Giter VIP home page Giter VIP logo

script-server's Introduction

Build Status Gitter

script-server

Script-server is a Web UI for scripts.

As an administrator, you add your existing scripts into Script server and other users would be able to execute them via a web interface. The UI is very straightforward and can be used by non-tech people.

No script modifications are needed - you configure each script in Script server and it creates the corresponding UI with parameters and takes care of validation, execution, etc.

DEMO server

Admin interface screenshots

Features

  • Different types of script parameters (text, flag, dropdown, file upload, etc.)
  • Real-time script output
  • Users can send input during script execution
  • Auth (optional): LDAP, Google OAuth, htpasswd file
  • Access control
  • Alerts
  • Logging and auditing
  • Formatted output support (colors, styles, cursor positioning, clearing)
  • Download of script output files
  • Execution history
  • Admin page for script configuration

For more details check how to configure a script or how to configure the server

Requirements

Server-side

Python 3.7 or higher with the following modules:

  • Tornado 5 / 6

Some features can require additional modules. Such requirements are specified in a corresponding feature description.

OS support:

  • Linux (main). Tested and working on Debian 10,11
  • Windows (additional). Light testing
  • macOS (additional). Light testing

Client-side

Any more or less up to date browser with enabled JS

Internet connection is not needed. All the files are loaded from the server.

Installation

For production

  1. Download script-server.zip file from Latest release or Dev release
  2. Create script-server folder anywhere on your PC and extract zip content to this folder

(For detailed steps on linux with virtualenv, please see Installation guide)

As a docker container

Please find pre-built images here: https://hub.docker.com/r/bugy/script-server/tags
For the usage please check this ticket

For development

  1. Clone/download the repository
  2. Run 'tools/init.py --no-npm' script

init.py script should be run after pulling any new changes

If you are making changes to web files, use npm run build or npm run serve

A issue running on OpenBSD and maybe other UNIX systems

See A issue running on OpenBSD and maybe other UNIX systems.

Setup and run

  1. Create configurations for your scripts in conf/runners/ folder (see script config page for details)
  2. Launch launcher.py from script-server folder
  • Windows command: launcher.py
  • Linux command: ./launcher.py
  1. Add/edit scripts on the admin page

By default, the server will run on http://localhost:5000

Server config

All the features listed above and some other minor features can be configured in conf/conf.json file. It is allowed not to create this file. In this case, default values will be used. See server config page for details

Admin panel

Admin panel is accessible on admin.html page (e.g. http://localhost:5000/admin.html)

Logging

All web/operating logs are written to the logs/server.log Additionally each script logs are written to separate file in logs/processes. File name format is {script_name}_{client_address}_{date}_{time}.log.

Testing/demo

Script-server has bundled configs/scripts for testing/demo purposes, which are located in samples folder. You can link/copy these config files (samples/configs/*.json) to server config folder (conf/runners).

Security

I do my best to make script-server secure and invulnerable to attacks, injections or user data security. However to be on the safe side, it's better to run Script server only on a trusted network.
Any security leaks report or recommendations are greatly appreciated!

Shell commands injection

Script server guarantees that all user parameters are passed to an executable script as arguments and won't be executed under any conditions. There is no way to inject fraud command from a client-side. However, user parameters are not escaped, so scripts should take care of not executing them also (general recommendation for bash is at least to wrap all arguments in double-quotes). It's recommended to use typed parameters when appropriate, because they are validated for proper values and so they are harder to be subject of commands injection. Such attempts would be easier to detect also.

Important! Command injection protection is fully supported for Linux, but only for .bat and .exe files on Windows

XSS and CSRF

(v1.0 - v1.16)
Script server is vulnerable to these attacks.

(v1.17+)
Script server is protected against XSRF attacks via a special token.
XSS protection: the code is written according to OWASP Cheat Sheet and the only known vulnerabilities are:

  • output_format=html_iframe, see the reasoning in the linked Wiki page

Contribution

If you like the project and think you could help with making it better, there are many ways you can do it:

  • Create a new issue for new feature proposal or a bug
  • Implement existing issues (there are quite some of them: frontend/backend, simple/complex, choose whatever you like)
  • Help with improving the documentation
  • Set up a demo server
  • Spread a word about the project to your colleagues, friends, blogs or any other channels
  • Any other things you could imagine

Any contribution would be of great help and I will highly appreciate it! If you have any questions, please create a new issue, or contact me via [email protected]

Asking questions

If you have any questions, feel free to:

Special thanks

JetBrains logo

script-server's People

Contributors

andrewheberle avatar annashepa avatar anthony-francisco avatar bruno-amelco avatar bugy avatar chihhao-su avatar conway avatar dependabot[bot] avatar dnrce avatar drehelis avatar eduardschwarzkopf avatar gpsinghsandhu avatar guria avatar jthacker avatar jtprof avatar miksir avatar oktorok avatar pierok13 avatar playpauseandstop avatar rollinghog avatar sfordinc avatar urekd avatar vnghia avatar wowselim avatar yog27ray avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

script-server's Issues

Back button is not working

When you press back button in browser, the URL changes, but the page is not updated

(at least in Chrome)

[feature] Remove spaces from script names in URL

Currently script names used as a hashes in the URL. However linking such pages to other people looks bad: either the link will be cut at the first space or spaces will be urlencoded (decreasing readability). So all spaces should be replaced with some other symbol (e.g. underscore).

Backward compatibility should be supported, i.e. old links should still work after this feature.

[feature] Change IP to hostname in process logs

Currently, for each script run, log file is created, and it contains caller IP in the name.
However hostname can provide more information at a glance, so if hostname can be acquired, it should be used for filename.
Also, main log file should log both caller IP and hostname.

[feature] Make terminal mode default

Since it's hard to predict, whether used commands in the script behave differently, being invoked in terminal, it should be better to launch all the scripts in terminal mode by default.

See some more info in my comment in #2 (comment)

Remove fcntl dependency on windows

In #28 was fixed blocking os.read, but the fix depends on the fcntl module, which is available only for linux.
This module shouldn't be used for windows

Logging of execution log

Currently execution log is sent only to web page and not logged anywhere.
It should be logged somewhere, so it will be possible to analyze what was happening.

[feature] Add LDAP authorization support

LDAP authorization should be configurable using web.json file.
For this new config section should be added, which should look like:
{
...
"authorization": {
"type": "LDAP",
"config": {
//some LDAP based config parameters
}
}
}

Add support for scripts output colors (for Linux)

Scripts can produce output with colouring mode (e.g. grep --color ..). Script server should show such output as colored as well.
Currently such output is shown like:
�[01;31m�[KI'm called�[m�[K
So we need to decode the color and create corresponding coloring at the web GUI for such blocks.
Both font and background can be colored.

For testing purposes we can extend Write to file script, with showing all occurences (including old ones) of the added text with different color. Like changing the last line of the script to:
cat ~/simple.txt | grep --color=always -E "$text|$"
And possible show some other information with different background.

[bug] sometimes script opening fails

How to reproduce:
open a config with a lot of parameters and update the page untill error occurs

Web console exception:
Uncaught TypeError: this.validate is not a function

[feature] allow omitting of parameter's "param"

If you have a script, which is reading input values by order (e.g. in bash: var1=$1), rather than by parameters (e.g. "script.sh -p val"), it's useful just to omit "param" in the parameter configuration.

[bug] Launching scripts sometimes causes exception and hanging request on GUI

Error log:

2016-08-11 17:25:00,831 [scriptServer.INFO] Calling script: ...
2016-08-11 17:25:00,851 [tornado.access.INFO] 200 POST /scripts/execute (...) 120.47ms
Exception in thread Thread-58:
Traceback (most recent call last):
File "/usr/lib/python3.5/threading.py", line 914, in _bootstrap_inner
self.run()
File "/usr/lib/python3.5/threading.py", line 862, in run
self._target(_self._args, *_self._kwargs)
File "/home/shepilov/DEV/github/script-server/execution.py", line 176, in pipe_process_output
if data and (self.encoding.lower() == "utf-8"):
AttributeError: 'NoneType' object has no attribute 'lower'

[feature] Add possiblity to run via SSL

Currently script server is working via plain HTTP only. There should be possilibility to turn on HTTPS.

Proposal:

  1. Add conf folder
  2. Read web.json configuration from conf folder
  3. If ssl parameter exists there, read key and cert paths from it
  4. Start http server with ssl config, on the port 5443
  5. Add port parameter to web.conf file, which will allow to override default port
  6. Move current script configurations locations to conf/runners

Additionally: test on windows

Fix Windows incompatibility issues

Currently script server is not running on windows because of different issues (paths, modules, working with processes, etc.). This should be fixed

[feature] improve process log with better information

PID in filename makes not much sense, since it won't help to find the proper file at all. However the running host for example or time will help.

It should be understood how this log file can be improve and implemented

Show that script has finished faster

There should be less than 0.1s delay after the script has finished and UI updates correspondingly (currently it means that ExecuteButton should be unlocked, and StopButton should be locked)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.