From 18ffb9690cec3742f709950c6530f9780dbd0d7b Mon Sep 17 00:00:00 2001 From: Georg Haas Date: Mon, 8 Feb 2021 23:37:10 +0100 Subject: [PATCH 1/2] nixos/uptermd: init --- .../from_md/release-notes/rl-2205.section.xml | 8 ++ .../manual/release-notes/rl-2205.section.md | 2 + nixos/modules/module-list.nix | 1 + nixos/modules/services/networking/uptermd.nix | 106 ++++++++++++++++++ 4 files changed, 117 insertions(+) create mode 100644 nixos/modules/services/networking/uptermd.nix diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml index ab0edcebc679..d2565c10eefd 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml @@ -323,6 +323,14 @@ services.tetrd. + + + uptermd, an + open-source solution for sharing terminal sessions instantly + over the public internet via secure tunnels. Available at + services.uptermd. + + agate, diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md index af65ae461312..c029dd76d23e 100644 --- a/nixos/doc/manual/release-notes/rl-2205.section.md +++ b/nixos/doc/manual/release-notes/rl-2205.section.md @@ -99,6 +99,8 @@ In addition to numerous new and upgraded packages, this release has the followin - [tetrd](https://tetrd.app), share your internet connection from your device to your PC and vice versa through a USB cable. Available at [services.tetrd](#opt-services.tetrd.enable). +- [uptermd](https://upterm.dev), an open-source solution for sharing terminal sessions instantly over the public internet via secure tunnels. Available at [services.uptermd](#opt-services.uptermd.enable). + - [agate](https://github.com/mbrubeck/agate), a very simple server for the Gemini hypertext protocol. Available as [services.agate](options.html#opt-services.agate.enable). - [ArchiSteamFarm](https://github.com/JustArchiNET/ArchiSteamFarm), a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Available as [services.archisteamfarm](options.html#opt-services.archisteamfarm.enable). diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index b3efa5d5e6fd..7b681ecffb27 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -936,6 +936,7 @@ ./services/networking/unifi.nix ./services/video/unifi-video.nix ./services/video/rtsp-simple-server.nix + ./services/networking/uptermd.nix ./services/networking/v2ray.nix ./services/networking/vsftpd.nix ./services/networking/wasabibackend.nix diff --git a/nixos/modules/services/networking/uptermd.nix b/nixos/modules/services/networking/uptermd.nix new file mode 100644 index 000000000000..072f561f5c3c --- /dev/null +++ b/nixos/modules/services/networking/uptermd.nix @@ -0,0 +1,106 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.services.uptermd; +in +{ + options = { + services.uptermd = { + enable = mkEnableOption "uptermd"; + + openFirewall = mkOption { + type = types.bool; + default = false; + description = '' + Whether to open the firewall for the port in . + ''; + }; + + port = mkOption { + type = types.port; + default = 2222; + description = '' + Port the server will listen on. + ''; + }; + + listenAddress = mkOption { + type = types.str; + default = "[::]"; + example = "127.0.0.1"; + description = '' + Address the server will listen on. + ''; + }; + + hostKey = mkOption { + type = types.nullOr types.path; + default = null; + example = "/run/keys/upterm_host_ed25519_key"; + description = '' + Path to SSH host key. If not defined, an ed25519 keypair is generated automatically. + ''; + }; + + extraFlags = mkOption { + type = types.listOf types.str; + default = []; + example = [ "--debug" ]; + description = '' + Extra flags passed to the uptermd command. + ''; + }; + }; + }; + + config = mkIf cfg.enable { + networking.firewall = mkIf cfg.openFirewall { + allowedTCPPorts = [ cfg.port ]; + }; + + systemd.services.uptermd = { + description = "Upterm Daemon"; + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; + + path = [ pkgs.openssh ]; + + preStart = mkIf (cfg.hostKey == null) '' + if ! [ -f ssh_host_ed25519_key ]; then + ssh-keygen \ + -t ed25519 \ + -f ssh_host_ed25519_key \ + -N "" + fi + ''; + + serviceConfig = { + StateDirectory = "uptermd"; + WorkingDirectory = "/var/lib/uptermd"; + ExecStart = "${pkgs.upterm}/bin/uptermd --ssh-addr ${cfg.listenAddress}:${toString cfg.port} --private-key ${if cfg.hostKey == null then "ssh_host_ed25519_key" else cfg.hostKey} ${concatStringsSep " " cfg.extraFlags}"; + + # Hardening + AmbientCapabilities = mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ]; + CapabilityBoundingSet = mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ]; + PrivateUsers = cfg.port >= 1024; + LockPersonality = true; + MemoryDenyWriteExecute = true; + PrivateDevices = true; + ProtectClock = true; + ProtectControlGroups = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]; + RestrictNamespaces = true; + RestrictRealtime = true; + SystemCallArchitectures = "native"; + SystemCallFilter = "@system-service"; + }; + }; + }; +} From cd7e4a1b3285e403d76830936013dca8e303dab8 Mon Sep 17 00:00:00 2001 From: fleaz Date: Thu, 17 Mar 2022 17:57:23 +0100 Subject: [PATCH 2/2] nixos/tests/uptermd: init --- nixos/tests/all-tests.nix | 1 + nixos/tests/uptermd.nix | 62 ++++++++++++++++++++++++++++++ pkgs/tools/misc/upterm/default.nix | 3 ++ 3 files changed, 66 insertions(+) create mode 100644 nixos/tests/uptermd.nix diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 0c085b64efa9..776fbb3f12ac 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -574,6 +574,7 @@ in unifi = handleTest ./unifi.nix {}; unit-php = handleTest ./web-servers/unit-php.nix {}; upnp = handleTest ./upnp.nix {}; + uptermd = handleTest ./uptermd.nix {}; usbguard = handleTest ./usbguard.nix {}; user-activation-scripts = handleTest ./user-activation-scripts.nix {}; uwsgi = handleTest ./uwsgi.nix {}; diff --git a/nixos/tests/uptermd.nix b/nixos/tests/uptermd.nix new file mode 100644 index 000000000000..b2ff9a1e0d9c --- /dev/null +++ b/nixos/tests/uptermd.nix @@ -0,0 +1,62 @@ +import ./make-test-python.nix ({ pkgs, ...}: + +let + client = {pkgs, ...}:{ + environment.systemPackages = [ pkgs.upterm ]; + }; +in +{ + name = "uptermd"; + meta = with pkgs.lib.maintainers; { + maintainers = [ fleaz ]; + }; + + nodes = { + server = {config, ...}: { + services.uptermd = { + enable = true; + openFirewall = true; + port = 1337; + }; + }; + client1 = client; + client2 = client; + }; + + + testScript = '' + start_all() + + server.wait_for_unit("uptermd.service") + server.wait_for_unit("network-online.target") + + # Add SSH hostkeys from the server to both clients + # uptermd needs an '@cert-authority entry so we need to modify the known_hosts file + client1.execute("sleep 3; mkdir -p ~/.ssh && ssh -o StrictHostKeyChecking=no -p 1337 server ls") + client1.execute("echo @cert-authority $(cat ~/.ssh/known_hosts) > ~/.ssh/known_hosts") + client2.execute("sleep 3; mkdir -p ~/.ssh && ssh -o StrictHostKeyChecking=no -p 1337 server ls") + client2.execute("echo @cert-authority $(cat ~/.ssh/known_hosts) > ~/.ssh/known_hosts") + + client1.wait_for_unit("multi-user.target") + client1.wait_until_succeeds("pgrep -f 'agetty.*tty1'") + client1.wait_until_tty_matches(1, "login: ") + client1.send_chars("root\n") + client1.wait_until_succeeds("pgrep -u root bash") + + client1.execute("ssh-keygen -t ed25519 -N \"\" -f /root/.ssh/id_ed25519") + client1.send_chars("TERM=xterm upterm host --server ssh://server:1337 --force-command hostname -- bash > /tmp/session-details\n") + client1.wait_for_file("/tmp/session-details") + client1.send_key("q") + + # uptermd can't connect if we don't have a keypair + client2.execute("ssh-keygen -t ed25519 -N \"\" -f /root/.ssh/id_ed25519") + + # Grep the ssh connect command from the output of 'upterm host' + ssh_command = client1.succeed("grep 'SSH Session' /tmp/session-details | cut -d':' -f2-").strip() + + # Connect with client2. Because we used '--force-command hostname' we should get "client1" as the output + output = client2.succeed(ssh_command) + + assert output.strip() == "client1" + ''; +}) diff --git a/pkgs/tools/misc/upterm/default.nix b/pkgs/tools/misc/upterm/default.nix index c392dd280272..fe4ac3599a76 100644 --- a/pkgs/tools/misc/upterm/default.nix +++ b/pkgs/tools/misc/upterm/default.nix @@ -2,6 +2,7 @@ , buildGo118Module , fetchFromGitHub , installShellFiles +, nixosTests }: buildGo118Module rec { @@ -29,6 +30,8 @@ buildGo118Module rec { doCheck = true; + passthru.tests = { inherit (nixosTests) uptermd; }; + __darwinAllowLocalNetworking = true; meta = with lib; {