setting timeout to 30 secs since no time specified.");
# $this->{timeout} = 30;
# }
return $this->_SetError("No service name for SASL authentication specified.")
unless defined $this->{service};
return 1;
}
## initializes command connection. (protocol)
## Starts listen on the Command socket and sends the B<CMDPASV> command.
##out> true if everything went like expected, otherwise false.
##eg> $this->_CommandConnection();
sub _CommandConnection
lib/Arc/Connection.pm view on Meta::CPAN
$line =~ s/\r//g;
$line =~ s/\n/ /g;
return $this->_SetError("SendLine only available when connection and select is set.") unless $this->{_connected};
if ($this->{_select}->can_write($this->{timeout})) {
$this->_Debug(substr ($line,0,30),"..");
$line .= "\015\012";
# encrypt if necessary
$line = $this->{_sasl}->encode($line)
if $this->{_authenticated} == 1 and $this->{protocol} == 1;
return $this->{_connection}->syswrite($line,4096) > 0;
} else {
$this->{_connected} = 0;
$this->{_connection}->close;
return $this->_SetError("Sending timed out.");
}
}
## send a command. (protocol)
lib/Arc/Connection.pm view on Meta::CPAN
until (scalar @{$this->{__linequeue}}) {
if ($this->{_select}->can_read($this->{timeout})) { # true if select thinks there is data
my $inbuf;
unless ($this->{_connection}->sysread($inbuf,4096)) {
$this->{_connected} = 0;
$this->{_connection}->close();
return $this->_SetError("Connection closed by foreign host.");
}
# decrypt if possible and necessary
$buf = $this->{_sasl}->decode($inbuf)
if $this->{_authenticated} == 1 and $this->{protocol} == 1;
# if authentication went wrong on the server side, but client thought it was ok
$buf = $inbuf unless $buf;
substr($buf,0,0) = $partial;
my @buf1 = split (/\015?\012/,$buf,-1);
$partial = pop @buf1;
push(@{$this->{__linequeue}}, map { "$_\n" } @buf1);
} else {
$this->{_connected} = 0;
$this->{_connection}->close();
lib/Arc/Connection.pm view on Meta::CPAN
}
sub clean
{
my $this = shift;
delete $this->{__sasl};
$this->{__linequeue} = [];
$this->{__partial} = "";
$this->{_authenticated} = 0;
$this->{_sasl} = undef;
$this->{_saslmech} = "";
$this->{_cmdparameter} = undef;
$this->{_expectedcmds} = undef;
$this->{_connected} = 0;
$this->{_username} = "anonymous";
$this->{_error} = undef;
# public:
lib/Arc/Connection.pod view on Meta::CPAN
ARC allows non-privileged users to run privileged commands on the server.
The server decides if the user is allowed to run this command through ACL.
This file is a part of the Perl ARCv2 module suite. ARCv2 is a
rewrite of ARC by R.Toebbicke, CERN, Switzerland in Perl.
=head1 ABSTRACT
From ARC by R. Toebbicke, modified by me:
User requests are shipped from a client machine to a server using a
SASL-authenticated socket connection. The purpose is to convey
requests such as privileged commands (e.g. AFS, Crontab) to be executed on the
server under appropriate privileges. Given that all privileges are
confined to the server and the server can be programmed as to filter and
check the command to be executed, the client machine can be less trusted
than the server.
Because ARC-v1-Commands are written in perl anyway, implementing the client/server
in perl makes sense. Platform-independence and "easy-to-read" source code are welcome
too. This package provides two perl command line scripts (arcx, arcxd). They can
be used for working with the ARC server from the command line, resp. to start the
server.
=head1 SYNOPSIS
This module is part of the module suite ARCv2.
This is the connection module from ARCv2. If we would use C++, we would say
this is an abstract class of an ARCv2 Connection. This class provides common
methods to its derived classes. Such as for authentication and basic ARCv2
protocols.
=head1 Class VARIABLES
=head3 PUBLIC MEMBERS
=over 2
=item protocol
lib/Arc/Connection.pod view on Meta::CPAN
=back
=over 2
=back
=head3 PROTECTED MEMBERS
=over 2
=item _authenticated
B<Description>: Are we authenticated
=item _cmdclientsock
B<Description>: IO::Socket for the command connection (encrypted)
B<Default value>: undef
=item _cmdparameter
B<Description>: parameter after the command
lib/Arc/Connection.pod view on Meta::CPAN
B<Example:>
unless (my $err = $arc->IsError()) { .. } else { print STDERR $err; }
=item Log ( $facility, ... (message) ) I<inherited from Arc>
B<Description>: Log function.
Logs messages to 'logdestination' if 'loglevel' is is set appropriatly.
loglevel behaviour has changed in the 1.0 release of ARCv2, the "Arc"-class can export
LOG_AUTH (authentication information), LOG_USER (connection information), LOG_ERR (errors),
LOG_CMD (ARCv2 addition internal command information), LOG_SIDE (verbose client/server-specific
information), LOG_DEBUG (verbose debug information). It possible to combine the
levels with or (resp. +) to allow a message to appear when not all loglevels are
requested by the user.
Commonly used for logging errors from application level.
B<Returns:> always false
lib/Arc/Connection/Client.pm view on Meta::CPAN
@Arc::Connection::Client::ISA = qw(Arc::Connection);
sub members
{
my $this = shift;
return { %{$this->SUPER::members},
logfileprefix => "client",
logdestination => "stderr",
sasl_cb_user => $ENV{'USER'}, # SASL Callback for username (PLAIN and some other mechs only)
sasl_cb_auth => $ENV{'USER'}, # SASL Callback for authname (PLAIN and some other mechs only)
sasl_cb_pass => "", # SASL Callback for password (PLAIN and some other mechs only)
server => undef, # Server to connect to
port => undef, # Port to connect to
sasl_mechanism => undef, # use this mechanism for authentication
server_sasl_mechanisms => [], # filled by the sasl mechanisms
protocol => 1, # Which protocol type the shall use.
};
}
sub _Init
{
my $this = shift;
return 0 unless $this->SUPER::_Init(@_);
lib/Arc/Connection/Client.pm view on Meta::CPAN
}
## initialize the protocol.
## Sends the initial protocol message ARC/2.0
##out> true when succesful, otherwise false
##eg> $this->_InitARC2();
sub _InitARC2
{
my $this = shift;
@{$this->{_expectedcmds}} = qw(ERR AUTH);
$this->{_authenticated} = 0;
return $this->_SendCommand ("ARC/2.".$this->{protocol});
}
## initiate the authentication.
## Tells the server which authtype we want to use.
## Protocol command: AUTHENTICATE [<authtype>]\r\n
##out> true when succesful, otherwise false
##eg> $this->_Authenticate();
sub _Authenticate
{
my $this = shift;
@{$this->{_expectedcmds}} = qw(ERR AUTHTYPE);
return $this->_SendCommand ("AUTHENTICATE",$this->{sasl_mechanism});
}
## initiate the authentication (sasl)
## Creates the sasl object (client_new).
## Client begins always and sends the first SASL challenge
## Protocol command: SASL <base64 encoded SASL output>\r\n
##out> true when succesful, otherwise false
##eg> $this->_StartAuthentication();
sub _StartAuthentication
{
my $this = shift;
$this->_PrepareAuthentication() || return;
$this->{__sasl}->callback(
user => $this->{sasl_cb_user},
auth => $this->{sasl_cb_auth},
pass => $this->{sasl_cb_pass},
);
my $sasl = $this->{_sasl} = $this->{__sasl}->client_new(
$this->{service},
$this->{server},
$this->{_connection}->sockhost.";".$this->{_connection}->sockport,
$this->{_connection}->peerhost.";".$this->{_connection}->peerport,
);
lib/Arc/Connection/Client.pm view on Meta::CPAN
} else {
$str = $sasl->client_step(decode_base64($this->{_cmdparameter}));
}
$str = "" unless defined $str;
if ($sasl->need_step || $sasl->code == 0) {
if ($sasl->code == 0) {
$this->_Sasl($str) if $str ne "";
$this->{_authenticated} = 1;
@{$this->{_expectedcmds}} = qw(ERR);
$this->{sasl_mechanism} = $this->{_saslmech};
$this->Log(LOG_AUTH,"SASL: Negotiation complete. User is authenticated.");
$ret = 1;
} else {
$ret = $this->_Sasl($str);
}
} else {
$this->Quit();
$ret = $this->_SetError("SASL: Negotiation failed. User is not authenticated. SASL error: (",$sasl->code,") ",$sasl->error);
}
return $ret
}
## send an ARCv2 command request
## Protocol command: CMD <cmd> <cmdparameter>\r\n
##in> ... (cmd and parameter)
##out> true when succesful, otherwise false
##eg> $this->_Cmd ("whoami");
sub _Cmd
lib/Arc/Connection/Client.pm view on Meta::CPAN
## This is received when a command is done.
sub _RDONE
{
my $this = shift;
@{$this->{_exceptedcmds}} = qw(ERR CMD);
return 1;
}
## start an ARCv2 session.
## This function which will change the status of the connection into a
## authenticated status. Users have to call this function
## to be able to run ARCv2 commands afterwards.
##out> true if authentication was successful, otherwise false.
##eg> if ($arc->StartSession()) { .. }
sub StartSession
{
my $this = shift;
return $this->_SetError("There is already a command running.") if $this->IsConnected();
return $this->_SetError("Connection to host ",$this->{server},":",$this->{port}," failed") unless $this->_Connect();
$this->_InitARC2();
while (!$this->{_error} && ($this->{_authenticated} == 0) && (my $cmd = $this->_RecvCommand())) {
last unless $this->_ProcessLine($cmd);
}
return !$this->{_error} && $this->{_authenticated};
}
## ends the connection.
## Tells the server that we want to end the conversation. (Userlevel)
## Protocol command: QUIT\r\n
##out> always true
##eg> $arc->Quit();
sub Quit
{
my $this = shift;
lib/Arc/Connection/Client.pm view on Meta::CPAN
}
## start an ARCv2 command
## This function starts the given ARCv2 Command and enables the Command* functions.
##in> ... (command and its parameters)
##out> true if successful, false if not. (IsError is set appropriatly)
##eg> if ($arc->CommandStart()) { ... }
sub CommandStart
{
my $this = shift;
return $this->_SetError("You are not authenticated.") unless $this->{_authenticated};
return $this->_SetError("Already running a command.") if defined $this->{_cmdclientsock};
return unless @_;
return unless $this->_Cmd(@_);
while (!$this->{_error} && (not defined $this->{_cmdclientsock}) && (my $cmd = $this->_RecvCommand()) ) {
$this->_ProcessLine($cmd);
last if $cmd eq "DONE";
}
return 1 if defined $this->{_cmdclientsock};
return;
lib/Arc/Connection/Client.pod view on Meta::CPAN
ARC allows non-privileged users to run privileged commands on the server.
The server decides if the user is allowed to run this command through ACL.
This file is a part of the Perl ARCv2 module suite. ARCv2 is a
rewrite of ARC by R.Toebbicke, CERN, Switzerland in Perl.
=head1 ABSTRACT
From ARC by R. Toebbicke, modified by me:
User requests are shipped from a client machine to a server using a
SASL-authenticated socket connection. The purpose is to convey
requests such as privileged commands (e.g. AFS, Crontab) to be executed on the
server under appropriate privileges. Given that all privileges are
confined to the server and the server can be programmed as to filter and
check the command to be executed, the client machine can be less trusted
than the server.
Because ARC-v1-Commands are written in perl anyway, implementing the client/server
in perl makes sense. Platform-independence and "easy-to-read" source code are welcome
too. This package provides two perl command line scripts (arcx, arcxd). They can
be used for working with the ARC server from the command line, resp. to start the
lib/Arc/Connection/Client.pod view on Meta::CPAN
my $arc = new Arc::Connection::Client(
server => "hyade11",
port => 4242,
timeout => 30,
loglevel=> 7,
logdestination => 'stderr',
service => 'arc',
sasl_mechanism => undef,
sasl_cb_user => \&username,
sasl_cb_auth => \&username,
sasl_cb_pass => \&password,
);
if (my $m = $arc->IsError()) {
die $m;
}
if ($arc->StartSession) {
$arc->CommandStart("test");
$arc->CommandWrite("hallo\n");
lib/Arc/Connection/Client.pod view on Meta::CPAN
B<Description>: Port to connect to
B<Default value>: undef
=item protocol I<reimplemented from Arc::Connection>
B<Description>: Which protocol type the shall use.
B<Default value>: 1
=item sasl_cb_auth
B<Description>: SASL Callback for authname (PLAIN and some other mechs only)
B<Default value>: $ENV{'USER'}
=item sasl_cb_pass
B<Description>: SASL Callback for password (PLAIN and some other mechs only)
B<Default value>: ""
=item sasl_cb_user
B<Description>: SASL Callback for username (PLAIN and some other mechs only)
B<Default value>: $ENV{'USER'}
=item sasl_mechanism
B<Description>: use this mechanism for authentication
B<Default value>: undef
=item server
B<Description>: Server to connect to
B<Default value>: undef
=item server_sasl_mechanisms
lib/Arc/Connection/Client.pod view on Meta::CPAN
=back
=over 2
=back
=head3 PROTECTED MEMBERS
=over 2
=item _authenticated I<inherited from Arc::Connection>
B<Description>: Are we authenticated
=item _cmdclientsock I<inherited from Arc::Connection>
B<Description>: IO::Socket for the command connection (encrypted)
B<Default value>: undef
=item _cmdparameter I<inherited from Arc::Connection>
B<Description>: parameter after the command
lib/Arc/Connection/Client.pod view on Meta::CPAN
B<Example:>
$arc->Quit();
=item StartSession ( )
B<Description>: start an ARCv2 session.
This function which will change the status of the connection into a
authenticated status. Users have to call this function
to be able to run ARCv2 commands afterwards.
B<Returns:> true if authentication was successful, otherwise false.
B<Example:>
if ($arc->StartSession()) { .. }
=back
=over 2
lib/Arc/Connection/Client.pod view on Meta::CPAN
B<Example:>
unless (my $err = $arc->IsError()) { .. } else { print STDERR $err; }
=item Log ( $facility, ... (message) ) I<inherited from Arc>
B<Description>: Log function.
Logs messages to 'logdestination' if 'loglevel' is is set appropriatly.
loglevel behaviour has changed in the 1.0 release of ARCv2, the "Arc"-class can export
LOG_AUTH (authentication information), LOG_USER (connection information), LOG_ERR (errors),
LOG_CMD (ARCv2 addition internal command information), LOG_SIDE (verbose client/server-specific
information), LOG_DEBUG (verbose debug information). It possible to combine the
levels with or (resp. +) to allow a message to appear when not all loglevels are
requested by the user.
Commonly used for logging errors from application level.
B<Returns:> always false
lib/Arc/Connection/Client.pod view on Meta::CPAN
=over 2
=back
=head3 PROTECTED METHODS
=over 2
=item _Authenticate ( )
B<Description>: initiate the authentication.
Tells the server which authtype we want to use.
Protocol command: AUTHENTICATE [<authtype>]\r\n
B<Returns:> true when succesful, otherwise false
B<Example:>
$this->_Authenticate();
lib/Arc/Connection/Client.pod view on Meta::CPAN
=item _RSASL ( )
B<Description>: parses the SASL <base64 encoded SASL string>\r\n, sent by the server.
Sasl response from the server
=item _StartAuthentication ( )
B<Description>: initiate the authentication (sasl)
Creates the sasl object (client_new).
Client begins always and sends the first SASL challenge
Protocol command: SASL <base64 encoded SASL output>\r\n
B<Returns:> true when succesful, otherwise false
B<Example:>
lib/Arc/Connection/Server.pm view on Meta::CPAN
} else {
$str = $sasl->server_step(decode_base64($this->{_cmdparameter}));
}
$str = "" unless defined $str;
if ($sasl->need_step || $sasl->code == 0) {
if ($sasl->code == 0) {
$this->_Sasl($str) if $str ne "";
$this->{_authenticated} = 1;
@{$this->{_expectedcmds}} = qw(QUIT CMD);
$this->{_username} = $sasl->property("user");
$this->{_realm} = $sasl->property("realm");
$this->Log(LOG_AUTH,"SASL: Negotiation complete. User '".$this->{_username}.
"' is authenticated using ".$this->{_saslmech}.". (".$this->{_connection}->peerhost.")");
$ret = 1;
} else {
$ret = $this->_Sasl($str);
}
} else {
$ret = $this->_Error("SASL: Negotiation failed. User is not authenticated. (",$sasl->code,") ",
$sasl->error);
}
return $ret;
}
## parses the AUTHENTICATE[ <SASL mech>]\r\n, sent by the client.
## Checks if the demanded SASL mechanism is allowed and returns the
## selected mechanism.
sub _RAUTHENTICATE
{
my $this = shift;
lib/Arc/Connection/Server.pm view on Meta::CPAN
## Do some cleanup.
##out> always true
##eg> $arc->Quit();
sub Quit
{
my $this = shift;
$this->{_connection}->close if ($this->{_connection});
$this->{_connected} = 0;
delete $this->{_sasl};
$this->{_authenticated} = 0;
1;
}
1;
lib/Arc/Connection/Server.pod view on Meta::CPAN
ARC allows non-privileged users to run privileged commands on the server.
The server decides if the user is allowed to run this command through ACL.
This file is a part of the Perl ARCv2 module suite. ARCv2 is a
rewrite of ARC by R.Toebbicke, CERN, Switzerland in Perl.
=head1 ABSTRACT
From ARC by R. Toebbicke, modified by me:
User requests are shipped from a client machine to a server using a
SASL-authenticated socket connection. The purpose is to convey
requests such as privileged commands (e.g. AFS, Crontab) to be executed on the
server under appropriate privileges. Given that all privileges are
confined to the server and the server can be programmed as to filter and
check the command to be executed, the client machine can be less trusted
than the server.
Because ARC-v1-Commands are written in perl anyway, implementing the client/server
in perl makes sense. Platform-independence and "easy-to-read" source code are welcome
too. This package provides two perl command line scripts (arcx, arcxd). They can
be used for working with the ARC server from the command line, resp. to start the
lib/Arc/Connection/Server.pod view on Meta::CPAN
=item _realm
B<Description>: Name of the SASL realm, if the user is from the default realm, this is empty
B<Default value>: ""
=back
=over 2
=item _authenticated I<inherited from Arc::Connection>
B<Description>: Are we authenticated
=item _cmdclientsock I<inherited from Arc::Connection>
B<Description>: IO::Socket for the command connection (encrypted)
B<Default value>: undef
=item _cmdparameter I<inherited from Arc::Connection>
B<Description>: parameter after the command
lib/Arc/Connection/Server.pod view on Meta::CPAN
B<Example:>
unless (my $err = $arc->IsError()) { .. } else { print STDERR $err; }
=item Log ( $facility, ... (message) ) I<inherited from Arc>
B<Description>: Log function.
Logs messages to 'logdestination' if 'loglevel' is is set appropriatly.
loglevel behaviour has changed in the 1.0 release of ARCv2, the "Arc"-class can export
LOG_AUTH (authentication information), LOG_USER (connection information), LOG_ERR (errors),
LOG_CMD (ARCv2 addition internal command information), LOG_SIDE (verbose client/server-specific
information), LOG_DEBUG (verbose debug information). It possible to combine the
levels with or (resp. +) to allow a message to appear when not all loglevels are
requested by the user.
Commonly used for logging errors from application level.
B<Returns:> always false
lib/Arc/Server.pod view on Meta::CPAN
ARC allows non-privileged users to run privileged commands on the server.
The server decides if the user is allowed to run this command through ACL.
This file is a part of the Perl ARCv2 module suite. ARCv2 is a
rewrite of ARC by R.Toebbicke, CERN, Switzerland in Perl.
=head1 ABSTRACT
From ARC by R. Toebbicke, modified by me:
User requests are shipped from a client machine to a server using a
SASL-authenticated socket connection. The purpose is to convey
requests such as privileged commands (e.g. AFS, Crontab) to be executed on the
server under appropriate privileges. Given that all privileges are
confined to the server and the server can be programmed as to filter and
check the command to be executed, the client machine can be less trusted
than the server.
Because ARC-v1-Commands are written in perl anyway, implementing the client/server
in perl makes sense. Platform-independence and "easy-to-read" source code are welcome
too. This package provides two perl command line scripts (arcx, arcxd). They can
be used for working with the ARC server from the command line, resp. to start the
lib/Arc/Server.pod view on Meta::CPAN
B<Example:>
unless (my $err = $arc->IsError()) { .. } else { print STDERR $err; }
=item Log ( $facility, ... (message) ) I<inherited from Arc>
B<Description>: Log function.
Logs messages to 'logdestination' if 'loglevel' is is set appropriatly.
loglevel behaviour has changed in the 1.0 release of ARCv2, the "Arc"-class can export
LOG_AUTH (authentication information), LOG_USER (connection information), LOG_ERR (errors),
LOG_CMD (ARCv2 addition internal command information), LOG_SIDE (verbose client/server-specific
information), LOG_DEBUG (verbose debug information). It possible to combine the
levels with or (resp. +) to allow a message to appear when not all loglevels are
requested by the user.
Commonly used for logging errors from application level.
B<Returns:> always false
lib/arcx.pod view on Meta::CPAN
to /etc/passwd.
=back
=head1 USAGE
As usual a command line interface has some parameters to influence the behaviour.
The scheme looks like this:
arcx [-h <hostname>] [-p <port>] [-l <loglevel] [-L <logdestination] [-n] [-v] [-S <service>] [-F -f <history>] [-u|-U <username>] [-a|-A <authname>] [-w|-W <password>] [-s <mech>] [-t <timeout in sec>] [-r <string>] [command [command-arguments]]
=head2 Parameter
=over 4
=item -h <hostname>
The hostname, where the ARCv2 server is running. If no -h option is given, arcx will use the one chosen at compile time ($Arc::DefaultHost).
=item -p <port>
lib/arcx.pod view on Meta::CPAN
=item -l <loglevel>
This option specifies the logging level of ARCv2. Default is 5, whereas 7 is the highest (DEBUG) and 1 is the lowest.
=item -v
The verbose option. If this option is set, arcx is verbose in its context. This option does not influence the ARCv2 object. Use -l and -L for it.
=item -n
Do nothing, only try to authenticate.
=item -F
Do not save the commands typed in the interactive mode in the history file.
=item -f <history>
Use the specified file to save command history.
=item -S <service>
This option sets the service name for SASL authentication. Default is "arc". This option has to be change on the server as well.
=item -u
Ask for username and use it for authentication.
=item -U <username>
Use the <username> for authentication.
=item -a
Ask for a authorization name.
=item -A <authname>
Use the <authname> for authorisation.
=item -w
Ask for a password (Only if SASL needs one).
=item -W <password>
Use the <password> for authentication. (Only if an appropriate mechanism is used. (eg. PLAIN)).
=item -s <mechanism>
For authentication use the given <mechanism>. (Default: let the server decide.)
=item -t <timeout>
Timeout in seconds to wait for data in control and command connection.
=item -r <string>
<string> is going to be written to the established command connection, when command is used. (Do not wait for user input on STDIN).
eg.: arcx -r "data" test
lib/arcxd.pod view on Meta::CPAN
The configuration file is based on .ini format, known from Windows (sorry).
In perl we can parse it, using Config::IniFiles. The configuration file is divided into
several sections. Each section can have a several number of key/value pairs.
=head2 main
=over 4
=item service
The name of the service the SASL authentication mechanism shall use.
=item timeout
Timeout in seconds to wait for data in control and command connection.
=back
=head2 arcd
=over 4
scripts/arcx view on Meta::CPAN
($args{h},$args{p}) = split(/:/,$_);
verbout("connecting to '$args{h}:$args{p}'");
verbout("timeout is set to '$args{t}'");
verbout("loglevel is set to '$args{l}'");
verbout("log output will go to '$args{L}'");
verbout("using service name '$args{S}'");
if (defined $args{s}) {
verbout("authentication mechanism forced by client: '$args{s}'");
} else {
verbout("we let the server choose the authentication mechanism.");
}
my $arc = new Arc::Connection::Client(
server => $args{h},
port => $args{p},
timeout => $args{t},
loglevel=> $args{l},
logdestination => $args{L},
service => $args{S},
sasl_mechanism => $args{s},
sasl_cb_user => \&username,
sasl_cb_auth => \&authname,
sasl_cb_pass => \&password,
protocol => $args{0} ? 0 : 1,
);
if (my $msg = $arc->IsError()) {
err($msg);
$retval = 1;
next;
}
if ($arc->StartSession) {
err("You are authenticated to $arc->{server}:$arc->{port} using $arc->{sasl_mechanism}.") if $args{n} || $intact || $args{v};
if ($intact) {
my $term = new Term::ReadLine 'ARCv2 Terminal';
# Read from history
unless ($args{F}) {
unless (open(FH,"<$args{f}")) {
err("Cannot read from history file: $args{f}. (",$!,")");
} else {
while (<FH>) {
scripts/arcx view on Meta::CPAN
EOT
}
sub usage
{
my $msg = shift;
print STDERR <<EOT;
$msg
$0 [-h <hostname>] [-p <port>] [-l <loglevel]
[-L <logdestination] [-n] [-v] [-S <service>]
[-F -f <history>] [-u|-U <username>] [-a|-A <authname>]
[-w|-W <password>] [-s <mech>] [-t <timeout in sec>]
[-r <string>] [-V] [-C <conffile>] [command [command-arguments]]
(Remark: Some parameters behave different in comparison to the old arc)
-h <hostname> specify the ARCv2 server
-p <port> port to connect (default: $Arc::DefaultPort)
-t <timeout> specify the timeout in seconds (default: 30 secs)
-0 use old protocol type (unencrypted protocol conn.)
-C <conffile> use <conffile> as source for server-command-mapping.
(default: $Arc::ConfigPath/arcx.conf)
-r <string> use this string as stdin value for the command
-S <service> name of the service used for arc auth (default: arc)
-s <mech> use <mech> as authentication mechanism for SASL
-n do nothing, just try to authenticate
-v be verbose
-U <username> username for authentication (dep. on SASL mechanism)
-u ask for username
-A <authz name> username for authorization (dep. SASL mechanism)
-a ask for authname
-W <password> password (dep. on SASL mechanism)
-w ask for password
-f <history> filename for command history (def: $ENV{HOME}/.archistory)
-F don't add commands to the history file
-l <loglevel> loglevel (see man Arc) (default: 0, error msgs will be on stderr)
-L <logdest> log destination (possible values: 'syslog' (def) or 'stderr')
-V display version information
scripts/arcx view on Meta::CPAN
{
if (defined $args{U} && $args{U} ne "") {
return $args{U};
} elsif (defined $args{u}) {
print STDERR "Enter your username: "; return <STDIN>;
} else {
return $ENV{'USER'};
}
}
sub authname
{
if (defined $args{A} && $args{A} ne "") {
return $args{A};
} elsif (defined $args{a}) {
print STDERR "Enter your name for authorization: "; return <STDIN>;
} else {
return $ENV{'USER'};
}
}
sub password
{
if (defined $args{P} && $args{P} ne "") {
return $args{P};
} elsif (defined $args{p}) {
sleep(3); # Wait for the server to get ready
my $client = new Arc::Connection::Client (
server => "localhost",
port => 30001, # Testport
loglevel => 0,
logdestination => 'stderr',
service => 'arc',
sasl_mechanism => "PLAIN",
sasl_cb_user => $user,
sasl_cb_auth => $user,
sasl_cb_pass => $pass,
) or ok(0);
ok(1); #2
my $s;
if ($client->StartSession()) { ok(1); } else { ok(0); } #3
if ($client->CommandStart("test")) { ok(1); } else { ok(0); } #4
if ($client->CommandWrite("hallo\n")) { ok(1); } else { ok(0); } #5
if ($s = $client->CommandRead()) { ok(1); } else { ok(0); } #5
( run in 1.640 second using v1.01-cache-2.11-cpan-5c0b1e786e0 )