am-at-enrollvbandGitHub
5dd34275dc
The auth proxy was only given the user and their password or public key, so a proxy program had no way to restrict logins to particular networks, or to record where an authentication attempt came from. The JSON sent to the program now has a client_ip key holding the bare IP the client connected from, with the port stripped so IPv6 arrives as 2001:db8::1 rather than [2001:db8::1]:52344. An IPv4-mapped IPv6 address is reported as plain IPv4 so that a client arriving over a dual-stack listener still matches IPv4 networks. The key is omitted when the client has no IP address. The IP is also mixed into the backend cache key. That is needed as the program is only run on a cache miss, so a client from a non-allowlisted address presenting valid credentials within the 5 minute cache lifetime would get a cache hit and be let in without the program being consulted at all.
42 lines
1.1 KiB
Python
Executable File
42 lines
1.1 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""
|
|
A demo proxy for rclone serve sftp/webdav/ftp, etc.
|
|
|
|
This takes the incoming user/pass and converts it into an sftp backend
|
|
running on localhost.
|
|
|
|
Logins from outside ALLOWED_NETWORKS are refused.
|
|
"""
|
|
|
|
import sys
|
|
import json
|
|
import ipaddress
|
|
|
|
ALLOWED_NETWORKS = ["127.0.0.0/8", "::1/128"]
|
|
|
|
def allowed(ip):
|
|
"""Return True if ip is in one of ALLOWED_NETWORKS."""
|
|
if ip is None:
|
|
return False
|
|
address = ipaddress.ip_address(ip)
|
|
return any(address in ipaddress.ip_network(network) for network in ALLOWED_NETWORKS)
|
|
|
|
def main():
|
|
i = json.load(sys.stdin)
|
|
# Exiting non zero refuses the login - rclone logs whatever we
|
|
# write on stderr, so say why.
|
|
if not allowed(i.get("client_ip")):
|
|
sys.exit("client_ip %s not allowed" % i.get("client_ip"))
|
|
o = {
|
|
"type": "sftp", # type of backend
|
|
"_root": "", # root of the fs
|
|
"_obscure": "pass", # comma sep list of fields to obscure
|
|
"user": i["user"],
|
|
"pass": i["pass"],
|
|
"host": "127.0.0.1",
|
|
}
|
|
json.dump(o, sys.stdout, indent="\t")
|
|
|
|
if __name__ == "__main__":
|
|
main()
|