Package: cbas
Table of ContentsAboutInstallQuickstartUsageConfig-FileLicenseAboutThis is the command line interface to the*c-bastion* jump host.
It allows you to upload an ssh-key-file and create a user on the jump-host, so
that you can log into it. It requires an initial connection to auth-server to
obtain an (open-id-connect) access token.The basic flow is as follows:+-----------------+  +-----------------+  +-----------------+
|                 |  |                 |  |                 |
|    developer    |  |    jump host    |  |   auth server   |
|                 |  |                 |  |                 |
+--------+--------+  +--------+--------+  +--------+--------+
         |                    |                    |
         +----------------------------------------->
         | request token      |                    |
         <-----------------------------------------+
         | receive token      |                    |
         |                    |                    |
         +-------------------->                    |
         | upload key         +-------------------->
         |                    | validate token     |
         |                    <--------------------+
         <--------------------+                    |
         | upload OK          |                    |
         |                    |                    |
         +-------------------->                    |
         | ssh log in         |                    |
         |                    |                    |
         |                    |                    |
         |                    |                    |
         +                    +                    +Wheredeveloperis your local machine (desktop, laptop, etc..)auth serveris the auth-server andjump hostis the jump host.cbastakes
care of obtaining the token and uploading the ssh-key.InstallUse the Python standards, for example:$pipinstallcbasQuickstartInstall the software.Ask one of your colleagues for theauth-host,client-secretandjump-hostparameters.Then run the following to upload your key:$cbas-a<AUTH-host>-s<CLIENT-SECRET>-h<JUMP-HOST>upload...Then youshouldbe able to login, using:$ssh<JUMP-HOST>...Usage$cbas--helpUsage: cbas [OPTIONS] COMMAND [ARGS]...

Options:
  -v, --verbose                   Activate verbose mode.
  -c, --config <config_path>      Path to config file. Default: '~/.cbas'.
  -u, --username <username>       Username. Default: the logged in user.
  -k, --ssh-key-file <key-file>   SSH Identity to use. Default:
                                  '~/.ssh/id_rsa.pub'.
  -p, --password-provider <provider>
                                  Password provider. Default: 'prompt'.
  -s, --client-secret <secret>    Special client secret, ask mum.
  -a, --auth-host <host>          Auth-server host.
  -h, --jump-host <host>          Jump host to connect with.
  --version                       Print version and exit.
  --help                          Show this message and exit.

Commands:
  delete  Delete user.
  dry_run Dry run, sanitize all config only.
  upload  Upload ssh-key and create user.OptionsverboseThis switch activates verbose output, useful in case you are debuggingconfigThe path to the config file. Note, since we are using theyamlreaderpackage, this could
also be a directory with multiple config files. Also, the config is in YAML
syntax, see below.usernameThe username when communicating with the auth-server. Note that the
returned token contains the authenticated username which is subsequently
sent to the jump-host. Thus you will not be able to create arbitrary users
on the jump-hostssh-key-filePath to thepublicssh-key-file. This will be uploaded to the jump-host.password-providerWhere to get the password from. Valid values arepromptandkeyring(andtesting).promptwill always ask for a password, whereaskeyringwill ask exactly once and then store the password in the system
keyring.auth-hostThe hostname of the auth-server. E.gauth-server.example. (Note that, by
default this will usehttps://as scheme and/oauth/tokenas
endpoint. However, explict urls, e.g.http://auth-server.exampleand
explicit endpoints e.g.auth-server.example/special/id/authare
tolerated.)client-secretA special client secret string needed when communicating with the
auth-server.jump-hostThe hostname of the jump-host. E.g.jump-host.example. (Note that, by
default this will usehttps://. However, explict urls, e.g.http://jump-host.exampleare tolerated.)versionDisplay version number and exit.helpDisplay help and exit.SubcommandsuploadUpload ssh-key-file and create user.dry_runSanitize and aggregate all options from config-file and command-line. Don’t
connect to anything.deleteDelete your user again. For example: if you uploaded the wrong ssh-key-file.Config-Filecbasis equipped with a powerful configuration mechanism. All relevant
parameters that can be supplied on the command-line can also be supplied in the
config-file, for example:username:acid_burnssh-key-file:~/.ssh/mykey_rsa.pubauth-host auth-server.exampleclient-secret:mysupersecretpassword-provider:keyringjump-host:jump-host.examplePlease note that, any parameters supplied on the command line will take
precedence over those supplied via the config-file. If in doubt, try using the--verboseswitch.LicenseCopyright 2016 Immobilien Scout GmbHLicensed under the Apache License, Version 2.0 (the “License”); you may not use
this file except in compliance with the License. You may obtain a copy of the
License athttp://www.apache.org/licenses/LICENSE-2.0Unless required by applicable law or agreed to in writing, software distributed
under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR
CONDITIONS OF ANY KIND, either express or implied. See the License for the
specific language governing permissions and limitations under the License.