Feature/332 kms key auth

.env.example

@@ -35,3 +35,8 @@ AUTH_ENABLED: false
 OIDC_PROVIDER: "https://authentikuri:9443/application/o/soarca/"
 OIDC_CLIENT_ID: "some client ID"
 OIDC_SKIP_TLS_VERIFY: false
+
+# SSH Key Management
+ENABLE_SSH_KMS: false
+SSH_KMS_DIR: "deployments/docker/testing/ssh-kms-test/ssh-keystore/"
+

.github/workflows/ci.yml

@@ -59,10 +59,16 @@ jobs:
       - name: Install swaggo
         run:  go install github.com/swaggo/swag/cmd/swag@latest  
         timeout-minutes: 12
-      - name: Start docker containers for test
+      - name: Start docker container for http test
         run: docker compose -f "deployments/docker/testing/httpbin-test/docker-compose.yml" up -d --build
+      - name: Start docker container for ssh test
+        run: docker compose -f "deployments/docker/testing/ssh-test/docker-compose.yml" up -d --build
+      - name: Start docker container for kms test
+        run: |
+          docker compose -f "deployments/docker/testing/ssh-kms-test/docker-compose.yml" up -d --build
+          docker compose -f "deployments/docker/testing/ssh-kms-test/docker-compose.yml" cp ssh_kms_server:/test deployments/docker/testing/ssh-kms-test
+          docker compose -f "deployments/docker/testing/ssh-kms-test/docker-compose.yml" cp ssh_kms_server:/test.pub deployments/docker/testing/ssh-kms-test
       - name: Run tests
         run: |
-          docker compose -f "deployments/docker/testing/ssh-test/docker-compose.yml" up -d --build
           make ci-test
 

.gitignore

@@ -12,6 +12,7 @@ bin/*
 api/*
 **.env
 test/cacao/flatfile-db-example.json
+pkg/core/capability/ssh/.ssh_test/
 
 
 docs/public

deployments/docker/testing/ssh-kms-test/Dockerfile

@@ -0,0 +1,21 @@
+FROM ubuntu:latest 
+
+RUN apt update && apt install  openssh-server sudo -y
+
+RUN sudo useradd -m sshtest
+
+RUN ssh-keygen -q -N "" -f /test
+
+RUN mkdir -p /home/sshtest/.ssh/
+
+RUN cat /test.pub > /home/sshtest/.ssh/authorized_keys
+
+RUN echo "PasswordAuthentication no" >> /etc/ssh/sshd_config
+
+RUN echo "PubkeyAuthentication yes" >> /etc/ssh/sshd_config
+
+RUN sudo service ssh start
+
+EXPOSE 22
+
+CMD ["sudo","/usr/sbin/sshd","-D"]

deployments/docker/testing/ssh-kms-test/docker-compose.yml

@@ -0,0 +1,8 @@
+ services:  
+  ssh_kms_server:
+    container_name: ssh_kms_server
+    build:
+      dockerfile: Dockerfile
+    ports:
+      - 2223:22
+

docs/static/openapi/swagger.json

@@ -37,7 +37,7 @@
         },
         "/keymanagement/:keyname/": {
             "put": {
-                "description": "adds a key to the KMS; load key into cache and write file",
+                "description": "adds a key to the KMS; load key into cache and write to database",
                 "produces": [
                     "application/json"
                 ],
@@ -94,18 +94,27 @@
                         }
                     }
                 }
-            }
-        },
-        "/keymanagement/refresh/": {
-            "post": {
-                "description": "refresh the KMS and re-parse the underlying directory",
+            },
+            "patch": {
+                "description": "update a key in the KMS; load key into cache and write to database",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
                     "keymanagement"
                 ],
-                "summary": "refresh the KMS system, which allows the user to include manually added files in the KMS",
+                "summary": "update key in KMS",
+                "parameters": [
+                    {
+                        "description": "key",
+                        "name": "data",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/api.KeyManagementKey"
+                        }
+                    }
+                ],
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -773,6 +782,9 @@
         "api.KeyManagementKey": {
             "type": "object",
             "properties": {
+                "passphrase": {
+                    "type": "string"
+                },
                 "private": {
                     "type": "string"
                 },

docs/static/openapi/swagger.yaml

@@ -75,6 +75,8 @@ definitions:
     type: object
   api.KeyManagementKey:
     properties:
+      passphrase:
+        type: string
       private:
         type: string
       public:
@@ -773,8 +775,8 @@ paths:
       summary: remove key from KMS
       tags:
       - keymanagement
-    put:
-      description: adds a key to the KMS; load key into cache and write file
+    patch:
+      description: update a key in the KMS; load key into cache and write to database
       parameters:
       - description: key
         in: body
@@ -793,12 +795,18 @@ paths:
           description: Bad Request
           schema:
             $ref: '#/definitions/api.Error'
-      summary: add key to KMS
+      summary: update key in KMS
       tags:
       - keymanagement
-  /keymanagement/refresh/:
-    post:
-      description: refresh the KMS and re-parse the underlying directory
+    put:
+      description: adds a key to the KMS; load key into cache and write to database
+      parameters:
+      - description: key
+        in: body
+        name: data
+        required: true
+        schema:
+          $ref: '#/definitions/api.KeyManagementKey'
       produces:
       - application/json
       responses:
@@ -810,8 +818,7 @@ paths:
           description: Bad Request
           schema:
             $ref: '#/definitions/api.Error'
-      summary: refresh the KMS system, which allows the user to include manually added
-        files in the KMS
+      summary: add key to KMS
       tags:
       - keymanagement
   /manual/:

examples/ssh-kms-playbook.json

@@ -0,0 +1,117 @@
+{
+    "type": "playbook",
+    "spec_version": "cacao-2.0",
+    "id": "playbook--300270f9-0e64-42c8-93cc-0927edbe3ae7",
+    "name": "Example ssh",
+    "description": "This playbook demonstrates ssh functionality",
+    "playbook_types": [
+        "notification"
+    ],
+    "created_by": "identity--96abab60-238a-44ff-8962-5806aa60cbce",
+    "created": "2023-11-20T15:56:00.123456Z",
+    "modified": "2023-11-20T15:56:00.123456Z",
+    "valid_from": "2023-11-20T15:56:00.123456Z",
+    "valid_until": "2123-11-20T15:56:00.123456Z",
+    "priority": 1,
+    "severity": 1,
+    "impact": 1,
+    "labels": [
+        "soarca",
+        "ssh",
+        "example"
+    ],
+    "authentication_info_definitions": {
+        "user-auth--b7ddc2ea-9f6a-4e82-8eaa-be202e942090": {
+            "type": "user-auth",
+            "kms":true,
+            "kms_key_identifier": "test",
+            "username": "linuxserver.io"
+        }
+    },
+    "agent_definitions": {
+        "soarca--00010001-1000-1000-a000-000100010001": {
+            "type": "soarca",
+            "name": "soarca-ssh"
+        }
+    },
+    "target_definitions": {
+        "ssh--1c3900b4-f86b-430d-b415-12312b9e31f4": {
+            "type": "ssh",
+            "name": "system 1",
+            "address": {
+                "ipv4": [
+                    "127.0.0.1"
+                ]
+            },
+            "port": "2223",
+            "authentication_info": "user-auth--b7ddc2ea-9f6a-4e82-8eaa-be202e942090"
+        }
+    },
+    "external_references": [
+        {
+            "name": "TNO COSSAS",
+            "description": "TNO COSSAS",
+            "source": "TNO COSSAS",
+            "url": "https://cossas-project.org"
+        }
+    ],
+    "workflow_start": "start--9e7d62b2-88ac-4656-94e1-dbd4413ba008",
+    "workflow_exception": "end--a6f0b81e-affb-4bca-b4f6-a2d5af908958",
+    "workflow": {
+        "start--9e7d62b2-88ac-4656-94e1-dbd4413ba008": {
+            "type": "start",
+            "name": "Start ssh example",
+            "on_completion": "action--eb9372d4-d524-49fc-bf24-be26ea084779"
+        },
+        "action--eb9372d4-d524-49fc-bf24-be26ea084779": {
+            "type": "action",
+            "name": "Execute command",
+            "description": "Execute command specified in variable",
+            "on_completion": "action--88f4c4df-fa96-44e6-b310-1c06d193ea55",
+            "commands": [
+                {
+                    "type": "ssh",
+                    "command": "__command__:value"
+                }
+            ],
+            "targets": [
+                "ssh--1c3900b4-f86b-430d-b415-12312b9e31f4"
+            ],
+            "agent": "soarca--00010001-1000-1000-a000-000100010001",
+            "step_variables": {
+                "__command__": {
+                    "type": "string",
+                    "value": "ls -la",
+                    "constant": true
+                }
+            }
+        },
+        "action--88f4c4df-fa96-44e6-b310-1c06d193ea55": {
+            "type": "action",
+            "name": "Touch file",
+            "description": "Touch file at path specified by variable",
+            "on_completion": "end--a6f0b81e-affb-4bca-b4f6-a2d5af908958",
+            "commands": [
+                {
+                    "type": "ssh",
+                    "command": "touch __path__:value"
+                }
+            ],
+            "targets": [
+                "ssh--1c3900b4-f86b-430d-b415-12312b9e31f4"
+            ],
+            "agent": "soarca--00010001-1000-1000-a000-000100010001",
+            "step_variables": {
+                "__path__": {
+                    "type": "string",
+                    "value": "touchy",
+                    "constant": true
+                }
+            }
+        },
+        "end--a6f0b81e-affb-4bca-b4f6-a2d5af908958": {
+            "type": "end",
+            "name": "End Flow"
+        }
+    }
+}

go.mod

@@ -20,6 +20,7 @@ require (
 	github.com/stretchr/testify v1.10.0
 	github.com/swaggo/files v1.0.1
 	github.com/swaggo/gin-swagger v1.6.0
+	github.com/swaggo/swag v1.16.1
 	go.mongodb.org/mongo-driver v1.12.1
 	golang.org/x/crypto v0.52.0
 )
@@ -76,7 +77,6 @@ require (
 	github.com/pelletier/go-toml/v2 v2.2.2 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
-	github.com/swaggo/swag v1.16.1 // indirect
 	github.com/tidwall/transform v0.0.0-20201103190739-32f242e2dbde // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.2.12 // indirect