Browse Source
Add SFTP Server Support (#6753)
Add SFTP Server Support (#6753)
* Add SFTP Server Support Signed-off-by: Mohamed Sekour <mohamed.sekour@exfo.com> * fix s3 tests and helm lint Signed-off-by: Mohamed Sekour <mohamed.sekour@exfo.com> * increase helm chart version * adjust version --------- Signed-off-by: Mohamed Sekour <mohamed.sekour@exfo.com> Co-authored-by: chrislu <chris.lu@gmail.com>pull/6720/head
Mohamed Sekour
1 week ago
committed by
GitHub
GitHub
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
28 changed files with 2997 additions and 103 deletions
-
37docker/compose/userstore.json
-
6go.mod
-
10go.sum
-
2k8s/charts/seaweedfs/Chart.yaml
-
32k8s/charts/seaweedfs/templates/_helpers.tpl
-
12k8s/charts/seaweedfs/templates/s3-secret.yaml
-
292k8s/charts/seaweedfs/templates/sftp-deployment.yaml
-
33k8s/charts/seaweedfs/templates/sftp-secret.yaml
-
39k8s/charts/seaweedfs/templates/sftp-service.yaml
-
33k8s/charts/seaweedfs/templates/sftp-servicemonitor.yaml
-
76k8s/charts/seaweedfs/values.yaml
-
1weed/command/command.go
-
27weed/command/filer.go
-
29weed/command/server.go
-
193weed/command/sftp.go
-
81weed/ftpd/ftp_server.go
-
76weed/sftpd/auth/auth.go
-
64weed/sftpd/auth/password.go
-
267weed/sftpd/auth/permissions.go
-
68weed/sftpd/auth/publickey.go
-
457weed/sftpd/sftp_filer.go
-
126weed/sftpd/sftp_helpers.go
-
59weed/sftpd/sftp_server.go
-
394weed/sftpd/sftp_service.go
-
143weed/sftpd/sftp_userstore.go
-
228weed/sftpd/user/filestore.go
-
204weed/sftpd/user/homemanager.go
-
111weed/sftpd/user/user.go
@ -0,0 +1,37 @@ |
|||
[ |
|||
{ |
|||
"Username": "admin", |
|||
"Password": "myadminpassword", |
|||
"PublicKeys": [ |
|||
], |
|||
"HomeDir": "/", |
|||
"Permissions": { |
|||
"/": ["*"] |
|||
}, |
|||
"Uid": 0, |
|||
"Gid": 0 |
|||
}, |
|||
{ |
|||
"Username": "user1", |
|||
"Password": "myuser1password", |
|||
"PublicKeys": [""], |
|||
"HomeDir": "/user1", |
|||
"Permissions": { |
|||
"/user1": ["*"], |
|||
"/public": ["read", "list","write"] |
|||
}, |
|||
"Uid": 1111, |
|||
"Gid": 1111 |
|||
}, |
|||
{ |
|||
"Username": "readonly", |
|||
"Password": "myreadonlypassword", |
|||
"PublicKeys": [], |
|||
"HomeDir": "/public", |
|||
"Permissions": { |
|||
"/public": ["read", "list"] |
|||
}, |
|||
"Uid": 1112, |
|||
"Gid": 1112 |
|||
} |
|||
] |
|||
@ -0,0 +1,292 @@ |
|||
{{- if .Values.sftp.enabled }} |
|||
apiVersion: apps/v1 |
|||
kind: Deployment |
|||
metadata: |
|||
name: {{ template "seaweedfs.name" . }}-sftp |
|||
namespace: {{ .Release.Namespace }} |
|||
labels: |
|||
app.kubernetes.io/name: {{ template "seaweedfs.name" . }} |
|||
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} |
|||
app.kubernetes.io/managed-by: {{ .Release.Service }} |
|||
app.kubernetes.io/instance: {{ .Release.Name }} |
|||
{{- if .Values.sftp.annotations }} |
|||
annotations: |
|||
{{- toYaml .Values.sftp.annotations | nindent 4 }} |
|||
{{- end }} |
|||
spec: |
|||
replicas: {{ .Values.sftp.replicas }} |
|||
selector: |
|||
matchLabels: |
|||
app.kubernetes.io/name: {{ template "seaweedfs.name" . }} |
|||
app.kubernetes.io/instance: {{ .Release.Name }} |
|||
app.kubernetes.io/component: sftp |
|||
template: |
|||
metadata: |
|||
labels: |
|||
app.kubernetes.io/name: {{ template "seaweedfs.name" . }} |
|||
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} |
|||
app.kubernetes.io/instance: {{ .Release.Name }} |
|||
app.kubernetes.io/component: sftp |
|||
{{ with .Values.podLabels }} |
|||
{{- toYaml . | nindent 8 }} |
|||
{{- end }} |
|||
{{- with .Values.sftp.podLabels }} |
|||
{{- toYaml . | nindent 8 }} |
|||
{{- end }} |
|||
annotations: |
|||
{{ with .Values.podAnnotations }} |
|||
{{- toYaml . | nindent 8 }} |
|||
{{- end }} |
|||
{{- with .Values.sftp.podAnnotations }} |
|||
{{- toYaml . | nindent 8 }} |
|||
{{- end }} |
|||
spec: |
|||
restartPolicy: {{ default .Values.global.restartPolicy .Values.sftp.restartPolicy }} |
|||
{{- if .Values.sftp.tolerations }} |
|||
tolerations: |
|||
{{ tpl .Values.sftp.tolerations . | nindent 8 | trim }} |
|||
{{- end }} |
|||
{{- include "seaweedfs.imagePullSecrets" . | nindent 6 }} |
|||
terminationGracePeriodSeconds: 10 |
|||
{{- if .Values.sftp.priorityClassName }} |
|||
priorityClassName: {{ .Values.sftp.priorityClassName | quote }} |
|||
{{- end }} |
|||
enableServiceLinks: false |
|||
{{- if .Values.sftp.serviceAccountName }} |
|||
serviceAccountName: {{ .Values.sftp.serviceAccountName | quote }} |
|||
{{- end }} |
|||
{{- if .Values.sftp.initContainers }} |
|||
initContainers: |
|||
{{ tpl .Values.sftp.initContainers . | nindent 8 | trim }} |
|||
{{- end }} |
|||
{{- if .Values.sftp.podSecurityContext.enabled }} |
|||
securityContext: {{- omit .Values.sftp.podSecurityContext "enabled" | toYaml | nindent 8 }} |
|||
{{- end }} |
|||
containers: |
|||
- name: seaweedfs |
|||
image: {{ template "sftp.image" . }} |
|||
imagePullPolicy: {{ default "IfNotPresent" .Values.global.imagePullPolicy }} |
|||
env: |
|||
- name: POD_IP |
|||
valueFrom: |
|||
fieldRef: |
|||
fieldPath: status.podIP |
|||
- name: POD_NAME |
|||
valueFrom: |
|||
fieldRef: |
|||
fieldPath: metadata.name |
|||
- name: NAMESPACE |
|||
valueFrom: |
|||
fieldRef: |
|||
fieldPath: metadata.namespace |
|||
- name: SEAWEEDFS_FULLNAME |
|||
value: "{{ template "seaweedfs.name" . }}" |
|||
{{- if .Values.sftp.extraEnvironmentVars }} |
|||
{{- range $key, $value := .Values.sftp.extraEnvironmentVars }} |
|||
- name: {{ $key }} |
|||
{{- if kindIs "string" $value }} |
|||
value: {{ $value | quote }} |
|||
{{- else }} |
|||
valueFrom: |
|||
{{ toYaml $value | nindent 16 | trim }} |
|||
{{- end -}} |
|||
{{- end }} |
|||
{{- end }} |
|||
{{- if .Values.global.extraEnvironmentVars }} |
|||
{{- range $key, $value := .Values.global.extraEnvironmentVars }} |
|||
- name: {{ $key }} |
|||
{{- if kindIs "string" $value }} |
|||
value: {{ $value | quote }} |
|||
{{- else }} |
|||
valueFrom: |
|||
{{ toYaml $value | nindent 16 | trim }} |
|||
{{- end -}} |
|||
{{- end }} |
|||
{{- end }} |
|||
command: |
|||
- "/bin/sh" |
|||
- "-ec" |
|||
- | |
|||
exec /usr/bin/weed \ |
|||
{{- if or (eq .Values.sftp.logs.type "hostPath") (eq .Values.sftp.logs.type "emptyDir") }} |
|||
-logdir=/logs \ |
|||
{{- else }} |
|||
-logtostderr=true \ |
|||
{{- end }} |
|||
{{- if .Values.sftp.loggingOverrideLevel }} |
|||
-v={{ .Values.sftp.loggingOverrideLevel }} \ |
|||
{{- else }} |
|||
-v={{ .Values.global.loggingLevel }} \ |
|||
{{- end }} |
|||
sftp \ |
|||
-ip.bind={{ .Values.sftp.bindAddress }} \ |
|||
-port={{ .Values.sftp.port }} \ |
|||
{{- if .Values.sftp.metricsPort }} |
|||
-metricsPort={{ .Values.sftp.metricsPort }} \ |
|||
{{- end }} |
|||
{{- if .Values.sftp.metricsIp }} |
|||
-metricsIp={{ .Values.sftp.metricsIp }} \ |
|||
{{- end }} |
|||
{{- if .Values.sftp.sshPrivateKey }} |
|||
-sshPrivateKey={{ .Values.sftp.sshPrivateKey }} \ |
|||
{{- end }} |
|||
{{- if .Values.sftp.hostKeysFolder }} |
|||
-hostKeysFolder={{ .Values.sftp.hostKeysFolder }} \ |
|||
{{- end }} |
|||
{{- if .Values.sftp.authMethods }} |
|||
-authMethods={{ .Values.sftp.authMethods }} \ |
|||
{{- end }} |
|||
{{- if .Values.sftp.maxAuthTries }} |
|||
-maxAuthTries={{ .Values.sftp.maxAuthTries }} \ |
|||
{{- end }} |
|||
{{- if .Values.sftp.bannerMessage }} |
|||
-bannerMessage="{{ .Values.sftp.bannerMessage }}" \ |
|||
{{- end }} |
|||
{{- if .Values.sftp.loginGraceTime }} |
|||
-loginGraceTime={{ .Values.sftp.loginGraceTime }} \ |
|||
{{- end }} |
|||
{{- if .Values.sftp.clientAliveInterval }} |
|||
-clientAliveInterval={{ .Values.sftp.clientAliveInterval }} \ |
|||
{{- end }} |
|||
{{- if .Values.sftp.clientAliveCountMax }} |
|||
-clientAliveCountMax={{ .Values.sftp.clientAliveCountMax }} \ |
|||
{{- end }} |
|||
{{- if .Values.sftp.dataCenter }} |
|||
-dataCenter={{ .Values.sftp.dataCenter }} \ |
|||
{{- end }} |
|||
{{- if .Values.sftp.localSocket }} |
|||
-localSocket={{ .Values.sftp.localSocket }} \ |
|||
{{- end }} |
|||
{{- if .Values.global.enableSecurity }} |
|||
-cert.file=/usr/local/share/ca-certificates/client/tls.crt \ |
|||
-key.file=/usr/local/share/ca-certificates/client/tls.key \ |
|||
{{- end }} |
|||
-userStoreFile=/etc/sw/seaweedfs_sftp_config \ |
|||
-filer={{ template "seaweedfs.name" . }}-filer-client.{{ .Release.Namespace }}:{{ .Values.filer.port }} |
|||
volumeMounts: |
|||
{{- if or (eq .Values.sftp.logs.type "hostPath") (eq .Values.sftp.logs.type "emptyDir") }} |
|||
- name: logs |
|||
mountPath: "/logs/" |
|||
{{- end }} |
|||
{{- if .Values.sftp.enableAuth }} |
|||
- mountPath: /etc/sw |
|||
name: config-users |
|||
readOnly: true |
|||
{{- end }} |
|||
- mountPath: /etc/sw/ssh |
|||
name: config-ssh |
|||
readOnly: true |
|||
{{- if .Values.global.enableSecurity }} |
|||
- name: security-config |
|||
readOnly: true |
|||
mountPath: /etc/seaweedfs/security.toml |
|||
subPath: security.toml |
|||
- name: ca-cert |
|||
readOnly: true |
|||
mountPath: /usr/local/share/ca-certificates/ca/ |
|||
- name: master-cert |
|||
readOnly: true |
|||
mountPath: /usr/local/share/ca-certificates/master/ |
|||
- name: volume-cert |
|||
readOnly: true |
|||
mountPath: /usr/local/share/ca-certificates/volume/ |
|||
- name: filer-cert |
|||
readOnly: true |
|||
mountPath: /usr/local/share/ca-certificates/filer/ |
|||
- name: client-cert |
|||
readOnly: true |
|||
mountPath: /usr/local/share/ca-certificates/client/ |
|||
{{- end }} |
|||
{{ tpl .Values.sftp.extraVolumeMounts . | nindent 12 | trim }} |
|||
ports: |
|||
- containerPort: {{ .Values.sftp.port }} |
|||
name: swfs-sftp |
|||
{{- if .Values.sftp.metricsPort }} |
|||
- containerPort: {{ .Values.sftp.metricsPort }} |
|||
name: metrics |
|||
{{- end }} |
|||
{{- if .Values.sftp.readinessProbe.enabled }} |
|||
readinessProbe: |
|||
tcpSocket: |
|||
port: {{ .Values.sftp.port }} |
|||
initialDelaySeconds: {{ .Values.sftp.readinessProbe.initialDelaySeconds }} |
|||
periodSeconds: {{ .Values.sftp.readinessProbe.periodSeconds }} |
|||
successThreshold: {{ .Values.sftp.readinessProbe.successThreshold }} |
|||
failureThreshold: {{ .Values.sftp.readinessProbe.failureThreshold }} |
|||
timeoutSeconds: {{ .Values.sftp.readinessProbe.timeoutSeconds }} |
|||
{{- end }} |
|||
{{- if .Values.sftp.livenessProbe.enabled }} |
|||
livenessProbe: |
|||
tcpSocket: |
|||
port: {{ .Values.sftp.port }} |
|||
initialDelaySeconds: {{ .Values.sftp.livenessProbe.initialDelaySeconds }} |
|||
periodSeconds: {{ .Values.sftp.livenessProbe.periodSeconds }} |
|||
successThreshold: {{ .Values.sftp.livenessProbe.successThreshold }} |
|||
failureThreshold: {{ .Values.sftp.livenessProbe.failureThreshold }} |
|||
timeoutSeconds: {{ .Values.sftp.livenessProbe.timeoutSeconds }} |
|||
{{- end }} |
|||
{{- with .Values.sftp.resources }} |
|||
resources: |
|||
{{- toYaml . | nindent 12 }} |
|||
{{- end }} |
|||
{{- if .Values.sftp.containerSecurityContext.enabled }} |
|||
securityContext: {{- omit .Values.sftp.containerSecurityContext "enabled" | toYaml | nindent 12 }} |
|||
{{- end }} |
|||
{{- if .Values.sftp.sidecars }} |
|||
{{- include "common.tplvalues.render" (dict "value" .Values.sftp.sidecars "context" $) | nindent 8 }} |
|||
{{- end }} |
|||
volumes: |
|||
{{- if .Values.sftp.enableAuth }} |
|||
- name: config-users |
|||
secret: |
|||
defaultMode: 420 |
|||
{{- if .Values.sftp.existingConfigSecret }} |
|||
secretName: {{ .Values.sftp.existingConfigSecret }} |
|||
{{- else }} |
|||
secretName: seaweedfs-sftp-secret |
|||
{{- end }} |
|||
{{- end }} |
|||
- name: config-ssh |
|||
secret: |
|||
defaultMode: 420 |
|||
{{- if .Values.sftp.existingSshConfigSecret }} |
|||
secretName: {{ .Values.sftp.existingSshConfigSecret }} |
|||
{{- else }} |
|||
secretName: seaweedfs-sftp-ssh-secret |
|||
{{- end }} |
|||
{{- if eq .Values.sftp.logs.type "hostPath" }} |
|||
- name: logs |
|||
hostPath: |
|||
path: {{ .Values.sftp.logs.hostPathPrefix }}/logs/seaweedfs/sftp |
|||
type: DirectoryOrCreate |
|||
{{- end }} |
|||
{{- if eq .Values.sftp.logs.type "emptyDir" }} |
|||
- name: logs |
|||
emptyDir: {} |
|||
{{- end }} |
|||
{{- if .Values.global.enableSecurity }} |
|||
- name: security-config |
|||
configMap: |
|||
name: {{ template "seaweedfs.name" . }}-security-config |
|||
- name: ca-cert |
|||
secret: |
|||
secretName: {{ template "seaweedfs.name" . }}-ca-cert |
|||
- name: master-cert |
|||
secret: |
|||
secretName: {{ template "seaweedfs.name" . }}-master-cert |
|||
- name: volume-cert |
|||
secret: |
|||
secretName: {{ template "seaweedfs.name" . }}-volume-cert |
|||
- name: filer-cert |
|||
secret: |
|||
secretName: {{ template "seaweedfs.name" . }}-filer-cert |
|||
- name: client-cert |
|||
secret: |
|||
secretName: {{ template "seaweedfs.name" . }}-client-cert |
|||
{{- end }} |
|||
{{ tpl .Values.sftp.extraVolumes . | indent 8 | trim }} |
|||
{{- if .Values.sftp.nodeSelector }} |
|||
nodeSelector: |
|||
{{ tpl .Values.sftp.nodeSelector . | indent 8 | trim }} |
|||
{{- end }} |
|||
{{- end }} |
|||
@ -0,0 +1,33 @@ |
|||
{{- if .Values.sftp.enabled }} |
|||
{{- $admin_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-sftp-secret" "key" "admin_password" 20) -}} |
|||
{{- $read_user_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-sftp-secret" "key" "readonly_password" 20) -}} |
|||
{{- $public_user_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-sftp-secret" "key" "public_user_password" 20) -}} |
|||
apiVersion: v1 |
|||
kind: Secret |
|||
type: Opaque |
|||
metadata: |
|||
name: seaweedfs-sftp-secret |
|||
namespace: {{ .Release.Namespace }} |
|||
annotations: |
|||
"helm.sh/resource-policy": keep |
|||
"helm.sh/hook": "pre-install,pre-upgrade" |
|||
labels: |
|||
app.kubernetes.io/name: {{ template "seaweedfs.name" . }} |
|||
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} |
|||
app.kubernetes.io/managed-by: {{ .Release.Service }} |
|||
app.kubernetes.io/instance: {{ .Release.Name }} |
|||
app.kubernetes.io/component: sftp |
|||
stringData: |
|||
admin_password: {{ $admin_pwd }} |
|||
readonly_password: {{ $read_user_pwd }} |
|||
public_user_password: {{ $public_user_pwd }} |
|||
seaweedfs_sftp_config: '[{"Username":"admin","Password":"{{ $admin_pwd }}","PublicKeys":[],"HomeDir":"/","Permissions":{"/":["read","write","list"]},"Uid":0,"Gid":0},{"Username":"readonly_user","Password":"{{ $read_user_pwd }}","PublicKeys":[],"HomeDir":"/","Permissions":{"/":["read","list"]},"Uid":1112,"Gid":1112},{"Username":"public_user","Password":"{{ $public_user_pwd }}","PublicKeys":[],"HomeDir":"/public","Permissions":{"/public":["write","read","list"]},"Uid":1113,"Gid":1113}]' |
|||
seaweedfs_sftp_ssh_private_key: | |
|||
-----BEGIN OPENSSH PRIVATE KEY----- |
|||
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW |
|||
QyNTUxOQAAACDH4McwcDphteXVullu6q7ephEN1N60z+w0qZw0UVW8OwAAAJDjxkmk48ZJ |
|||
pAAAAAtzc2gtZWQyNTUxOQAAACDH4McwcDphteXVullu6q7ephEN1N60z+w0qZw0UVW8Ow |
|||
AAAEAeVy/4+gf6rjj2jla/AHqJpC1LcS5hn04IUs4q+iVq/MfgxzBwOmG15dW6WW7qrt6m |
|||
EQ3U3rTP7DSpnDRRVbw7AAAADHNla291ckAwMDY2NwE= |
|||
-----END OPENSSH PRIVATE KEY----- |
|||
{{- end }} |
|||
@ -0,0 +1,39 @@ |
|||
{{- if .Values.sftp.enabled }} |
|||
apiVersion: v1 |
|||
kind: Service |
|||
metadata: |
|||
name: {{ template "seaweedfs.name" . }}-sftp |
|||
namespace: {{ .Release.Namespace }} |
|||
labels: |
|||
app.kubernetes.io/name: {{ template "seaweedfs.name" . }} |
|||
app.kubernetes.io/component: sftp |
|||
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} |
|||
app.kubernetes.io/managed-by: {{ .Release.Service }} |
|||
{{- if .Values.sftp.annotations }} |
|||
annotations: |
|||
{{- toYaml .Values.sftp.annotations | nindent 4 }} |
|||
{{- end }} |
|||
spec: |
|||
type: {{ .Values.sftp.service.type | default "ClusterIP" }} |
|||
internalTrafficPolicy: {{ .Values.sftp.internalTrafficPolicy | default "Cluster" }} |
|||
ports: |
|||
- name: "swfs-sftp" |
|||
port: {{ .Values.sftp.port }} |
|||
targetPort: {{ .Values.sftp.port }} |
|||
protocol: TCP |
|||
{{- if and (eq (.Values.sftp.service.type | default "ClusterIP") "NodePort") .Values.sftp.service.nodePort }} |
|||
nodePort: {{ .Values.sftp.service.nodePort }} |
|||
{{- end }} |
|||
{{- if .Values.sftp.metricsPort }} |
|||
- name: "metrics" |
|||
port: {{ .Values.sftp.metricsPort }} |
|||
targetPort: {{ .Values.sftp.metricsPort }} |
|||
protocol: TCP |
|||
{{- if and (eq (.Values.sftp.service.type | default "ClusterIP") "NodePort") .Values.sftp.service.metricsNodePort }} |
|||
nodePort: {{ .Values.sftp.service.metricsNodePort }} |
|||
{{- end }} |
|||
{{- end }} |
|||
selector: |
|||
app.kubernetes.io/name: {{ template "seaweedfs.name" . }} |
|||
app.kubernetes.io/component: sftp |
|||
{{- end }} |
|||
@ -0,0 +1,33 @@ |
|||
{{- if .Values.sftp.enabled }} |
|||
{{- if .Values.sftp.metricsPort }} |
|||
{{- if .Values.global.monitoring.enabled }} |
|||
apiVersion: monitoring.coreos.com/v1 |
|||
kind: ServiceMonitor |
|||
metadata: |
|||
name: {{ template "seaweedfs.name" . }}-sftp |
|||
namespace: {{ .Release.Namespace }} |
|||
labels: |
|||
app.kubernetes.io/name: {{ template "seaweedfs.name" . }} |
|||
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} |
|||
app.kubernetes.io/managed-by: {{ .Release.Service }} |
|||
app.kubernetes.io/instance: {{ .Release.Name }} |
|||
app.kubernetes.io/component: sftp |
|||
{{- with .Values.global.monitoring.additionalLabels }} |
|||
{{- toYaml . | nindent 4 }} |
|||
{{- end }} |
|||
{{- if .Values.sftp.annotations }} |
|||
annotations: |
|||
{{- toYaml .Values.sftp.annotations | nindent 4 }} |
|||
{{- end }} |
|||
spec: |
|||
endpoints: |
|||
- interval: 30s |
|||
port: metrics |
|||
scrapeTimeout: 5s |
|||
selector: |
|||
matchLabels: |
|||
app.kubernetes.io/name: {{ template "seaweedfs.name" . }} |
|||
app.kubernetes.io/component: sftp |
|||
{{- end }} |
|||
{{- end }} |
|||
{{- end }} |
|||
@ -0,0 +1,193 @@ |
|||
package command |
|||
|
|||
import ( |
|||
"context" |
|||
"fmt" |
|||
"net" |
|||
"os" |
|||
"runtime" |
|||
"time" |
|||
|
|||
"github.com/seaweedfs/seaweedfs/weed/glog" |
|||
"github.com/seaweedfs/seaweedfs/weed/pb" |
|||
filer_pb "github.com/seaweedfs/seaweedfs/weed/pb/filer_pb" |
|||
"github.com/seaweedfs/seaweedfs/weed/security" |
|||
"github.com/seaweedfs/seaweedfs/weed/sftpd" |
|||
stats_collect "github.com/seaweedfs/seaweedfs/weed/stats" |
|||
"github.com/seaweedfs/seaweedfs/weed/util" |
|||
) |
|||
|
|||
var ( |
|||
sftpOptionsStandalone SftpOptions |
|||
) |
|||
|
|||
// SftpOptions holds configuration options for the SFTP server.
|
|||
type SftpOptions struct { |
|||
filer *string |
|||
bindIp *string |
|||
port *int |
|||
sshPrivateKey *string |
|||
hostKeysFolder *string |
|||
authMethods *string |
|||
maxAuthTries *int |
|||
bannerMessage *string |
|||
loginGraceTime *time.Duration |
|||
clientAliveInterval *time.Duration |
|||
clientAliveCountMax *int |
|||
userStoreFile *string |
|||
dataCenter *string |
|||
metricsHttpPort *int |
|||
metricsHttpIp *string |
|||
localSocket *string |
|||
} |
|||
|
|||
// cmdSftp defines the SFTP command similar to the S3 command.
|
|||
var cmdSftp = &Command{ |
|||
UsageLine: "sftp [-port=2022] [-filer=<ip:port>] [-sshPrivateKey=</path/to/private_key>]", |
|||
Short: "start an SFTP server that is backed by a SeaweedFS filer", |
|||
Long: `Start an SFTP server that leverages the SeaweedFS filer service to handle file operations. |
|||
|
|||
Instead of reading from or writing to a local filesystem, all file operations |
|||
are routed through the filer (filer_pb) gRPC API. This allows you to centralize |
|||
your file management in SeaweedFS. |
|||
`, |
|||
} |
|||
|
|||
func init() { |
|||
// Register the command to avoid cyclic dependencies.
|
|||
cmdSftp.Run = runSftp |
|||
|
|||
sftpOptionsStandalone.filer = cmdSftp.Flag.String("filer", "localhost:8888", "filer server address (ip:port)") |
|||
sftpOptionsStandalone.bindIp = cmdSftp.Flag.String("ip.bind", "0.0.0.0", "ip address to bind SFTP server") |
|||
sftpOptionsStandalone.port = cmdSftp.Flag.Int("port", 2022, "SFTP server listen port") |
|||
sftpOptionsStandalone.sshPrivateKey = cmdSftp.Flag.String("sshPrivateKey", "", "path to the SSH private key file for host authentication") |
|||
sftpOptionsStandalone.hostKeysFolder = cmdSftp.Flag.String("hostKeysFolder", "", "path to folder containing SSH private key files for host authentication") |
|||
sftpOptionsStandalone.authMethods = cmdSftp.Flag.String("authMethods", "password,publickey", "comma-separated list of allowed auth methods: password, publickey, keyboard-interactive") |
|||
sftpOptionsStandalone.maxAuthTries = cmdSftp.Flag.Int("maxAuthTries", 6, "maximum number of authentication attempts per connection") |
|||
sftpOptionsStandalone.bannerMessage = cmdSftp.Flag.String("bannerMessage", "SeaweedFS SFTP Server - Unauthorized access is prohibited", "message displayed before authentication") |
|||
sftpOptionsStandalone.loginGraceTime = cmdSftp.Flag.Duration("loginGraceTime", 2*time.Minute, "timeout for authentication") |
|||
sftpOptionsStandalone.clientAliveInterval = cmdSftp.Flag.Duration("clientAliveInterval", 5*time.Second, "interval for sending keep-alive messages") |
|||
sftpOptionsStandalone.clientAliveCountMax = cmdSftp.Flag.Int("clientAliveCountMax", 3, "maximum number of missed keep-alive messages before disconnecting") |
|||
sftpOptionsStandalone.userStoreFile = cmdSftp.Flag.String("userStoreFile", "", "path to JSON file containing user credentials and permissions") |
|||
sftpOptionsStandalone.dataCenter = cmdSftp.Flag.String("dataCenter", "", "prefer to read and write to volumes in this data center") |
|||
sftpOptionsStandalone.metricsHttpPort = cmdSftp.Flag.Int("metricsPort", 0, "Prometheus metrics listen port") |
|||
sftpOptionsStandalone.metricsHttpIp = cmdSftp.Flag.String("metricsIp", "", "metrics listen ip. If empty, default to same as -ip.bind option.") |
|||
sftpOptionsStandalone.localSocket = cmdSftp.Flag.String("localSocket", "", "default to /tmp/seaweedfs-sftp-<port>.sock") |
|||
} |
|||
|
|||
// runSftp is the command entry point.
|
|||
func runSftp(cmd *Command, args []string) bool { |
|||
// Load security configuration as done in other SeaweedFS services.
|
|||
util.LoadSecurityConfiguration() |
|||
|
|||
// Configure metrics
|
|||
switch { |
|||
case *sftpOptionsStandalone.metricsHttpIp != "": |
|||
// nothing to do, use sftpOptionsStandalone.metricsHttpIp
|
|||
case *sftpOptionsStandalone.bindIp != "": |
|||
*sftpOptionsStandalone.metricsHttpIp = *sftpOptionsStandalone.bindIp |
|||
} |
|||
go stats_collect.StartMetricsServer(*sftpOptionsStandalone.metricsHttpIp, *sftpOptionsStandalone.metricsHttpPort) |
|||
|
|||
return sftpOptionsStandalone.startSftpServer() |
|||
} |
|||
|
|||
func (sftpOpt *SftpOptions) startSftpServer() bool { |
|||
filerAddress := pb.ServerAddress(*sftpOpt.filer) |
|||
grpcDialOption := security.LoadClientTLS(util.GetViper(), "grpc.client") |
|||
|
|||
// metrics read from the filer
|
|||
var metricsAddress string |
|||
var metricsIntervalSec int |
|||
var filerGroup string |
|||
|
|||
// Connect to the filer service and try to retrieve basic configuration.
|
|||
for { |
|||
err := pb.WithGrpcFilerClient(false, 0, filerAddress, grpcDialOption, func(client filer_pb.SeaweedFilerClient) error { |
|||
resp, err := client.GetFilerConfiguration(context.Background(), &filer_pb.GetFilerConfigurationRequest{}) |
|||
if err != nil { |
|||
return fmt.Errorf("get filer %s configuration: %v", filerAddress, err) |
|||
} |
|||
metricsAddress, metricsIntervalSec = resp.MetricsAddress, int(resp.MetricsIntervalSec) |
|||
filerGroup = resp.FilerGroup |
|||
glog.V(0).Infof("SFTP read filer configuration, using filer at: %s", filerAddress) |
|||
return nil |
|||
}) |
|||
if err != nil { |
|||
glog.V(0).Infof("Waiting to connect to filer %s grpc address %s...", *sftpOpt.filer, filerAddress.ToGrpcAddress()) |
|||
time.Sleep(time.Second) |
|||
} else { |
|||
glog.V(0).Infof("Connected to filer %s grpc address %s", *sftpOpt.filer, filerAddress.ToGrpcAddress()) |
|||
break |
|||
} |
|||
} |
|||
|
|||
go stats_collect.LoopPushingMetric("sftp", stats_collect.SourceName(uint32(*sftpOpt.port)), metricsAddress, metricsIntervalSec) |
|||
|
|||
// Parse auth methods
|
|||
var authMethods []string |
|||
if *sftpOpt.authMethods != "" { |
|||
authMethods = util.StringSplit(*sftpOpt.authMethods, ",") |
|||
} |
|||
|
|||
// Create a new SFTP service instance with all options
|
|||
service := sftpd.NewSFTPService(&sftpd.SFTPServiceOptions{ |
|||
GrpcDialOption: grpcDialOption, |
|||
DataCenter: *sftpOpt.dataCenter, |
|||
FilerGroup: filerGroup, |
|||
Filer: filerAddress, |
|||
SshPrivateKey: *sftpOpt.sshPrivateKey, |
|||
HostKeysFolder: *sftpOpt.hostKeysFolder, |
|||
AuthMethods: authMethods, |
|||
MaxAuthTries: *sftpOpt.maxAuthTries, |
|||
BannerMessage: *sftpOpt.bannerMessage, |
|||
LoginGraceTime: *sftpOpt.loginGraceTime, |
|||
ClientAliveInterval: *sftpOpt.clientAliveInterval, |
|||
ClientAliveCountMax: *sftpOpt.clientAliveCountMax, |
|||
UserStoreFile: *sftpOpt.userStoreFile, |
|||
}) |
|||
|
|||
// Set up Unix socket if on non-Windows platforms
|
|||
if runtime.GOOS != "windows" { |
|||
localSocket := *sftpOpt.localSocket |
|||
if localSocket == "" { |
|||
localSocket = fmt.Sprintf("/tmp/seaweedfs-sftp-%d.sock", *sftpOpt.port) |
|||
} |
|||
if err := os.Remove(localSocket); err != nil && !os.IsNotExist(err) { |
|||
glog.Fatalf("Failed to remove %s, error: %s", localSocket, err.Error()) |
|||
} |
|||
go func() { |
|||
// start on local unix socket
|
|||
sftpSocketListener, err := net.Listen("unix", localSocket) |
|||
if err != nil { |
|||
glog.Fatalf("Failed to listen on %s: %v", localSocket, err) |
|||
} |
|||
if err := service.Serve(sftpSocketListener); err != nil { |
|||
glog.Fatalf("Failed to serve SFTP on socket %s: %v", localSocket, err) |
|||
} |
|||
}() |
|||
} |
|||
|
|||
// Start the SFTP service on TCP
|
|||
listenAddress := fmt.Sprintf("%s:%d", *sftpOpt.bindIp, *sftpOpt.port) |
|||
sftpListener, sftpLocalListener, err := util.NewIpAndLocalListeners(*sftpOpt.bindIp, *sftpOpt.port, time.Duration(10)*time.Second) |
|||
if err != nil { |
|||
glog.Fatalf("SFTP server listener on %s error: %v", listenAddress, err) |
|||
} |
|||
|
|||
glog.V(0).Infof("Start Seaweed SFTP Server %s at %s", util.Version(), listenAddress) |
|||
|
|||
if sftpLocalListener != nil { |
|||
go func() { |
|||
if err := service.Serve(sftpLocalListener); err != nil { |
|||
glog.Fatalf("SFTP Server failed to serve on local listener: %v", err) |
|||
} |
|||
}() |
|||
} |
|||
|
|||
if err := service.Serve(sftpListener); err != nil { |
|||
glog.Fatalf("SFTP Server failed to serve: %v", err) |
|||
} |
|||
|
|||
return true |
|||
} |
|||
@ -1,81 +0,0 @@ |
|||
package ftpd |
|||
|
|||
import ( |
|||
"crypto/tls" |
|||
"errors" |
|||
"github.com/seaweedfs/seaweedfs/weed/util" |
|||
"net" |
|||
|
|||
ftpserver "github.com/fclairamb/ftpserverlib" |
|||
"google.golang.org/grpc" |
|||
) |
|||
|
|||
type FtpServerOption struct { |
|||
Filer string |
|||
IP string |
|||
IpBind string |
|||
Port int |
|||
FilerGrpcAddress string |
|||
FtpRoot string |
|||
GrpcDialOption grpc.DialOption |
|||
PassivePortStart int |
|||
PassivePortStop int |
|||
} |
|||
|
|||
type SftpServer struct { |
|||
option *FtpServerOption |
|||
ftpListener net.Listener |
|||
} |
|||
|
|||
var _ = ftpserver.MainDriver(&SftpServer{}) |
|||
|
|||
// NewFtpServer returns a new FTP server driver
|
|||
func NewFtpServer(ftpListener net.Listener, option *FtpServerOption) (*SftpServer, error) { |
|||
var err error |
|||
server := &SftpServer{ |
|||
option: option, |
|||
ftpListener: ftpListener, |
|||
} |
|||
return server, err |
|||
} |
|||
|
|||
// GetSettings returns some general settings around the server setup
|
|||
func (s *SftpServer) GetSettings() (*ftpserver.Settings, error) { |
|||
var portRange *ftpserver.PortRange |
|||
if s.option.PassivePortStart > 0 && s.option.PassivePortStop > s.option.PassivePortStart { |
|||
portRange = &ftpserver.PortRange{ |
|||
Start: s.option.PassivePortStart, |
|||
End: s.option.PassivePortStop, |
|||
} |
|||
} |
|||
|
|||
return &ftpserver.Settings{ |
|||
Listener: s.ftpListener, |
|||
ListenAddr: util.JoinHostPort(s.option.IpBind, s.option.Port), |
|||
PublicHost: s.option.IP, |
|||
PassiveTransferPortRange: portRange, |
|||
ActiveTransferPortNon20: true, |
|||
IdleTimeout: -1, |
|||
ConnectionTimeout: 20, |
|||
}, nil |
|||
} |
|||
|
|||
// ClientConnected is called to send the very first welcome message
|
|||
func (s *SftpServer) ClientConnected(cc ftpserver.ClientContext) (string, error) { |
|||
return "Welcome to SeaweedFS FTP Server", nil |
|||
} |
|||
|
|||
// ClientDisconnected is called when the user disconnects, even if he never authenticated
|
|||
func (s *SftpServer) ClientDisconnected(cc ftpserver.ClientContext) { |
|||
} |
|||
|
|||
// AuthUser authenticates the user and selects an handling driver
|
|||
func (s *SftpServer) AuthUser(cc ftpserver.ClientContext, username, password string) (ftpserver.ClientDriver, error) { |
|||
return nil, nil |
|||
} |
|||
|
|||
// GetTLSConfig returns a TLS Certificate to use
|
|||
// The certificate could frequently change if we use something like "let's encrypt"
|
|||
func (s *SftpServer) GetTLSConfig() (*tls.Config, error) { |
|||
return nil, errors.New("no TLS certificate configured") |
|||
} |
|||
@ -0,0 +1,76 @@ |
|||
// Package auth provides authentication and authorization functionality for the SFTP server
|
|||
package auth |
|||
|
|||
import ( |
|||
"github.com/seaweedfs/seaweedfs/weed/sftpd/user" |
|||
"golang.org/x/crypto/ssh" |
|||
) |
|||
|
|||
// Provider defines the interface for authentication providers
|
|||
type Provider interface { |
|||
// GetAuthMethods returns the SSH server auth methods
|
|||
GetAuthMethods() []ssh.AuthMethod |
|||
} |
|||
|
|||
// Manager handles authentication and authorization
|
|||
type Manager struct { |
|||
userStore user.Store |
|||
passwordAuth *PasswordAuthenticator |
|||
publicKeyAuth *PublicKeyAuthenticator |
|||
permissionChecker *PermissionChecker |
|||
enabledAuthMethods []string |
|||
} |
|||
|
|||
// NewManager creates a new authentication manager
|
|||
func NewManager(userStore user.Store, fsHelper FileSystemHelper, enabledAuthMethods []string) *Manager { |
|||
manager := &Manager{ |
|||
userStore: userStore, |
|||
enabledAuthMethods: enabledAuthMethods, |
|||
} |
|||
|
|||
// Initialize authenticators based on enabled methods
|
|||
passwordEnabled := false |
|||
publicKeyEnabled := false |
|||
|
|||
for _, method := range enabledAuthMethods { |
|||
switch method { |
|||
case "password": |
|||
passwordEnabled = true |
|||
case "publickey": |
|||
publicKeyEnabled = true |
|||
} |
|||
} |
|||
|
|||
manager.passwordAuth = NewPasswordAuthenticator(userStore, passwordEnabled) |
|||
manager.publicKeyAuth = NewPublicKeyAuthenticator(userStore, publicKeyEnabled) |
|||
manager.permissionChecker = NewPermissionChecker(fsHelper) |
|||
|
|||
return manager |
|||
} |
|||
|
|||
// GetSSHServerConfig returns an SSH server config with the appropriate authentication methods
|
|||
func (m *Manager) GetSSHServerConfig() *ssh.ServerConfig { |
|||
config := &ssh.ServerConfig{} |
|||
|
|||
// Add password authentication if enabled
|
|||
if m.passwordAuth.Enabled() { |
|||
config.PasswordCallback = m.passwordAuth.Authenticate |
|||
} |
|||
|
|||
// Add public key authentication if enabled
|
|||
if m.publicKeyAuth.Enabled() { |
|||
config.PublicKeyCallback = m.publicKeyAuth.Authenticate |
|||
} |
|||
|
|||
return config |
|||
} |
|||
|
|||
// CheckPermission checks if a user has the required permission on a path
|
|||
func (m *Manager) CheckPermission(user *user.User, path, permission string) error { |
|||
return m.permissionChecker.CheckFilePermission(user, path, permission) |
|||
} |
|||
|
|||
// GetUser retrieves a user from the user store
|
|||
func (m *Manager) GetUser(username string) (*user.User, error) { |
|||
return m.userStore.GetUser(username) |
|||
} |
|||
@ -0,0 +1,64 @@ |
|||
package auth |
|||
|
|||
import ( |
|||
"fmt" |
|||
"math/rand" |
|||
"time" |
|||
|
|||
"github.com/seaweedfs/seaweedfs/weed/sftpd/user" |
|||
"golang.org/x/crypto/ssh" |
|||
) |
|||
|
|||
// PasswordAuthenticator handles password-based authentication
|
|||
type PasswordAuthenticator struct { |
|||
userStore user.Store |
|||
enabled bool |
|||
} |
|||
|
|||
// NewPasswordAuthenticator creates a new password authenticator
|
|||
func NewPasswordAuthenticator(userStore user.Store, enabled bool) *PasswordAuthenticator { |
|||
return &PasswordAuthenticator{ |
|||
userStore: userStore, |
|||
enabled: enabled, |
|||
} |
|||
} |
|||
|
|||
// Enabled returns whether password authentication is enabled
|
|||
func (a *PasswordAuthenticator) Enabled() bool { |
|||
return a.enabled |
|||
} |
|||
|
|||
// Authenticate validates a password for a user
|
|||
func (a *PasswordAuthenticator) Authenticate(conn ssh.ConnMetadata, password []byte) (*ssh.Permissions, error) { |
|||
username := conn.User() |
|||
|
|||
// Check if password auth is enabled
|
|||
if !a.enabled { |
|||
return nil, fmt.Errorf("password authentication disabled") |
|||
} |
|||
|
|||
// Validate password against user store
|
|||
if a.userStore.ValidatePassword(username, password) { |
|||
return &ssh.Permissions{ |
|||
Extensions: map[string]string{ |
|||
"username": username, |
|||
}, |
|||
}, nil |
|||
} |
|||
|
|||
// Add delay to prevent brute force attacks
|
|||
time.Sleep(time.Duration(100+rand.Intn(100)) * time.Millisecond) |
|||
|
|||
return nil, fmt.Errorf("authentication failed") |
|||
} |
|||
|
|||
// ValidatePassword checks if the provided password is valid for the user
|
|||
func ValidatePassword(store user.Store, username string, password []byte) bool { |
|||
user, err := store.GetUser(username) |
|||
if err != nil { |
|||
return false |
|||
} |
|||
|
|||
// Compare plaintext password
|
|||
return string(password) == user.Password |
|||
} |
|||
@ -0,0 +1,267 @@ |
|||
package auth |
|||
|
|||
import ( |
|||
"context" |
|||
"fmt" |
|||
"os" |
|||
"strings" |
|||
|
|||
"github.com/seaweedfs/seaweedfs/weed/sftpd/user" |
|||
) |
|||
|
|||
// Permission constants for clarity and consistency
|
|||
const ( |
|||
PermRead = "read" |
|||
PermWrite = "write" |
|||
PermExecute = "execute" |
|||
PermList = "list" |
|||
PermDelete = "delete" |
|||
PermMkdir = "mkdir" |
|||
PermTraverse = "traverse" |
|||
PermAll = "*" |
|||
PermAdmin = "admin" |
|||
PermReadWrite = "readwrite" |
|||
) |
|||
|
|||
// PermissionChecker handles permission checking for file operations
|
|||
// It verifies both Unix-style permissions and explicit ACLs defined in user configuration.
|
|||
type PermissionChecker struct { |
|||
fsHelper FileSystemHelper |
|||
} |
|||
|
|||
// FileSystemHelper provides necessary filesystem operations for permission checking
|
|||
type FileSystemHelper interface { |
|||
GetEntry(path string) (*Entry, error) |
|||
} |
|||
|
|||
// Entry represents a filesystem entry with attributes
|
|||
type Entry struct { |
|||
IsDirectory bool |
|||
Attributes *EntryAttributes |
|||
IsSymlink bool // Added to track symlinks
|
|||
Target string // For symlinks, stores the target path
|
|||
} |
|||
|
|||
// EntryAttributes contains file attributes
|
|||
type EntryAttributes struct { |
|||
Uid uint32 |
|||
Gid uint32 |
|||
FileMode uint32 |
|||
SymlinkTarget string |
|||
} |
|||
|
|||
// PermissionError represents a permission-related error
|
|||
type PermissionError struct { |
|||
Path string |
|||
Perm string |
|||
User string |
|||
} |
|||
|
|||
func (e *PermissionError) Error() string { |
|||
return fmt.Sprintf("permission denied: %s required on %s for user %s", e.Perm, e.Path, e.User) |
|||
} |
|||
|
|||
// NewPermissionChecker creates a new permission checker
|
|||
func NewPermissionChecker(fsHelper FileSystemHelper) *PermissionChecker { |
|||
return &PermissionChecker{ |
|||
fsHelper: fsHelper, |
|||
} |
|||
} |
|||
|
|||
// CheckFilePermission verifies if a user has the required permission on a path
|
|||
// It first checks if the path is in the user's home directory with explicit permissions.
|
|||
// If not, it falls back to Unix permission checking followed by explicit permission checking.
|
|||
// Parameters:
|
|||
// - user: The user requesting access
|
|||
// - path: The filesystem path to check
|
|||
// - perm: The permission being requested (read, write, execute, etc.)
|
|||
//
|
|||
// Returns:
|
|||
// - nil if permission is granted, error otherwise
|
|||
func (pc *PermissionChecker) CheckFilePermission(user *user.User, path string, perm string) error { |
|||
if user == nil { |
|||
return &PermissionError{Path: path, Perm: perm, User: "unknown"} |
|||
} |
|||
|
|||
// Retrieve metadata via helper
|
|||
entry, err := pc.fsHelper.GetEntry(path) |
|||
if err != nil { |
|||
return fmt.Errorf("failed to get entry for path %s: %w", path, err) |
|||
} |
|||
|
|||
// Handle symlinks by resolving them
|
|||
if entry.IsSymlink { |
|||
// Get the actual entry for the resolved path
|
|||
entry, err = pc.fsHelper.GetEntry(entry.Attributes.SymlinkTarget) |
|||
if err != nil { |
|||
return fmt.Errorf("failed to get entry for resolved path %s: %w", entry.Attributes.SymlinkTarget, err) |
|||
} |
|||
|
|||
// Store the original target
|
|||
entry.Target = entry.Attributes.SymlinkTarget |
|||
} |
|||
|
|||
// Special case: root user always has permission
|
|||
if user.Username == "root" || user.Uid == 0 { |
|||
return nil |
|||
} |
|||
|
|||
// Check if path is within user's home directory and has explicit permissions
|
|||
if isPathInHomeDirectory(user, path) { |
|||
// Check if user has explicit permissions for this path
|
|||
if HasExplicitPermission(user, path, perm, entry.IsDirectory) { |
|||
return nil |
|||
} |
|||
} else { |
|||
// For paths outside home directory or without explicit home permissions,
|
|||
// check UNIX-style perms first
|
|||
isOwner := user.Uid == entry.Attributes.Uid |
|||
isGroup := user.Gid == entry.Attributes.Gid |
|||
mode := os.FileMode(entry.Attributes.FileMode) |
|||
|
|||
if HasUnixPermission(isOwner, isGroup, mode, entry.IsDirectory, perm) { |
|||
return nil |
|||
} |
|||
|
|||
// Then check explicit ACLs
|
|||
if HasExplicitPermission(user, path, perm, entry.IsDirectory) { |
|||
return nil |
|||
} |
|||
} |
|||
|
|||
return &PermissionError{Path: path, Perm: perm, User: user.Username} |
|||
} |
|||
|
|||
// CheckFilePermissionWithContext is a context-aware version of CheckFilePermission
|
|||
// that supports cancellation and timeouts
|
|||
func (pc *PermissionChecker) CheckFilePermissionWithContext(ctx context.Context, user *user.User, path string, perm string) error { |
|||
// Check for context cancellation
|
|||
if ctx.Err() != nil { |
|||
return ctx.Err() |
|||
} |
|||
|
|||
return pc.CheckFilePermission(user, path, perm) |
|||
} |
|||
|
|||
// isPathInHomeDirectory checks if a path is in the user's home directory
|
|||
func isPathInHomeDirectory(user *user.User, path string) bool { |
|||
return strings.HasPrefix(path, user.HomeDir) |
|||
} |
|||
|
|||
// HasUnixPermission checks if the user has the required Unix permission
|
|||
// Uses bit masks for clarity and maintainability
|
|||
func HasUnixPermission(isOwner, isGroup bool, fileMode os.FileMode, isDirectory bool, requiredPerm string) bool { |
|||
const ( |
|||
ownerRead = 0400 |
|||
ownerWrite = 0200 |
|||
ownerExec = 0100 |
|||
groupRead = 0040 |
|||
groupWrite = 0020 |
|||
groupExec = 0010 |
|||
otherRead = 0004 |
|||
otherWrite = 0002 |
|||
otherExec = 0001 |
|||
) |
|||
|
|||
// Check read permission
|
|||
hasRead := (isOwner && (fileMode&ownerRead != 0)) || |
|||
(isGroup && (fileMode&groupRead != 0)) || |
|||
(fileMode&otherRead != 0) |
|||
|
|||
// Check write permission
|
|||
hasWrite := (isOwner && (fileMode&ownerWrite != 0)) || |
|||
(isGroup && (fileMode&groupWrite != 0)) || |
|||
(fileMode&otherWrite != 0) |
|||
|
|||
// Check execute permission
|
|||
hasExec := (isOwner && (fileMode&ownerExec != 0)) || |
|||
(isGroup && (fileMode&groupExec != 0)) || |
|||
(fileMode&otherExec != 0) |
|||
|
|||
switch requiredPerm { |
|||
case PermRead: |
|||
return hasRead |
|||
case PermWrite: |
|||
return hasWrite |
|||
case PermExecute: |
|||
return hasExec |
|||
case PermList: |
|||
if isDirectory { |
|||
return hasRead && hasExec |
|||
} |
|||
return hasRead |
|||
case PermDelete: |
|||
return hasWrite |
|||
case PermMkdir: |
|||
return isDirectory && hasWrite |
|||
case PermTraverse: |
|||
return isDirectory && hasExec |
|||
case PermReadWrite: |
|||
return hasRead && hasWrite |
|||
case PermAll, PermAdmin: |
|||
return hasRead && hasWrite && hasExec |
|||
} |
|||
return false |
|||
} |
|||
|
|||
// HasExplicitPermission checks if the user has explicit permission from user config
|
|||
func HasExplicitPermission(user *user.User, filepath, requiredPerm string, isDirectory bool) bool { |
|||
// Find the most specific permission that applies to this path
|
|||
var bestMatch string |
|||
var perms []string |
|||
|
|||
for p, userPerms := range user.Permissions { |
|||
// Check if the path is either the permission path exactly or is under that path
|
|||
if strings.HasPrefix(filepath, p) && len(p) > len(bestMatch) { |
|||
bestMatch = p |
|||
perms = userPerms |
|||
} |
|||
} |
|||
|
|||
// No matching permissions found
|
|||
if bestMatch == "" { |
|||
return false |
|||
} |
|||
|
|||
// Check if user has admin role
|
|||
if containsString(perms, PermAdmin) { |
|||
return true |
|||
} |
|||
|
|||
// If user has list permission and is requesting traverse/execute permission, grant it
|
|||
if isDirectory && requiredPerm == PermExecute && containsString(perms, PermList) { |
|||
return true |
|||
} |
|||
|
|||
// Check if the required permission is in the list
|
|||
for _, perm := range perms { |
|||
if perm == requiredPerm || perm == PermAll { |
|||
return true |
|||
} |
|||
|
|||
// Handle combined permissions
|
|||
if perm == PermReadWrite && (requiredPerm == PermRead || requiredPerm == PermWrite) { |
|||
return true |
|||
} |
|||
|
|||
// Directory-specific permissions
|
|||
if isDirectory && perm == PermList && requiredPerm == PermRead { |
|||
return true |
|||
} |
|||
if isDirectory && perm == PermTraverse && requiredPerm == PermExecute { |
|||
return true |
|||
} |
|||
} |
|||
|
|||
return false |
|||
} |
|||
|
|||
// Helper function to check if a string is in a slice
|
|||
func containsString(slice []string, s string) bool { |
|||
for _, item := range slice { |
|||
if item == s { |
|||
return true |
|||
} |
|||
} |
|||
return false |
|||
} |
|||
@ -0,0 +1,68 @@ |
|||
package auth |
|||
|
|||
import ( |
|||
"crypto/subtle" |
|||
"fmt" |
|||
|
|||
"github.com/seaweedfs/seaweedfs/weed/sftpd/user" |
|||
"golang.org/x/crypto/ssh" |
|||
) |
|||
|
|||
// PublicKeyAuthenticator handles public key-based authentication
|
|||
type PublicKeyAuthenticator struct { |
|||
userStore user.Store |
|||
enabled bool |
|||
} |
|||
|
|||
// NewPublicKeyAuthenticator creates a new public key authenticator
|
|||
func NewPublicKeyAuthenticator(userStore user.Store, enabled bool) *PublicKeyAuthenticator { |
|||
return &PublicKeyAuthenticator{ |
|||
userStore: userStore, |
|||
enabled: enabled, |
|||
} |
|||
} |
|||
|
|||
// Enabled returns whether public key authentication is enabled
|
|||
func (a *PublicKeyAuthenticator) Enabled() bool { |
|||
return a.enabled |
|||
} |
|||
|
|||
// Authenticate validates a public key for a user
|
|||
func (a *PublicKeyAuthenticator) Authenticate(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) { |
|||
username := conn.User() |
|||
|
|||
// Check if public key auth is enabled
|
|||
if !a.enabled { |
|||
return nil, fmt.Errorf("public key authentication disabled") |
|||
} |
|||
|
|||
// Convert key to string format for comparison
|
|||
keyData := string(key.Marshal()) |
|||
|
|||
// Validate public key
|
|||
if ValidatePublicKey(a.userStore, username, keyData) { |
|||
return &ssh.Permissions{ |
|||
Extensions: map[string]string{ |
|||
"username": username, |
|||
}, |
|||
}, nil |
|||
} |
|||
|
|||
return nil, fmt.Errorf("authentication failed") |
|||
} |
|||
|
|||
// ValidatePublicKey checks if the provided public key is valid for the user
|
|||
func ValidatePublicKey(store user.Store, username string, keyData string) bool { |
|||
user, err := store.GetUser(username) |
|||
if err != nil { |
|||
return false |
|||
} |
|||
|
|||
for _, key := range user.PublicKeys { |
|||
if subtle.ConstantTimeCompare([]byte(key), []byte(keyData)) == 1 { |
|||
return true |
|||
} |
|||
} |
|||
|
|||
return false |
|||
} |
|||
@ -0,0 +1,457 @@ |
|||
// sftp_filer_refactored.go
|
|||
package sftpd |
|||
|
|||
import ( |
|||
"bytes" |
|||
"context" |
|||
"crypto/md5" |
|||
"encoding/json" |
|||
"fmt" |
|||
"io" |
|||
"net/http" |
|||
"os" |
|||
"path" |
|||
"strings" |
|||
"syscall" |
|||
"time" |
|||
|
|||
"github.com/pkg/sftp" |
|||
"github.com/seaweedfs/seaweedfs/weed/filer" |
|||
"github.com/seaweedfs/seaweedfs/weed/glog" |
|||
"github.com/seaweedfs/seaweedfs/weed/pb" |
|||
filer_pb "github.com/seaweedfs/seaweedfs/weed/pb/filer_pb" |
|||
weed_server "github.com/seaweedfs/seaweedfs/weed/server" |
|||
"github.com/seaweedfs/seaweedfs/weed/sftpd/user" |
|||
"github.com/seaweedfs/seaweedfs/weed/util" |
|||
"google.golang.org/grpc" |
|||
) |
|||
|
|||
const ( |
|||
defaultTimeout = 30 * time.Second |
|||
defaultListLimit = 1000 |
|||
) |
|||
|
|||
// ==================== Filer RPC Helpers ====================
|
|||
|
|||
// callWithClient wraps a gRPC client call with timeout and client creation.
|
|||
func (fs *SftpServer) callWithClient(streaming bool, fn func(ctx context.Context, client filer_pb.SeaweedFilerClient) error) error { |
|||
return fs.withTimeoutContext(func(ctx context.Context) error { |
|||
return fs.WithFilerClient(streaming, func(client filer_pb.SeaweedFilerClient) error { |
|||
return fn(ctx, client) |
|||
}) |
|||
}) |
|||
} |
|||
|
|||
// getEntry retrieves a single directory entry by path.
|
|||
func (fs *SftpServer) getEntry(p string) (*filer_pb.Entry, error) { |
|||
dir, name := util.FullPath(p).DirAndName() |
|||
var entry *filer_pb.Entry |
|||
err := fs.callWithClient(false, func(ctx context.Context, client filer_pb.SeaweedFilerClient) error { |
|||
r, err := client.LookupDirectoryEntry(ctx, &filer_pb.LookupDirectoryEntryRequest{Directory: dir, Name: name}) |
|||
if err != nil { |
|||
return err |
|||
} |
|||
if r.Entry == nil { |
|||
return fmt.Errorf("%s not found in %s", name, dir) |
|||
} |
|||
entry = r.Entry |
|||
return nil |
|||
}) |
|||
if err != nil { |
|||
return nil, fmt.Errorf("lookup %s: %w", p, err) |
|||
} |
|||
return entry, nil |
|||
} |
|||
|
|||
// updateEntry sends an UpdateEntryRequest for the given entry.
|
|||
func (fs *SftpServer) updateEntry(dir string, entry *filer_pb.Entry) error { |
|||
return fs.callWithClient(false, func(ctx context.Context, client filer_pb.SeaweedFilerClient) error { |
|||
_, err := client.UpdateEntry(ctx, &filer_pb.UpdateEntryRequest{Directory: dir, Entry: entry}) |
|||
return err |
|||
}) |
|||
} |
|||
|
|||
// ==================== FilerClient Interface ====================
|
|||
|
|||
func (fs *SftpServer) AdjustedUrl(location *filer_pb.Location) string { return location.Url } |
|||
func (fs *SftpServer) GetDataCenter() string { return fs.dataCenter } |
|||
func (fs *SftpServer) WithFilerClient(streamingMode bool, fn func(filer_pb.SeaweedFilerClient) error) error { |
|||
addr := fs.filerAddr.ToGrpcAddress() |
|||
return pb.WithGrpcClient(streamingMode, util.RandomInt32(), func(conn *grpc.ClientConn) error { |
|||
return fn(filer_pb.NewSeaweedFilerClient(conn)) |
|||
}, addr, false, fs.grpcDialOption) |
|||
} |
|||
func (fs *SftpServer) withTimeoutContext(fn func(ctx context.Context) error) error { |
|||
ctx, cancel := context.WithTimeout(context.Background(), defaultTimeout) |
|||
defer cancel() |
|||
return fn(ctx) |
|||
} |
|||
|
|||
// ==================== Command Dispatcher ====================
|
|||
|
|||
func (fs *SftpServer) dispatchCmd(r *sftp.Request) error { |
|||
glog.V(0).Infof("Dispatch: %s %s", r.Method, r.Filepath) |
|||
switch r.Method { |
|||
case "Remove": |
|||
return fs.removeEntry(r) |
|||
case "Rename": |
|||
return fs.renameEntry(r) |
|||
case "Mkdir": |
|||
return fs.makeDir(r) |
|||
case "Rmdir": |
|||
return fs.removeDir(r) |
|||
case "Setstat": |
|||
return fs.setFileStat(r) |
|||
default: |
|||
return fmt.Errorf("unsupported: %s", r.Method) |
|||
} |
|||
} |
|||
|
|||
// ==================== File Operations ====================
|
|||
|
|||
func (fs *SftpServer) readFile(r *sftp.Request) (io.ReaderAt, error) { |
|||
if err := fs.checkFilePermission(r.Filepath, "read"); err != nil { |
|||
return nil, err |
|||
} |
|||
entry, err := fs.getEntry(r.Filepath) |
|||
if err != nil { |
|||
return nil, err |
|||
} |
|||
return &SeaweedFileReaderAt{fs: fs, entry: entry}, nil |
|||
} |
|||
|
|||
// putFile uploads a file to the filer and sets ownership metadata.
|
|||
func (fs *SftpServer) putFile(filepath string, data []byte, user *user.User) error { |
|||
dir, filename := util.FullPath(filepath).DirAndName() |
|||
uploadUrl := fmt.Sprintf("http://%s%s", fs.filerAddr, filepath) |
|||
|
|||
// Create a reader from our buffered data and calculate MD5 hash
|
|||
hash := md5.New() |
|||
reader := bytes.NewReader(data) |
|||
body := io.TeeReader(reader, hash) |
|||
fileSize := int64(len(data)) |
|||
|
|||
// Create and execute HTTP request
|
|||
proxyReq, err := http.NewRequest(http.MethodPut, uploadUrl, body) |
|||
if err != nil { |
|||
return fmt.Errorf("create request: %v", err) |
|||
} |
|||
proxyReq.ContentLength = fileSize |
|||
proxyReq.Header.Set("Content-Type", "application/octet-stream") |
|||
|
|||
client := &http.Client{} |
|||
resp, err := client.Do(proxyReq) |
|||
if err != nil { |
|||
return fmt.Errorf("upload to filer: %v", err) |
|||
} |
|||
defer resp.Body.Close() |
|||
|
|||
// Process response
|
|||
respBody, err := io.ReadAll(resp.Body) |
|||
if err != nil { |
|||
return fmt.Errorf("read response: %v", err) |
|||
} |
|||
|
|||
if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated { |
|||
return fmt.Errorf("upload failed with status %d: %s", resp.StatusCode, string(respBody)) |
|||
} |
|||
|
|||
var result weed_server.FilerPostResult |
|||
if err := json.Unmarshal(respBody, &result); err != nil { |
|||
return fmt.Errorf("parse response: %v", err) |
|||
} |
|||
|
|||
if result.Error != "" { |
|||
return fmt.Errorf("filer error: %s", result.Error) |
|||
} |
|||
|
|||
// Update file ownership using the same pattern as other functions
|
|||
if user != nil { |
|||
err := fs.callWithClient(false, func(ctx context.Context, client filer_pb.SeaweedFilerClient) error { |
|||
// Look up the file to get its current entry
|
|||
lookupResp, err := client.LookupDirectoryEntry(ctx, &filer_pb.LookupDirectoryEntryRequest{ |
|||
Directory: dir, |
|||
Name: filename, |
|||
}) |
|||
if err != nil { |
|||
return fmt.Errorf("lookup file for attribute update: %v", err) |
|||
} |
|||
|
|||
if lookupResp.Entry == nil { |
|||
return fmt.Errorf("file not found after upload: %s/%s", dir, filename) |
|||
} |
|||
|
|||
// Update the entry with new uid/gid
|
|||
entry := lookupResp.Entry |
|||
entry.Attributes.Uid = user.Uid |
|||
entry.Attributes.Gid = user.Gid |
|||
|
|||
// Update the entry in the filer
|
|||
_, err = client.UpdateEntry(ctx, &filer_pb.UpdateEntryRequest{ |
|||
Directory: dir, |
|||
Entry: entry, |
|||
}) |
|||
return err |
|||
}) |
|||
|
|||
if err != nil { |
|||
// Log the error but don't fail the whole operation
|
|||
glog.Errorf("Failed to update file ownership for %s: %v", filepath, err) |
|||
} |
|||
} |
|||
|
|||
return nil |
|||
} |
|||
|
|||
func (fs *SftpServer) newFileWriter(r *sftp.Request) (io.WriterAt, error) { |
|||
return &filerFileWriter{fs: *fs, req: r, permissions: 0644, uid: fs.user.Uid, gid: fs.user.Gid}, nil |
|||
} |
|||
|
|||
func (fs *SftpServer) removeEntry(r *sftp.Request) error { |
|||
return fs.deleteEntry(r.Filepath, false) |
|||
} |
|||
|
|||
func (fs *SftpServer) renameEntry(r *sftp.Request) error { |
|||
if err := fs.checkFilePermission(r.Filepath, "rename"); err != nil { |
|||
return err |
|||
} |
|||
oldDir, oldName := util.FullPath(r.Filepath).DirAndName() |
|||
newDir, newName := util.FullPath(r.Target).DirAndName() |
|||
return fs.callWithClient(false, func(ctx context.Context, client filer_pb.SeaweedFilerClient) error { |
|||
_, err := client.AtomicRenameEntry(ctx, &filer_pb.AtomicRenameEntryRequest{ |
|||
OldDirectory: oldDir, OldName: oldName, |
|||
NewDirectory: newDir, NewName: newName, |
|||
}) |
|||
return err |
|||
}) |
|||
} |
|||
|
|||
func (fs *SftpServer) setFileStat(r *sftp.Request) error { |
|||
if err := fs.checkFilePermission(r.Filepath, "write"); err != nil { |
|||
return err |
|||
} |
|||
entry, err := fs.getEntry(r.Filepath) |
|||
if err != nil { |
|||
return err |
|||
} |
|||
dir, _ := util.FullPath(r.Filepath).DirAndName() |
|||
// apply attrs
|
|||
if r.AttrFlags().Permissions { |
|||
entry.Attributes.FileMode = uint32(r.Attributes().FileMode()) |
|||
} |
|||
if r.AttrFlags().UidGid { |
|||
entry.Attributes.Uid = uint32(r.Attributes().UID) |
|||
entry.Attributes.Gid = uint32(r.Attributes().GID) |
|||
} |
|||
if r.AttrFlags().Acmodtime { |
|||
entry.Attributes.Mtime = int64(r.Attributes().Mtime) |
|||
} |
|||
if r.AttrFlags().Size { |
|||
entry.Attributes.FileSize = uint64(r.Attributes().Size) |
|||
} |
|||
return fs.updateEntry(dir, entry) |
|||
} |
|||
|
|||
// ==================== Directory Operations ====================
|
|||
|
|||
func (fs *SftpServer) listDir(r *sftp.Request) (sftp.ListerAt, error) { |
|||
if err := fs.checkFilePermission(r.Filepath, "list"); err != nil { |
|||
return nil, err |
|||
} |
|||
if r.Method == "Stat" || r.Method == "Lstat" { |
|||
entry, err := fs.getEntry(r.Filepath) |
|||
if err != nil { |
|||
return nil, err |
|||
} |
|||
fi := &EnhancedFileInfo{FileInfo: FileInfoFromEntry(entry), uid: entry.Attributes.Uid, gid: entry.Attributes.Gid} |
|||
return listerat([]os.FileInfo{fi}), nil |
|||
} |
|||
return fs.listAllPages(r.Filepath) |
|||
} |
|||
|
|||
func (fs *SftpServer) listAllPages(dirPath string) (sftp.ListerAt, error) { |
|||
var all []os.FileInfo |
|||
last := "" |
|||
for { |
|||
page, err := fs.fetchDirectoryPage(dirPath, last) |
|||
if err != nil { |
|||
return nil, err |
|||
} |
|||
all = append(all, page...) |
|||
if len(page) < defaultListLimit { |
|||
break |
|||
} |
|||
last = page[len(page)-1].Name() |
|||
} |
|||
return listerat(all), nil |
|||
} |
|||
|
|||
func (fs *SftpServer) fetchDirectoryPage(dirPath, start string) ([]os.FileInfo, error) { |
|||
var list []os.FileInfo |
|||
err := fs.callWithClient(true, func(ctx context.Context, client filer_pb.SeaweedFilerClient) error { |
|||
stream, err := client.ListEntries(ctx, &filer_pb.ListEntriesRequest{Directory: dirPath, StartFromFileName: start, Limit: defaultListLimit}) |
|||
if err != nil { |
|||
return err |
|||
} |
|||
for { |
|||
r, err := stream.Recv() |
|||
if err == io.EOF { |
|||
break |
|||
} |
|||
if err != nil || r.Entry == nil { |
|||
continue |
|||
} |
|||
p := path.Join(dirPath, r.Entry.Name) |
|||
if err := fs.checkFilePermission(p, "list"); err != nil { |
|||
continue |
|||
} |
|||
list = append(list, &EnhancedFileInfo{FileInfo: FileInfoFromEntry(r.Entry), uid: r.Entry.Attributes.Uid, gid: r.Entry.Attributes.Gid}) |
|||
} |
|||
return nil |
|||
}) |
|||
return list, err |
|||
} |
|||
|
|||
// makeDir creates a new directory with proper permissions.
|
|||
func (fs *SftpServer) makeDir(r *sftp.Request) error { |
|||
if fs.user == nil { |
|||
return fmt.Errorf("cannot create directory: no user info") |
|||
} |
|||
dir, name := util.FullPath(r.Filepath).DirAndName() |
|||
if err := fs.checkFilePermission(dir, "mkdir"); err != nil { |
|||
return err |
|||
} |
|||
// default mode and ownership
|
|||
err := filer_pb.Mkdir(fs, string(dir), name, func(entry *filer_pb.Entry) { |
|||
mode := uint32(0755 | os.ModeDir) |
|||
if strings.HasPrefix(r.Filepath, fs.user.HomeDir) { |
|||
mode = uint32(0700 | os.ModeDir) |
|||
} |
|||
entry.Attributes.FileMode = mode |
|||
entry.Attributes.Uid = fs.user.Uid |
|||
entry.Attributes.Gid = fs.user.Gid |
|||
now := time.Now().Unix() |
|||
entry.Attributes.Crtime = now |
|||
entry.Attributes.Mtime = now |
|||
if entry.Extended == nil { |
|||
entry.Extended = make(map[string][]byte) |
|||
} |
|||
entry.Extended["creator"] = []byte(fs.user.Username) |
|||
}) |
|||
return err |
|||
} |
|||
|
|||
// removeDir deletes a directory.
|
|||
func (fs *SftpServer) removeDir(r *sftp.Request) error { |
|||
return fs.deleteEntry(r.Filepath, false) |
|||
} |
|||
|
|||
// ==================== Common Arguments Helpers ====================
|
|||
|
|||
func FileInfoFromEntry(e *filer_pb.Entry) FileInfo { |
|||
return FileInfo{name: e.Name, size: int64(e.Attributes.FileSize), mode: os.FileMode(e.Attributes.FileMode), modTime: time.Unix(e.Attributes.Mtime, 0), isDir: e.IsDirectory} |
|||
} |
|||
|
|||
func (fs *SftpServer) deleteEntry(p string, recursive bool) error { |
|||
if err := fs.checkFilePermission(p, "delete"); err != nil { |
|||
return err |
|||
} |
|||
dir, name := util.FullPath(p).DirAndName() |
|||
return fs.callWithClient(false, func(ctx context.Context, client filer_pb.SeaweedFilerClient) error { |
|||
r, err := client.DeleteEntry(ctx, &filer_pb.DeleteEntryRequest{Directory: dir, Name: name, IsDeleteData: true, IsRecursive: recursive}) |
|||
if err != nil { |
|||
return err |
|||
} |
|||
if r.Error != "" { |
|||
return fmt.Errorf("%s", r.Error) |
|||
} |
|||
return nil |
|||
}) |
|||
} |
|||
|
|||
// ==================== Custom Types ====================
|
|||
|
|||
type EnhancedFileInfo struct { |
|||
FileInfo |
|||
uid uint32 |
|||
gid uint32 |
|||
} |
|||
|
|||
func (fi *EnhancedFileInfo) Sys() interface{} { |
|||
return &syscall.Stat_t{Uid: fi.uid, Gid: fi.gid} |
|||
} |
|||
|
|||
func (fi *EnhancedFileInfo) Owner() (uid, gid int) { |
|||
return int(fi.uid), int(fi.gid) |
|||
} |
|||
|
|||
// SeaweedFileReaderAt implements io.ReaderAt for SeaweedFS files
|
|||
|
|||
type SeaweedFileReaderAt struct { |
|||
fs *SftpServer |
|||
entry *filer_pb.Entry |
|||
} |
|||
|
|||
func (ra *SeaweedFileReaderAt) ReadAt(p []byte, off int64) (n int, err error) { |
|||
// Create a new reader for each ReadAt call
|
|||
reader := filer.NewFileReader(ra.fs, ra.entry) |
|||
if reader == nil { |
|||
return 0, fmt.Errorf("failed to create file reader") |
|||
} |
|||
|
|||
// Check if we're reading past the end of the file
|
|||
fileSize := int64(ra.entry.Attributes.FileSize) |
|||
if off >= fileSize { |
|||
return 0, io.EOF |
|||
} |
|||
|
|||
// Seek to the offset
|
|||
if seeker, ok := reader.(io.Seeker); ok { |
|||
_, err = seeker.Seek(off, io.SeekStart) |
|||
if err != nil { |
|||
return 0, fmt.Errorf("seek error: %v", err) |
|||
} |
|||
} else { |
|||
// If the reader doesn't implement Seek, we need to read and discard bytes
|
|||
toSkip := off |
|||
skipBuf := make([]byte, 8192) |
|||
for toSkip > 0 { |
|||
skipSize := int64(len(skipBuf)) |
|||
if skipSize > toSkip { |
|||
skipSize = toSkip |
|||
} |
|||
read, err := reader.Read(skipBuf[:skipSize]) |
|||
if err != nil { |
|||
return 0, fmt.Errorf("skip error: %v", err) |
|||
} |
|||
if read == 0 { |
|||
return 0, fmt.Errorf("unable to skip to offset %d", off) |
|||
} |
|||
toSkip -= int64(read) |
|||
} |
|||
} |
|||
|
|||
// Adjust read length if it would go past EOF
|
|||
readLen := len(p) |
|||
remaining := fileSize - off |
|||
if int64(readLen) > remaining { |
|||
readLen = int(remaining) |
|||
if readLen == 0 { |
|||
return 0, io.EOF |
|||
} |
|||
} |
|||
|
|||
// Read the data
|
|||
n, err = io.ReadFull(reader, p[:readLen]) |
|||
|
|||
// Handle EOF correctly
|
|||
if err == io.ErrUnexpectedEOF || (err == nil && n < len(p)) { |
|||
err = io.EOF |
|||
} |
|||
|
|||
return n, err |
|||
} |
|||
|
|||
func (fs *SftpServer) checkFilePermission(filepath string, permissions string) error { |
|||
return fs.authManager.CheckPermission(fs.user, filepath, permissions) |
|||
} |
|||
@ -0,0 +1,126 @@ |
|||
// sftp_helpers.go
|
|||
package sftpd |
|||
|
|||
import ( |
|||
"io" |
|||
"os" |
|||
"sync" |
|||
"time" |
|||
|
|||
"github.com/pkg/sftp" |
|||
"github.com/seaweedfs/seaweedfs/weed/glog" |
|||
"github.com/seaweedfs/seaweedfs/weed/util" |
|||
) |
|||
|
|||
// FileInfo implements os.FileInfo.
|
|||
type FileInfo struct { |
|||
name string |
|||
size int64 |
|||
mode os.FileMode |
|||
modTime time.Time |
|||
isDir bool |
|||
} |
|||
|
|||
func (fi *FileInfo) Name() string { return fi.name } |
|||
func (fi *FileInfo) Size() int64 { return fi.size } |
|||
func (fi *FileInfo) Mode() os.FileMode { return fi.mode } |
|||
func (fi *FileInfo) ModTime() time.Time { return fi.modTime } |
|||
func (fi *FileInfo) IsDir() bool { return fi.isDir } |
|||
func (fi *FileInfo) Sys() interface{} { return nil } |
|||
|
|||
// bufferReader wraps a byte slice to io.ReaderAt.
|
|||
type bufferReader struct { |
|||
b []byte |
|||
i int64 |
|||
} |
|||
|
|||
func NewBufferReader(b []byte) *bufferReader { return &bufferReader{b: b} } |
|||
|
|||
func (r *bufferReader) Read(p []byte) (int, error) { |
|||
if r.i >= int64(len(r.b)) { |
|||
return 0, io.EOF |
|||
} |
|||
n := copy(p, r.b[r.i:]) |
|||
r.i += int64(n) |
|||
return n, nil |
|||
} |
|||
|
|||
func (r *bufferReader) ReadAt(p []byte, off int64) (int, error) { |
|||
if off >= int64(len(r.b)) { |
|||
return 0, io.EOF |
|||
} |
|||
n := copy(p, r.b[off:]) |
|||
if n < len(p) { |
|||
return n, io.EOF |
|||
} |
|||
return n, nil |
|||
} |
|||
|
|||
// listerat implements sftp.ListerAt.
|
|||
type listerat []os.FileInfo |
|||
|
|||
func (l listerat) ListAt(ls []os.FileInfo, offset int64) (int, error) { |
|||
if offset >= int64(len(l)) { |
|||
return 0, io.EOF |
|||
} |
|||
n := copy(ls, l[offset:]) |
|||
if n < len(ls) { |
|||
return n, io.EOF |
|||
} |
|||
return n, nil |
|||
} |
|||
|
|||
// filerFileWriter buffers writes and flushes on Close.
|
|||
type filerFileWriter struct { |
|||
fs SftpServer |
|||
req *sftp.Request |
|||
mu sync.Mutex |
|||
data []byte |
|||
permissions os.FileMode |
|||
uid uint32 |
|||
gid uint32 |
|||
offset int64 |
|||
} |
|||
|
|||
func (w *filerFileWriter) Write(p []byte) (int, error) { |
|||
w.mu.Lock() |
|||
defer w.mu.Unlock() |
|||
end := w.offset + int64(len(p)) |
|||
if end > int64(len(w.data)) { |
|||
newBuf := make([]byte, end) |
|||
copy(newBuf, w.data) |
|||
w.data = newBuf |
|||
} |
|||
n := copy(w.data[w.offset:], p) |
|||
w.offset += int64(n) |
|||
return n, nil |
|||
} |
|||
|
|||
func (w *filerFileWriter) WriteAt(p []byte, off int64) (int, error) { |
|||
w.mu.Lock() |
|||
defer w.mu.Unlock() |
|||
end := int(off) + len(p) |
|||
if end > len(w.data) { |
|||
newBuf := make([]byte, end) |
|||
copy(newBuf, w.data) |
|||
w.data = newBuf |
|||
} |
|||
n := copy(w.data[off:], p) |
|||
return n, nil |
|||
} |
|||
|
|||
func (w *filerFileWriter) Close() error { |
|||
w.mu.Lock() |
|||
defer w.mu.Unlock() |
|||
|
|||
dir, _ := util.FullPath(w.req.Filepath).DirAndName() |
|||
|
|||
// Check permissions based on file metadata and user permissions
|
|||
if err := w.fs.checkFilePermission(dir, "write"); err != nil { |
|||
glog.Errorf("Permission denied for %s", dir) |
|||
return err |
|||
} |
|||
|
|||
// Call the extracted putFile method on SftpServer
|
|||
return w.fs.putFile(w.req.Filepath, w.data, w.fs.user) |
|||
} |
|||
@ -0,0 +1,59 @@ |
|||
// sftp_server.go
|
|||
package sftpd |
|||
|
|||
import ( |
|||
"io" |
|||
|
|||
"github.com/pkg/sftp" |
|||
"github.com/seaweedfs/seaweedfs/weed/pb" |
|||
"github.com/seaweedfs/seaweedfs/weed/sftpd/auth" |
|||
"github.com/seaweedfs/seaweedfs/weed/sftpd/user" |
|||
"google.golang.org/grpc" |
|||
) |
|||
|
|||
type SftpServer struct { |
|||
filerAddr pb.ServerAddress |
|||
grpcDialOption grpc.DialOption |
|||
dataCenter string |
|||
filerGroup string |
|||
user *user.User |
|||
authManager *auth.Manager |
|||
} |
|||
|
|||
// NewSftpServer constructs the server.
|
|||
func NewSftpServer(filerAddr pb.ServerAddress, grpcDialOption grpc.DialOption, dataCenter, filerGroup string, user *user.User) SftpServer { |
|||
// Create a file system helper for the auth manager
|
|||
fsHelper := NewFileSystemHelper(filerAddr, grpcDialOption, dataCenter, filerGroup) |
|||
|
|||
// Create an auth manager for permission checking
|
|||
authManager := auth.NewManager(nil, fsHelper, []string{}) |
|||
|
|||
return SftpServer{ |
|||
filerAddr: filerAddr, |
|||
grpcDialOption: grpcDialOption, |
|||
dataCenter: dataCenter, |
|||
filerGroup: filerGroup, |
|||
user: user, |
|||
authManager: authManager, |
|||
} |
|||
} |
|||
|
|||
// Fileread is invoked for “get” requests.
|
|||
func (fs *SftpServer) Fileread(req *sftp.Request) (io.ReaderAt, error) { |
|||
return fs.readFile(req) |
|||
} |
|||
|
|||
// Filewrite is invoked for “put” requests.
|
|||
func (fs *SftpServer) Filewrite(req *sftp.Request) (io.WriterAt, error) { |
|||
return fs.newFileWriter(req) |
|||
} |
|||
|
|||
// Filecmd handles Remove, Rename, Mkdir, Rmdir, etc.
|
|||
func (fs *SftpServer) Filecmd(req *sftp.Request) error { |
|||
return fs.dispatchCmd(req) |
|||
} |
|||
|
|||
// Filelist handles directory listings.
|
|||
func (fs *SftpServer) Filelist(req *sftp.Request) (sftp.ListerAt, error) { |
|||
return fs.listDir(req) |
|||
} |
|||
@ -0,0 +1,394 @@ |
|||
// sftp_service.go
|
|||
package sftpd |
|||
|
|||
import ( |
|||
"context" |
|||
"fmt" |
|||
"io" |
|||
"log" |
|||
"net" |
|||
"os" |
|||
"path/filepath" |
|||
"time" |
|||
|
|||
"github.com/pkg/sftp" |
|||
"github.com/seaweedfs/seaweedfs/weed/glog" |
|||
"github.com/seaweedfs/seaweedfs/weed/pb" |
|||
filer_pb "github.com/seaweedfs/seaweedfs/weed/pb/filer_pb" |
|||
"github.com/seaweedfs/seaweedfs/weed/sftpd/auth" |
|||
"github.com/seaweedfs/seaweedfs/weed/sftpd/user" |
|||
"github.com/seaweedfs/seaweedfs/weed/util" |
|||
"golang.org/x/crypto/ssh" |
|||
"google.golang.org/grpc" |
|||
) |
|||
|
|||
// SFTPService holds configuration for the SFTP service.
|
|||
type SFTPService struct { |
|||
options SFTPServiceOptions |
|||
userStore user.Store |
|||
authManager *auth.Manager |
|||
homeManager *user.HomeManager |
|||
} |
|||
|
|||
// SFTPServiceOptions contains all configuration options for the SFTP service.
|
|||
type SFTPServiceOptions struct { |
|||
GrpcDialOption grpc.DialOption |
|||
DataCenter string |
|||
FilerGroup string |
|||
Filer pb.ServerAddress |
|||
|
|||
// SSH Configuration
|
|||
SshPrivateKey string // Legacy single host key
|
|||
HostKeysFolder string // Multiple host keys for different algorithms
|
|||
AuthMethods []string // Enabled auth methods: "password", "publickey", "keyboard-interactive"
|
|||
MaxAuthTries int // Limit authentication attempts
|
|||
BannerMessage string // Pre-auth banner message
|
|||
LoginGraceTime time.Duration // Timeout for authentication
|
|||
|
|||
// Connection Management
|
|||
ClientAliveInterval time.Duration // Keep-alive check interval
|
|||
ClientAliveCountMax int // Max missed keep-alives before disconnect
|
|||
|
|||
// User Management
|
|||
UserStoreFile string // Path to user store file
|
|||
} |
|||
|
|||
// NewSFTPService creates a new service instance.
|
|||
func NewSFTPService(options *SFTPServiceOptions) *SFTPService { |
|||
service := SFTPService{options: *options} |
|||
|
|||
// Initialize user store
|
|||
userStore, err := user.NewFileStore(options.UserStoreFile) |
|||
if err != nil { |
|||
glog.Fatalf("Failed to initialize user store: %v", err) |
|||
} |
|||
service.userStore = userStore |
|||
|
|||
// Initialize file system helper for permission checking
|
|||
fsHelper := NewFileSystemHelper( |
|||
options.Filer, |
|||
options.GrpcDialOption, |
|||
options.DataCenter, |
|||
options.FilerGroup, |
|||
) |
|||
|
|||
// Initialize auth manager
|
|||
service.authManager = auth.NewManager(userStore, fsHelper, options.AuthMethods) |
|||
|
|||
// Initialize home directory manager
|
|||
service.homeManager = user.NewHomeManager(fsHelper) |
|||
|
|||
return &service |
|||
} |
|||
|
|||
// FileSystemHelper implements auth.FileSystemHelper interface
|
|||
type FileSystemHelper struct { |
|||
filerAddr pb.ServerAddress |
|||
grpcDialOption grpc.DialOption |
|||
dataCenter string |
|||
filerGroup string |
|||
} |
|||
|
|||
func NewFileSystemHelper(filerAddr pb.ServerAddress, grpcDialOption grpc.DialOption, dataCenter, filerGroup string) *FileSystemHelper { |
|||
return &FileSystemHelper{ |
|||
filerAddr: filerAddr, |
|||
grpcDialOption: grpcDialOption, |
|||
dataCenter: dataCenter, |
|||
filerGroup: filerGroup, |
|||
} |
|||
} |
|||
|
|||
// GetEntry implements auth.FileSystemHelper interface
|
|||
func (fs *FileSystemHelper) GetEntry(path string) (*auth.Entry, error) { |
|||
dir, name := util.FullPath(path).DirAndName() |
|||
var entry *filer_pb.Entry |
|||
|
|||
err := fs.withTimeoutContext(func(ctx context.Context) error { |
|||
return fs.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error { |
|||
resp, err := client.LookupDirectoryEntry(ctx, &filer_pb.LookupDirectoryEntryRequest{ |
|||
Directory: dir, |
|||
Name: name, |
|||
}) |
|||
if err != nil { |
|||
return err |
|||
} |
|||
if resp.Entry == nil { |
|||
return fmt.Errorf("entry not found") |
|||
} |
|||
entry = resp.Entry |
|||
return nil |
|||
}) |
|||
}) |
|||
|
|||
if err != nil { |
|||
return nil, err |
|||
} |
|||
|
|||
return &auth.Entry{ |
|||
IsDirectory: entry.IsDirectory, |
|||
Attributes: &auth.EntryAttributes{ |
|||
Uid: entry.Attributes.GetUid(), |
|||
Gid: entry.Attributes.GetGid(), |
|||
FileMode: entry.Attributes.GetFileMode(), |
|||
SymlinkTarget: entry.Attributes.GetSymlinkTarget(), |
|||
}, |
|||
IsSymlink: entry.Attributes.GetSymlinkTarget() != "", |
|||
}, nil |
|||
} |
|||
|
|||
// Implement FilerClient interface for FileSystemHelper
|
|||
func (fs *FileSystemHelper) AdjustedUrl(location *filer_pb.Location) string { |
|||
return location.Url |
|||
} |
|||
|
|||
func (fs *FileSystemHelper) GetDataCenter() string { |
|||
return fs.dataCenter |
|||
} |
|||
|
|||
func (fs *FileSystemHelper) WithFilerClient(streamingMode bool, fn func(filer_pb.SeaweedFilerClient) error) error { |
|||
addr := fs.filerAddr.ToGrpcAddress() |
|||
return pb.WithGrpcClient(streamingMode, util.RandomInt32(), func(conn *grpc.ClientConn) error { |
|||
return fn(filer_pb.NewSeaweedFilerClient(conn)) |
|||
}, addr, false, fs.grpcDialOption) |
|||
} |
|||
|
|||
func (fs *FileSystemHelper) withTimeoutContext(fn func(ctx context.Context) error) error { |
|||
ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second) |
|||
defer cancel() |
|||
return fn(ctx) |
|||
} |
|||
|
|||
// Serve accepts incoming connections on the provided listener and handles them.
|
|||
func (s *SFTPService) Serve(listener net.Listener) error { |
|||
// Build SSH server config
|
|||
sshConfig, err := s.buildSSHConfig() |
|||
if err != nil { |
|||
return fmt.Errorf("failed to create SSH config: %v", err) |
|||
} |
|||
|
|||
glog.V(0).Infof("Starting Seaweed SFTP service on %s", listener.Addr().String()) |
|||
|
|||
for { |
|||
conn, err := listener.Accept() |
|||
if err != nil { |
|||
return fmt.Errorf("failed to accept incoming connection: %v", err) |
|||
} |
|||
go s.handleSSHConnection(conn, sshConfig) |
|||
} |
|||
} |
|||
|
|||
// buildSSHConfig creates the SSH server configuration with proper authentication.
|
|||
func (s *SFTPService) buildSSHConfig() (*ssh.ServerConfig, error) { |
|||
// Get base config from auth manager
|
|||
config := s.authManager.GetSSHServerConfig() |
|||
|
|||
// Set additional options
|
|||
config.MaxAuthTries = s.options.MaxAuthTries |
|||
config.BannerCallback = func(conn ssh.ConnMetadata) string { |
|||
return s.options.BannerMessage |
|||
} |
|||
config.ServerVersion = "SSH-2.0-SeaweedFS-SFTP" // Custom server version
|
|||
|
|||
hostKeysAdded := 0 |
|||
// Add legacy host key if specified
|
|||
if s.options.SshPrivateKey != "" { |
|||
if err := s.addHostKey(config, s.options.SshPrivateKey); err != nil { |
|||
return nil, err |
|||
} |
|||
hostKeysAdded++ |
|||
} |
|||
|
|||
// Add all host keys from the specified folder
|
|||
if s.options.HostKeysFolder != "" { |
|||
files, err := os.ReadDir(s.options.HostKeysFolder) |
|||
if err != nil { |
|||
return nil, fmt.Errorf("failed to read host keys folder: %v", err) |
|||
} |
|||
for _, file := range files { |
|||
if file.IsDir() { |
|||
continue // Skip directories
|
|||
} |
|||
|
|||
keyPath := filepath.Join(s.options.HostKeysFolder, file.Name()) |
|||
if err := s.addHostKey(config, keyPath); err != nil { |
|||
// Log the error but continue with other keys
|
|||
log.Printf("Warning: failed to add host key %s: %v", keyPath, err) |
|||
continue |
|||
} |
|||
hostKeysAdded++ |
|||
} |
|||
|
|||
if hostKeysAdded == 0 { |
|||
log.Printf("Warning: no valid host keys found in folder %s", s.options.HostKeysFolder) |
|||
} |
|||
} |
|||
|
|||
// Ensure we have at least one host key
|
|||
if hostKeysAdded == 0 { |
|||
return nil, fmt.Errorf("no host keys provided") |
|||
} |
|||
return config, nil |
|||
} |
|||
|
|||
// addHostKey adds a host key to the SSH server configuration.
|
|||
func (s *SFTPService) addHostKey(config *ssh.ServerConfig, keyPath string) error { |
|||
keyBytes, err := os.ReadFile(keyPath) |
|||
if err != nil { |
|||
return fmt.Errorf("failed to read host key %s: %v", keyPath, err) |
|||
} |
|||
|
|||
// Try parsing as private key
|
|||
signer, err := ssh.ParsePrivateKey(keyBytes) |
|||
if err != nil { |
|||
// Try parsing with passphrase if available
|
|||
if passphraseErr, ok := err.(*ssh.PassphraseMissingError); ok { |
|||
return fmt.Errorf("host key %s requires passphrase: %v", keyPath, passphraseErr) |
|||
} |
|||
return fmt.Errorf("failed to parse host key %s: %v", keyPath, err) |
|||
} |
|||
config.AddHostKey(signer) |
|||
glog.V(0).Infof("Added host key %s (%s)", keyPath, signer.PublicKey().Type()) |
|||
return nil |
|||
} |
|||
|
|||
// handleSSHConnection handles an incoming SSH connection.
|
|||
func (s *SFTPService) handleSSHConnection(conn net.Conn, config *ssh.ServerConfig) { |
|||
// Set connection deadline for handshake
|
|||
_ = conn.SetDeadline(time.Now().Add(s.options.LoginGraceTime)) |
|||
|
|||
// Perform SSH handshake
|
|||
sshConn, chans, reqs, err := ssh.NewServerConn(conn, config) |
|||
if err != nil { |
|||
glog.Errorf("Failed to handshake: %v", err) |
|||
conn.Close() |
|||
return |
|||
} |
|||
|
|||
// Clear deadline after successful handshake
|
|||
_ = conn.SetDeadline(time.Time{}) |
|||
|
|||
// Set up connection monitoring
|
|||
ctx, cancel := context.WithCancel(context.Background()) |
|||
defer cancel() |
|||
|
|||
// Start keep-alive monitoring
|
|||
go s.monitorConnection(ctx, sshConn) |
|||
|
|||
username := sshConn.Permissions.Extensions["username"] |
|||
glog.V(0).Infof("New SSH connection from %s (%s) as user %s", |
|||
sshConn.RemoteAddr(), sshConn.ClientVersion(), username) |
|||
|
|||
// Get user from store
|
|||
sftpUser, err := s.authManager.GetUser(username) |
|||
if err != nil { |
|||
glog.Errorf("Failed to retrieve user %s: %v", username, err) |
|||
sshConn.Close() |
|||
return |
|||
} |
|||
|
|||
// Create user-specific filesystem
|
|||
userFs := NewSftpServer( |
|||
s.options.Filer, |
|||
s.options.GrpcDialOption, |
|||
s.options.DataCenter, |
|||
s.options.FilerGroup, |
|||
sftpUser, |
|||
) |
|||
|
|||
// Ensure home directory exists with proper permissions
|
|||
if err := s.homeManager.EnsureHomeDirectory(sftpUser); err != nil { |
|||
glog.Errorf("Failed to ensure home directory for user %s: %v", username, err) |
|||
// We don't close the connection here, as the user might still be able to access other directories
|
|||
} |
|||
|
|||
// Handle SSH requests and channels
|
|||
go ssh.DiscardRequests(reqs) |
|||
for newChannel := range chans { |
|||
go s.handleChannel(newChannel, &userFs) |
|||
} |
|||
} |
|||
|
|||
// monitorConnection monitors an SSH connection with keep-alives.
|
|||
func (s *SFTPService) monitorConnection(ctx context.Context, sshConn *ssh.ServerConn) { |
|||
if s.options.ClientAliveInterval <= 0 { |
|||
return |
|||
} |
|||
|
|||
ticker := time.NewTicker(s.options.ClientAliveInterval) |
|||
defer ticker.Stop() |
|||
|
|||
missedCount := 0 |
|||
|
|||
for { |
|||
select { |
|||
case <-ctx.Done(): |
|||
return |
|||
case <-ticker.C: |
|||
// Send keep-alive request
|
|||
_, _, err := sshConn.SendRequest("keepalive@openssh.com", true, nil) |
|||
if err != nil { |
|||
missedCount++ |
|||
glog.V(0).Infof("Keep-alive missed for %s: %v (%d/%d)", |
|||
sshConn.RemoteAddr(), err, missedCount, s.options.ClientAliveCountMax) |
|||
|
|||
if missedCount >= s.options.ClientAliveCountMax { |
|||
glog.Warningf("Closing unresponsive connection from %s", sshConn.RemoteAddr()) |
|||
sshConn.Close() |
|||
return |
|||
} |
|||
} else { |
|||
missedCount = 0 |
|||
} |
|||
} |
|||
} |
|||
} |
|||
|
|||
// handleChannel handles a single SSH channel.
|
|||
func (s *SFTPService) handleChannel(newChannel ssh.NewChannel, fs *SftpServer) { |
|||
if newChannel.ChannelType() != "session" { |
|||
_ = newChannel.Reject(ssh.UnknownChannelType, "unknown channel type") |
|||
return |
|||
} |
|||
|
|||
channel, requests, err := newChannel.Accept() |
|||
if err != nil { |
|||
glog.Errorf("Could not accept channel: %v", err) |
|||
return |
|||
} |
|||
|
|||
go func(in <-chan *ssh.Request) { |
|||
for req := range in { |
|||
switch req.Type { |
|||
case "subsystem": |
|||
// Check that the subsystem is "sftp".
|
|||
if string(req.Payload[4:]) == "sftp" { |
|||
_ = req.Reply(true, nil) |
|||
s.handleSFTP(channel, fs) |
|||
} else { |
|||
_ = req.Reply(false, nil) |
|||
} |
|||
default: |
|||
_ = req.Reply(false, nil) |
|||
} |
|||
} |
|||
}(requests) |
|||
} |
|||
|
|||
// handleSFTP starts the SFTP server on the SSH channel.
|
|||
func (s *SFTPService) handleSFTP(channel ssh.Channel, fs *SftpServer) { |
|||
// Create server options with initial working directory set to user's home
|
|||
serverOptions := sftp.WithStartDirectory(fs.user.HomeDir) |
|||
server := sftp.NewRequestServer(channel, sftp.Handlers{ |
|||
FileGet: fs, |
|||
FilePut: fs, |
|||
FileCmd: fs, |
|||
FileList: fs, |
|||
}, serverOptions) |
|||
|
|||
if err := server.Serve(); err == io.EOF { |
|||
server.Close() |
|||
glog.V(0).Info("SFTP client exited session.") |
|||
} else if err != nil { |
|||
glog.Errorf("SFTP server finished with error: %v", err) |
|||
} |
|||
} |
|||
@ -0,0 +1,143 @@ |
|||
package sftpd |
|||
|
|||
import ( |
|||
"crypto/subtle" |
|||
"encoding/json" |
|||
"fmt" |
|||
"os" |
|||
"strings" |
|||
"sync" |
|||
) |
|||
|
|||
// UserStore interface for user management.
|
|||
type UserStore interface { |
|||
GetUser(username string) (*User, error) |
|||
ValidatePassword(username string, password []byte) bool |
|||
ValidatePublicKey(username string, keyData string) bool |
|||
GetUserPermissions(username string, path string) []string |
|||
} |
|||
|
|||
// User represents an SFTP user with authentication and permission details.
|
|||
type User struct { |
|||
Username string |
|||
Password string // Plaintext password
|
|||
PublicKeys []string // Authorized public keys
|
|||
HomeDir string // User's home directory
|
|||
Permissions map[string][]string // path -> permissions (read, write, list, etc.)
|
|||
Uid uint32 // User ID for file ownership
|
|||
Gid uint32 // Group ID for file ownership
|
|||
} |
|||
|
|||
// FileUserStore implements UserStore using a JSON file.
|
|||
type FileUserStore struct { |
|||
filePath string |
|||
users map[string]*User |
|||
mu sync.RWMutex |
|||
} |
|||
|
|||
// NewFileUserStore creates a new user store from a JSON file.
|
|||
func NewFileUserStore(filePath string) (*FileUserStore, error) { |
|||
store := &FileUserStore{ |
|||
filePath: filePath, |
|||
users: make(map[string]*User), |
|||
} |
|||
|
|||
if err := store.loadUsers(); err != nil { |
|||
return nil, err |
|||
} |
|||
|
|||
return store, nil |
|||
} |
|||
|
|||
// loadUsers loads users from the JSON file.
|
|||
func (s *FileUserStore) loadUsers() error { |
|||
s.mu.Lock() |
|||
defer s.mu.Unlock() |
|||
|
|||
// Check if file exists
|
|||
if _, err := os.Stat(s.filePath); os.IsNotExist(err) { |
|||
return fmt.Errorf("user store file not found: %s", s.filePath) |
|||
} |
|||
|
|||
data, err := os.ReadFile(s.filePath) |
|||
if err != nil { |
|||
return fmt.Errorf("failed to read user store file: %v", err) |
|||
} |
|||
|
|||
var users []*User |
|||
if err := json.Unmarshal(data, &users); err != nil { |
|||
return fmt.Errorf("failed to parse user store file: %v", err) |
|||
} |
|||
|
|||
for _, user := range users { |
|||
s.users[user.Username] = user |
|||
} |
|||
|
|||
return nil |
|||
} |
|||
|
|||
// GetUser returns a user by username.
|
|||
func (s *FileUserStore) GetUser(username string) (*User, error) { |
|||
s.mu.RLock() |
|||
defer s.mu.RUnlock() |
|||
|
|||
user, ok := s.users[username] |
|||
if !ok { |
|||
return nil, fmt.Errorf("user not found: %s", username) |
|||
} |
|||
|
|||
return user, nil |
|||
} |
|||
|
|||
// ValidatePassword checks if the password is valid for the user.
|
|||
func (s *FileUserStore) ValidatePassword(username string, password []byte) bool { |
|||
user, err := s.GetUser(username) |
|||
if err != nil { |
|||
return false |
|||
} |
|||
|
|||
// Compare plaintext password using constant time comparison for security
|
|||
return subtle.ConstantTimeCompare([]byte(user.Password), password) == 1 |
|||
} |
|||
|
|||
// ValidatePublicKey checks if the public key is valid for the user.
|
|||
func (s *FileUserStore) ValidatePublicKey(username string, keyData string) bool { |
|||
user, err := s.GetUser(username) |
|||
if err != nil { |
|||
return false |
|||
} |
|||
|
|||
for _, key := range user.PublicKeys { |
|||
if subtle.ConstantTimeCompare([]byte(key), []byte(keyData)) == 1 { |
|||
return true |
|||
} |
|||
} |
|||
|
|||
return false |
|||
} |
|||
|
|||
// GetUserPermissions returns the permissions for a user on a path.
|
|||
func (s *FileUserStore) GetUserPermissions(username string, path string) []string { |
|||
user, err := s.GetUser(username) |
|||
if err != nil { |
|||
return nil |
|||
} |
|||
|
|||
// Check exact path match first
|
|||
if perms, ok := user.Permissions[path]; ok { |
|||
return perms |
|||
} |
|||
|
|||
// Check parent directories
|
|||
var bestMatch string |
|||
var bestPerms []string |
|||
|
|||
for p, perms := range user.Permissions { |
|||
if strings.HasPrefix(path, p) && len(p) > len(bestMatch) { |
|||
bestMatch = p |
|||
bestPerms = perms |
|||
} |
|||
} |
|||
|
|||
return bestPerms |
|||
} |
|||
@ -0,0 +1,228 @@ |
|||
package user |
|||
|
|||
import ( |
|||
"crypto/subtle" |
|||
"encoding/json" |
|||
"fmt" |
|||
"os" |
|||
"sync" |
|||
|
|||
"golang.org/x/crypto/ssh" |
|||
) |
|||
|
|||
// FileStore implements Store using a JSON file
|
|||
type FileStore struct { |
|||
filePath string |
|||
users map[string]*User |
|||
mu sync.RWMutex |
|||
} |
|||
|
|||
// NewFileStore creates a new user store from a JSON file
|
|||
func NewFileStore(filePath string) (*FileStore, error) { |
|||
store := &FileStore{ |
|||
filePath: filePath, |
|||
users: make(map[string]*User), |
|||
} |
|||
|
|||
// Create the file if it doesn't exist
|
|||
if _, err := os.Stat(filePath); os.IsNotExist(err) { |
|||
// Create an empty users array
|
|||
if err := os.WriteFile(filePath, []byte("[]"), 0600); err != nil { |
|||
return nil, fmt.Errorf("failed to create user store file: %v", err) |
|||
} |
|||
} |
|||
|
|||
if err := store.loadUsers(); err != nil { |
|||
return nil, err |
|||
} |
|||
|
|||
return store, nil |
|||
} |
|||
|
|||
// loadUsers loads users from the JSON file
|
|||
func (s *FileStore) loadUsers() error { |
|||
s.mu.Lock() |
|||
defer s.mu.Unlock() |
|||
|
|||
data, err := os.ReadFile(s.filePath) |
|||
if err != nil { |
|||
return fmt.Errorf("failed to read user store file: %v", err) |
|||
} |
|||
|
|||
var users []*User |
|||
if err := json.Unmarshal(data, &users); err != nil { |
|||
return fmt.Errorf("failed to parse user store file: %v", err) |
|||
} |
|||
|
|||
// Clear existing users and add the loaded ones
|
|||
s.users = make(map[string]*User) |
|||
for _, user := range users { |
|||
// Process public keys to ensure they're in the correct format
|
|||
for i, keyData := range user.PublicKeys { |
|||
// Try to parse the key as an authorized key format
|
|||
pubKey, _, _, _, err := ssh.ParseAuthorizedKey([]byte(keyData)) |
|||
if err == nil { |
|||
// If successful, store the marshaled binary format
|
|||
user.PublicKeys[i] = string(pubKey.Marshal()) |
|||
} |
|||
} |
|||
s.users[user.Username] = user |
|||
|
|||
} |
|||
|
|||
return nil |
|||
} |
|||
|
|||
// saveUsers saves users to the JSON file
|
|||
func (s *FileStore) saveUsers() error { |
|||
s.mu.RLock() |
|||
defer s.mu.RUnlock() |
|||
|
|||
// Convert map to slice for JSON serialization
|
|||
var users []*User |
|||
for _, user := range s.users { |
|||
users = append(users, user) |
|||
} |
|||
|
|||
data, err := json.MarshalIndent(users, "", " ") |
|||
if err != nil { |
|||
return fmt.Errorf("failed to serialize users: %v", err) |
|||
} |
|||
|
|||
if err := os.WriteFile(s.filePath, data, 0600); err != nil { |
|||
return fmt.Errorf("failed to write user store file: %v", err) |
|||
} |
|||
|
|||
return nil |
|||
} |
|||
|
|||
// GetUser returns a user by username
|
|||
func (s *FileStore) GetUser(username string) (*User, error) { |
|||
s.mu.RLock() |
|||
defer s.mu.RUnlock() |
|||
|
|||
user, ok := s.users[username] |
|||
if !ok { |
|||
return nil, &UserNotFoundError{Username: username} |
|||
} |
|||
|
|||
return user, nil |
|||
} |
|||
|
|||
// ValidatePassword checks if the password is valid for the user
|
|||
func (s *FileStore) ValidatePassword(username string, password []byte) bool { |
|||
user, err := s.GetUser(username) |
|||
if err != nil { |
|||
return false |
|||
} |
|||
|
|||
// Compare plaintext password using constant time comparison for security
|
|||
return subtle.ConstantTimeCompare([]byte(user.Password), password) == 1 |
|||
} |
|||
|
|||
// ValidatePublicKey checks if the public key is valid for the user
|
|||
func (s *FileStore) ValidatePublicKey(username string, keyData string) bool { |
|||
user, err := s.GetUser(username) |
|||
if err != nil { |
|||
return false |
|||
} |
|||
|
|||
for _, key := range user.PublicKeys { |
|||
if key == keyData { |
|||
return true |
|||
} |
|||
} |
|||
|
|||
return false |
|||
} |
|||
|
|||
// GetUserPermissions returns the permissions for a user on a path
|
|||
func (s *FileStore) GetUserPermissions(username string, path string) []string { |
|||
user, err := s.GetUser(username) |
|||
if err != nil { |
|||
return nil |
|||
} |
|||
|
|||
// Check exact path match first
|
|||
if perms, ok := user.Permissions[path]; ok { |
|||
return perms |
|||
} |
|||
|
|||
// Check parent directories
|
|||
var bestMatch string |
|||
var bestPerms []string |
|||
|
|||
for p, perms := range user.Permissions { |
|||
if len(p) > len(bestMatch) && os.IsPathSeparator(p[len(p)-1]) && path[:len(p)] == p { |
|||
bestMatch = p |
|||
bestPerms = perms |
|||
} |
|||
} |
|||
|
|||
return bestPerms |
|||
} |
|||
|
|||
// SaveUser saves or updates a user
|
|||
func (s *FileStore) SaveUser(user *User) error { |
|||
s.mu.Lock() |
|||
s.users[user.Username] = user |
|||
s.mu.Unlock() |
|||
|
|||
return s.saveUsers() |
|||
} |
|||
|
|||
// DeleteUser removes a user
|
|||
func (s *FileStore) DeleteUser(username string) error { |
|||
s.mu.Lock() |
|||
_, exists := s.users[username] |
|||
if !exists { |
|||
s.mu.Unlock() |
|||
return &UserNotFoundError{Username: username} |
|||
} |
|||
|
|||
delete(s.users, username) |
|||
s.mu.Unlock() |
|||
|
|||
return s.saveUsers() |
|||
} |
|||
|
|||
// ListUsers returns all usernames
|
|||
func (s *FileStore) ListUsers() ([]string, error) { |
|||
s.mu.RLock() |
|||
defer s.mu.RUnlock() |
|||
|
|||
usernames := make([]string, 0, len(s.users)) |
|||
for username := range s.users { |
|||
usernames = append(usernames, username) |
|||
} |
|||
|
|||
return usernames, nil |
|||
} |
|||
|
|||
// CreateUser creates a new user with the given username and password
|
|||
func (s *FileStore) CreateUser(username, password string) (*User, error) { |
|||
s.mu.Lock() |
|||
defer s.mu.Unlock() |
|||
|
|||
// Check if user already exists
|
|||
if _, exists := s.users[username]; exists { |
|||
return nil, fmt.Errorf("user already exists: %s", username) |
|||
} |
|||
|
|||
// Create new user
|
|||
user := NewUser(username) |
|||
|
|||
// Store plaintext password
|
|||
user.Password = password |
|||
|
|||
// Add default permissions
|
|||
user.Permissions[user.HomeDir] = []string{"all"} |
|||
|
|||
// Save the user
|
|||
s.users[username] = user |
|||
if err := s.saveUsers(); err != nil { |
|||
return nil, err |
|||
} |
|||
|
|||
return user, nil |
|||
} |
|||
@ -0,0 +1,204 @@ |
|||
package user |
|||
|
|||
import ( |
|||
"context" |
|||
"fmt" |
|||
"os" |
|||
"path/filepath" |
|||
"strings" |
|||
"time" |
|||
|
|||
"github.com/seaweedfs/seaweedfs/weed/glog" |
|||
filer_pb "github.com/seaweedfs/seaweedfs/weed/pb/filer_pb" |
|||
"github.com/seaweedfs/seaweedfs/weed/util" |
|||
) |
|||
|
|||
// HomeManager handles user home directory operations
|
|||
type HomeManager struct { |
|||
filerClient FilerClient |
|||
} |
|||
|
|||
// FilerClient defines the interface for interacting with the filer
|
|||
type FilerClient interface { |
|||
WithFilerClient(streamingMode bool, fn func(client filer_pb.SeaweedFilerClient) error) error |
|||
GetDataCenter() string |
|||
AdjustedUrl(location *filer_pb.Location) string |
|||
} |
|||
|
|||
// NewHomeManager creates a new home directory manager
|
|||
func NewHomeManager(filerClient FilerClient) *HomeManager { |
|||
return &HomeManager{ |
|||
filerClient: filerClient, |
|||
} |
|||
} |
|||
|
|||
// EnsureHomeDirectory creates the user's home directory if it doesn't exist
|
|||
func (hm *HomeManager) EnsureHomeDirectory(user *User) error { |
|||
if user.HomeDir == "" { |
|||
return fmt.Errorf("user has no home directory configured") |
|||
} |
|||
|
|||
glog.V(0).Infof("Ensuring home directory exists for user %s: %s", user.Username, user.HomeDir) |
|||
|
|||
// Check if home directory exists and create it if needed
|
|||
err := hm.createDirectoryIfNotExists(user.HomeDir, user) |
|||
if err != nil { |
|||
return fmt.Errorf("failed to ensure home directory: %v", err) |
|||
} |
|||
|
|||
// Update user permissions map to include the home directory with full access if not already present
|
|||
if user.Permissions == nil { |
|||
user.Permissions = make(map[string][]string) |
|||
} |
|||
|
|||
// Only add permissions if not already present
|
|||
if _, exists := user.Permissions[user.HomeDir]; !exists { |
|||
user.Permissions[user.HomeDir] = []string{"all"} |
|||
glog.V(0).Infof("Added full permissions for user %s to home directory %s", |
|||
user.Username, user.HomeDir) |
|||
} |
|||
|
|||
return nil |
|||
} |
|||
|
|||
// createDirectoryIfNotExists creates a directory path if it doesn't exist
|
|||
func (hm *HomeManager) createDirectoryIfNotExists(dirPath string, user *User) error { |
|||
// Split the path into components
|
|||
components := strings.Split(strings.Trim(dirPath, "/"), "/") |
|||
currentPath := "/" |
|||
|
|||
for _, component := range components { |
|||
if component == "" { |
|||
continue |
|||
} |
|||
|
|||
nextPath := filepath.Join(currentPath, component) |
|||
err := hm.createSingleDirectory(nextPath, user) |
|||
if err != nil { |
|||
return err |
|||
} |
|||
|
|||
currentPath = nextPath |
|||
} |
|||
|
|||
return nil |
|||
} |
|||
|
|||
// createSingleDirectory creates a single directory if it doesn't exist
|
|||
func (hm *HomeManager) createSingleDirectory(dirPath string, user *User) error { |
|||
var dirExists bool |
|||
|
|||
err := hm.filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error { |
|||
ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second) |
|||
defer cancel() |
|||
|
|||
dir, name := util.FullPath(dirPath).DirAndName() |
|||
|
|||
// Check if directory exists
|
|||
resp, err := client.LookupDirectoryEntry(ctx, &filer_pb.LookupDirectoryEntryRequest{ |
|||
Directory: dir, |
|||
Name: name, |
|||
}) |
|||
|
|||
if err != nil || resp.Entry == nil { |
|||
// Directory doesn't exist, create it
|
|||
glog.V(0).Infof("Creating directory %s for user %s", dirPath, user.Username) |
|||
|
|||
err = filer_pb.Mkdir(hm, string(dir), name, func(entry *filer_pb.Entry) { |
|||
// Set appropriate permissions
|
|||
entry.Attributes.FileMode = uint32(0700 | os.ModeDir) // rwx------ for user
|
|||
entry.Attributes.Uid = user.Uid |
|||
entry.Attributes.Gid = user.Gid |
|||
|
|||
// Set creation and modification times
|
|||
now := time.Now().Unix() |
|||
entry.Attributes.Crtime = now |
|||
entry.Attributes.Mtime = now |
|||
|
|||
// Add extended attributes
|
|||
if entry.Extended == nil { |
|||
entry.Extended = make(map[string][]byte) |
|||
} |
|||
entry.Extended["creator"] = []byte(user.Username) |
|||
entry.Extended["auto_created"] = []byte("true") |
|||
}) |
|||
|
|||
if err != nil { |
|||
return fmt.Errorf("failed to create directory %s: %v", dirPath, err) |
|||
} |
|||
} else if !resp.Entry.IsDirectory { |
|||
return fmt.Errorf("path %s exists but is not a directory", dirPath) |
|||
} else { |
|||
dirExists = true |
|||
|
|||
// Update ownership if needed
|
|||
if resp.Entry.Attributes.Uid != user.Uid || resp.Entry.Attributes.Gid != user.Gid { |
|||
glog.V(0).Infof("Updating ownership of directory %s for user %s", dirPath, user.Username) |
|||
|
|||
entry := resp.Entry |
|||
entry.Attributes.Uid = user.Uid |
|||
entry.Attributes.Gid = user.Gid |
|||
|
|||
_, updateErr := client.UpdateEntry(ctx, &filer_pb.UpdateEntryRequest{ |
|||
Directory: dir, |
|||
Entry: entry, |
|||
}) |
|||
|
|||
if updateErr != nil { |
|||
glog.Warningf("Failed to update directory ownership: %v", updateErr) |
|||
} |
|||
} |
|||
} |
|||
|
|||
return nil |
|||
}) |
|||
|
|||
if err != nil { |
|||
return err |
|||
} |
|||
|
|||
if !dirExists { |
|||
// Verify the directory was created
|
|||
verifyErr := hm.filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error { |
|||
ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second) |
|||
defer cancel() |
|||
|
|||
dir, name := util.FullPath(dirPath).DirAndName() |
|||
resp, err := client.LookupDirectoryEntry(ctx, &filer_pb.LookupDirectoryEntryRequest{ |
|||
Directory: dir, |
|||
Name: name, |
|||
}) |
|||
|
|||
if err != nil || resp.Entry == nil { |
|||
return fmt.Errorf("directory not found after creation") |
|||
} |
|||
|
|||
if !resp.Entry.IsDirectory { |
|||
return fmt.Errorf("path exists but is not a directory") |
|||
} |
|||
|
|||
dirExists = true |
|||
return nil |
|||
}) |
|||
|
|||
if verifyErr != nil { |
|||
return fmt.Errorf("failed to verify directory creation: %v", verifyErr) |
|||
} |
|||
} |
|||
|
|||
return nil |
|||
} |
|||
|
|||
// Implement necessary methods to satisfy the filer_pb.FilerClient interface
|
|||
func (hm *HomeManager) AdjustedUrl(location *filer_pb.Location) string { |
|||
return hm.filerClient.AdjustedUrl(location) |
|||
} |
|||
|
|||
func (hm *HomeManager) GetDataCenter() string { |
|||
return hm.filerClient.GetDataCenter() |
|||
} |
|||
|
|||
// WithFilerClient delegates to the underlying filer client
|
|||
func (hm *HomeManager) WithFilerClient(streamingMode bool, fn func(client filer_pb.SeaweedFilerClient) error) error { |
|||
return hm.filerClient.WithFilerClient(streamingMode, fn) |
|||
} |
|||
@ -0,0 +1,111 @@ |
|||
// Package user provides user management functionality for the SFTP server
|
|||
package user |
|||
|
|||
import ( |
|||
"fmt" |
|||
"math/rand" |
|||
"path/filepath" |
|||
) |
|||
|
|||
// User represents an SFTP user with authentication and permission details
|
|||
type User struct { |
|||
Username string // Username for authentication
|
|||
Password string // Plaintext password
|
|||
PublicKeys []string // Authorized public keys
|
|||
HomeDir string // User's home directory
|
|||
Permissions map[string][]string // path -> permissions (read, write, list, etc.)
|
|||
Uid uint32 // User ID for file ownership
|
|||
Gid uint32 // Group ID for file ownership
|
|||
} |
|||
|
|||
// Store defines the interface for user storage and retrieval
|
|||
type Store interface { |
|||
// GetUser retrieves a user by username
|
|||
GetUser(username string) (*User, error) |
|||
|
|||
// ValidatePassword checks if the password is valid for the user
|
|||
ValidatePassword(username string, password []byte) bool |
|||
|
|||
// ValidatePublicKey checks if the public key is valid for the user
|
|||
ValidatePublicKey(username string, keyData string) bool |
|||
|
|||
// GetUserPermissions returns the permissions for a user on a path
|
|||
GetUserPermissions(username string, path string) []string |
|||
|
|||
// SaveUser saves or updates a user
|
|||
SaveUser(user *User) error |
|||
|
|||
// DeleteUser removes a user
|
|||
DeleteUser(username string) error |
|||
|
|||
// ListUsers returns all usernames
|
|||
ListUsers() ([]string, error) |
|||
} |
|||
|
|||
// UserNotFoundError is returned when a user is not found
|
|||
type UserNotFoundError struct { |
|||
Username string |
|||
} |
|||
|
|||
func (e *UserNotFoundError) Error() string { |
|||
return fmt.Sprintf("user not found: %s", e.Username) |
|||
} |
|||
|
|||
// NewUser creates a new user with default settings
|
|||
func NewUser(username string) *User { |
|||
// Generate a random UID/GID between 1000 and 60000
|
|||
// This range is typically safe for regular users in most systems
|
|||
// 0-999 are often reserved for system users
|
|||
randomId := 1000 + rand.Intn(59000) |
|||
|
|||
return &User{ |
|||
Username: username, |
|||
Permissions: make(map[string][]string), |
|||
HomeDir: filepath.Join("/home", username), |
|||
Uid: uint32(randomId), |
|||
Gid: uint32(randomId), |
|||
} |
|||
} |
|||
|
|||
// SetPassword sets a plaintext password for the user
|
|||
func (u *User) SetPassword(password string) { |
|||
u.Password = password |
|||
} |
|||
|
|||
// AddPublicKey adds a public key to the user
|
|||
func (u *User) AddPublicKey(key string) { |
|||
// Check if key already exists
|
|||
for _, existingKey := range u.PublicKeys { |
|||
if existingKey == key { |
|||
return |
|||
} |
|||
} |
|||
u.PublicKeys = append(u.PublicKeys, key) |
|||
} |
|||
|
|||
// RemovePublicKey removes a public key from the user
|
|||
func (u *User) RemovePublicKey(key string) bool { |
|||
for i, existingKey := range u.PublicKeys { |
|||
if existingKey == key { |
|||
// Remove the key by replacing it with the last element and truncating
|
|||
u.PublicKeys[i] = u.PublicKeys[len(u.PublicKeys)-1] |
|||
u.PublicKeys = u.PublicKeys[:len(u.PublicKeys)-1] |
|||
return true |
|||
} |
|||
} |
|||
return false |
|||
} |
|||
|
|||
// SetPermission sets permissions for a specific path
|
|||
func (u *User) SetPermission(path string, permissions []string) { |
|||
u.Permissions[path] = permissions |
|||
} |
|||
|
|||
// RemovePermission removes permissions for a specific path
|
|||
func (u *User) RemovePermission(path string) bool { |
|||
if _, exists := u.Permissions[path]; exists { |
|||
delete(u.Permissions, path) |
|||
return true |
|||
} |
|||
return false |
|||
} |
|||
Write
Preview
Loading…
Cancel
Save
Reference in new issue