Giter VIP home page Giter VIP logo

rce-agent's Introduction

RCE Agent

Build and Tests Go Report Card Go Reference

rce-agent is a gRPC-based Remote Command Execution (RCE) client and server. The server (or "agent") runs on a remote host and executes a whitelist of shell commands specified in a file. The client calls the agent to execute whitelist commands. TLS is used to secure and authenticate both client and server.

rce-agent replaces SSH and other methods of remote code execution. There are no passwords—only TLS certificates—and commands are limited to a whitelist. This eliminates the need for SSH keys, passwords, or forwarding.

RCE Agent diagram

This package is meant to be integrated into your code. The rce.Client and rce.Server objects do all the heavy lifting so your client and agent code can focus on their domain-specific logic. See example/ for example code.

RCE Agent is also meant to be used with your private certificate authority (CA) for TLS-encrypted communication and mutual authentication of client and agent. (Setting up a private CA is beyond the scope of this project, but we highly suggest you use one!) Normally, only the client verifies the server's TLS certificate (cert). For additional security, your code should use rce.TLSFiles to create Go tls.Config which makes the server (agent) verify the client's cert, too.

rce-agent's People

Contributors

brianip avatar bwester avatar cuzelac avatar daniel-nichter avatar dependabot[bot] avatar haydenmuhl avatar michael-finch avatar michaelfinch avatar mpuncel avatar ricardolsmendes avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

rce-agent's Issues

The example server fails inside container

First of all, thanks for making this useful project open source! 👏

I'm trying to run the example server inside a Docker container but didn't succeed. The example client was able to establish a connection, but got the error below:

2020/06/15 22:43:41 Connecting to 127.0.0.1:5501...
INFO: 2020/06/15 22:43:41 parsed scheme: ""
INFO: 2020/06/15 22:43:41 scheme "" not registered, fallback to default scheme
INFO: 2020/06/15 22:43:41 ccResolverWrapper: sending new addresses to cc: [{127.0.0.1:5501 0  <nil>}]
INFO: 2020/06/15 22:43:41 ClientConn switching balancer to "pick_first"
INFO: 2020/06/15 22:43:41 pickfirstBalancer: HandleSubConnStateChange: 0xc000099390, CONNECTING
INFO: 2020/06/15 22:43:41 pickfirstBalancer: HandleSubConnStateChange: 0xc000099390, READY
2020/06/15 22:43:41 Connected
INFO: 2020/06/15 22:43:41 pickfirstBalancer: HandleSubConnStateChange: 0xc000099390, TRANSIENT_FAILURE
2020/06/15 22:43:41 client.Start: rpc error: code = Unavailable desc = transport is closing

Reading the example's docs I noticed a comment, The client failed ("transport is closing") because the agent is using TLS but the client is not., but I didn't set any TLS config, so I don't think it makes sense in this case.

If you have any suggestions, please advise!

Thanks!

Project status and examples

Is this project still active? Is there any plans to update it with usage examples and update the golang version and other dependencies?

Make the command whitelisting feature optional

Hi there,
We have been discussing the possibility of using rce-agent to add a container-to-container communication feature to GitLab Runner's Custom Executor driver for AWS Fargate. The related issue is Support a fargate-agent sidecar container to prevent the need for custom CI images.

We made good progress in the proof-of-concept, but now we are blocked by the rce-agent's command whitelisting feature. This is a blocker because the driver is used to run CI/CD pipelines and we cannot anticipate the commands users will set up in their jobs, and hence we cannot whitelist them.

So the primary goal of this issue is to ask rce-agent's team if it makes sense to turn the command whitelisting feature optional. Based on the answer we can decide whether it's worth keeping the conversation going. 🙂

Thanks in advance!

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.