selfAddPersonalAccess

Add a personal server access on your account

usage

--osh selfAddPersonalAccess --host HOST [OPTIONS]

--host IP|HOST|IP/MASK

Server to add access to

--user USER

Remote login to use, if you want to allow any login, use --user-any

--user-any

Allow access with any remote login

--port PORT

Remote SSH port to use, if you want to allow any port, use --port-any

--port-any

Allow access to all remote ports

--scpup

Allow SCP upload, you--bastion-->server (omit --user in this case)

--scpdown

Allow SCP download, you<--bastion--server (omit --user in this case)

--sftp

Allow usage of the SFTP subsystem, you<--bastion-->server (omit --user in this case)

--force

Add the access without checking that the public SSH key is properly installed remotely

--force-key FINGERPRINT

Only use the key with the specified fingerprint to connect to the server (cf selfListEgressKeys)

--force-password HASH

Only use the password with the specified hash to connect to the server (cf selfListPasswords)

--ttl SECONDS|DURATION

Specify a number of seconds (or a duration string, such as "1d7h8m") after which the access will automatically expire

--comment "'ANY TEXT'"

Add a comment alongside this server. Quote it twice as shown if you're under a shell.

Plugin configuration

Options

widest_v4_prefix (optional, integer, between 0 and 32)

When specified, this limits the size of prefixes that can be added to an ACL, e.g. 24 would not allow prefixes wider than /24 (such as /20 or /16). Note that this doesn't prevent users from adding thousands of ACLs to cover a wide range of networks, but this helps ensuring ACLs such as 0.0.0.0/0 can't be added in a single command.

self_remote_user_only (optional, boolean)

When true, this only allows to add ACLs with the remote user being the same than the account name, i.e. a bastion account named "johndoe" would only be able to use selfAddPersonalAccess --user johndoe.

Example

Configuration, in JSON format, must be in /etc/bastion/plugin.selfAddPersonalAccess.conf:

{ "widest_v4_prefix": 24, "self_remote_user_only": true }