refactoring, socket.io update

more refactoring, code standards, updated socket.io to 1.7.4, increment
release to 0.1.1

Author: billchurch

.gitignore

@@ -3,6 +3,9 @@ logs
 *.log
 npm-debug.log*
 
+# Editor preference files
+*.sublime-*
+
 # Runtime data
 pids
 *.pid

ChangeLog.md

@@ -1,12 +1,26 @@
 # Change Log
+## [0.1.1] 2017-06-03
+### Added
+- `serverlog.client` and `serverlog.server` options added to `config.json` to enable logging of client commands to server log (only client portion implemented at this time)
+- morgan express middleware for logging
+### Changed
+- Updated socket.io to 1.7.4
+- continued refactoring, breaking up `index.js`
+- revised error handling methods
+- revised session termination methods
+### Fixed
+### Removed
+- color console decorations from `util/index.js`
+- SanatizeHeaders function from `util/index.js`
+
 ## [0.1.0] 2017-05-27
 ### Added
 - This ChangeLog.md file
 - Support for UTF-8 characters (thanks @bara666)
 - Snyk, Bithound, Travis CI
 - Cross platform improvements (path mappings)
 - Session fixup between Express and Socket.io
-- Session secret settings in config.json
+- Session secret settings in `config.json`
 - env variable `DEBUG=ssh2` will put the `ssh2` module into debug mode
 - env variable `DEBUG=WebSSH2` will output additional debug messages for functions
 and events in the application (not including the ssh2 module debug)
@@ -19,7 +33,7 @@ and events in the application (not including the ssh2 module debug)
 - error handling in public/client.js
 - moved socket.io operations to their own file /socket/index.js, more changes like this to come (./socket/index.js)
 - all session based variables are now under the req.session.ssh property or socket.request.ssh (./index.js)
-- moved SSH algorithms to config.json and defined as a session variable (..session.ssh.algorithms)
+- moved SSH algorithms to `config.json` and defined as a session variable (..session.ssh.algorithms)
 -- prep for future feature to define algorithms in header or some other method to enable separate ciphers per host
 - minified and combined all js files to a single js in `./public/webssh2.min.js` also included a sourcemap `./public/webssh2.min.js` which maps to `./public/webssh2.js` for easier troubleshooting.
 - combined all css files to a single css in `./public/webssh2.css`
@@ -28,7 +42,7 @@ and events in the application (not including the ssh2 module debug)
 - sourcemaps of all minified code (in /public/src and /public/src/js)
 - renamed `client.htm` to `client-full.htm`
 - created `client-min.htm` to serve minified javascript
-- if header.text is null in config.json and header is not defined as a get parameter the Header will not be displayed. Both of these must be null / undefined and not specified as get parameters.
+- if header.text is null in `config.json` and header is not defined as a get parameter the Header will not be displayed. Both of these must be null / undefined and not specified as get parameters.
 
 ### Fixed
 - Multiple errors may overwrite status bar which would cause confusion as to what originally caused the error. Example, ssh server disconnects which prompts a cascade of events (conn.on('end'), socket.on('disconnect'), conn.on('close')) and the original reason (conn.on('end')) would be lost and the user would erroneously receive a WEBSOCKET error as the last event to fire would be the websocket connection closing from the app.

README.md

@@ -1,7 +1,7 @@
 # WebSSH2 [![GitHub version](https://badge.fury.io/gh/billchurch%2FWebSSH2.svg)](https://badge.fury.io/gh/billchurch%2FWebSSH2) [![Build Status](https://travis-ci.org/billchurch/WebSSH2.svg?branch=master)](https://travis-ci.org/billchurch/WebSSH2) [![Known Vulnerabilities](https://snyk.io/test/github/billchurch/webssh2/badge.svg)](https://snyk.io/test/github/billchurch/webssh2) [![bitHound Overall Score](https://www.bithound.io/github/billchurch/WebSSH2/badges/score.svg)](https://www.bithound.io/github/billchurch/WebSSH2) [![bitHound Dependencies](https://www.bithound.io/github/billchurch/WebSSH2/badges/dependencies.svg)](https://www.bithound.io/github/billchurch/WebSSH2/master/dependencies/npm) [![NSP Status](https://nodesecurity.io/orgs/billchurch/projects/b0a0d9df-1340-43ef-9736-ef983c057764/badge)](https://nodesecurity.io/orgs/billchurch/projects/b0a0d9df-1340-43ef-9736-ef983c057764)
 Web SSH Client using ssh2, socket.io, xterm.js, and express
 
-Bare bones example of using SSH2 as a client on a host to proxy a Websocket / Socket.io connection to a SSH2 server. 
+Bare bones example of using SSH2 as a client on a host to proxy a Websocket / Socket.io connection to a SSH2 server.
 
 <img width="1044" alt="Screenshot 2017-03-23 18.13.59" src="https://cloud.githubusercontent.com/assets/1668075/24272639/8ad4fef0-0ff4-11e7-8dd0-72b26605e467.png">
 
@@ -29,7 +29,7 @@ You will be prompted for credentials to use on the SSH server via HTTP Basic aut
 
 * **header=** - _string_ - optional header to display on page
 
-* **headerBackground=** - _string_ - optional background color of header to display on page 
+* **headerBackground=** - _string_ - optional background color of header to display on page
 
 ## Headers
 
@@ -62,7 +62,7 @@ You will be prompted for credentials to use on the SSH server via HTTP Basic aut
 
 * **session.secret** - _string_ - Secret key for cookie encryption. You should change this in production.
 
-* **options.challengeButton** - _boolean_ - Challenge button. This option, which is still under development, allows the user to resend the password to the server (in cases of step-up authentication for things like `sudo` or a router `enable` command. 
+* **options.challengeButton** - _boolean_ - Challenge button. This option, which is still under development, allows the user to resend the password to the server (in cases of step-up authentication for things like `sudo` or a router `enable` command.
 
 * **algorithms** - _object_ - This option allows you to explicitly override the default transport layer algorithms used for the connection. Each value must be an array of valid algorithms for that category. The order of the algorithms in the arrays are important, with the most favorable being first. Valid keys:
 
@@ -152,6 +152,11 @@ You will be prompted for credentials to use on the SSH server via HTTP Basic aut
       * zlib@openssh.com
       * zlib
 
+* **serverlog.client** - _boolean_ - Enables client command logging on server log (console.log). Very simple at this point, buffers data from client until it receives a line-feed then dumps buffer to console.log with session information for tracking. Will capture anything send from client, including passwords, so use for testing only... Default: false. Example:
+  * _serverlog.client: GcZDThwA4UahDiKO2gkMYd7YPIfVAEFW/mnf0NUugLMFRHhsWAAAA host: 192.168.99.80 command: ls -lat_
+
+* **serverlog.server** - _boolean_ - not implemented, default: false.
+
 # Experimental client-side logging
 Clicking `Start logging` on the status bar will log all data to the client. A `Download log` option will appear after starting the logging. You may download at any time to the client. You may stop logging at any time my pressing the `Logging - STOP LOG`. Note that clicking the `Start logging` option again will cause the current log to be overwritten, so be sure to download first.
 
@@ -162,4 +167,4 @@ http://localhost:2222/ssh/host/192.168.1.1?port=2244&header=My%20Header&color=re
 # Tips
 * If you want to add custom JavaScript to the browser client you can either modify `./public/client-(full|min).html` and add a **<script>** element or check out `Gulpfile.js` and add your custom javascript file to the concat task
 * BIG-IP Acess Policy Manager (APM) doesn't always care for minified javascript when run in portal mode. Be sure to Set `useminified` option in `config.json` to `false` for these environments
-* Set `useminified` option in `config.json` to `true` to utilize minified javascript 
+* Set `useminified` option in `config.json` to `true` to utilize minified javascript

app.js

@@ -0,0 +1,80 @@
+// app.js
+
+var path = require('path')
+var config = require('read-config')(path.join(__dirname, 'config.json'))
+var express = require('express')
+var logger = require('morgan')
+var session = require('express-session')({
+  secret: config.session.secret,
+  name: config.session.name,
+  resave: true,
+  saveUninitialized: false,
+  unset: 'destroy'
+})
+var app = express()
+var server = require('http').Server(app)
+var myutil = require('./util')
+var validator = require('validator')
+var io = require('socket.io')(server, { serveClient: false })
+var socket = require('./socket')
+var expressOptions = require('./expressOptions')
+
+// express
+app.use(session)
+app.use(myutil.basicAuth)
+if (config.accesslog) app.use(logger('common'))
+app.disable('x-powered-by')
+
+// static files
+app.use(express.static(path.join(__dirname, 'public'), expressOptions))
+
+app.get('/ssh/host/:host?', function (req, res, next) {
+  res.sendFile(path.join(path.join(__dirname, 'public', (config.useminified)
+    ? 'client-min.htm' : 'client-full.htm')))
+  // capture, assign, and validated variables
+  req.session.ssh = {
+    host: (validator.isIP(req.params.host + '') && req.params.host) ||
+      (validator.isFQDN(req.params.host) && req.params.host) ||
+      (/^(([a-z]|[A-Z]|[0-9]|[!^(){}\-_~])+)?\w$/.test(req.params.host) &&
+      req.params.host) || config.ssh.host,
+    port: (validator.isInt(req.query.port + '', {min: 1, max: 65535}) &&
+      req.query.port) || config.ssh.port,
+    header: {
+      name: req.query.header || config.header.text,
+      background: req.query.headerBackground || config.header.background
+    },
+    algorithms: config.algorithms,
+    term: (/^(([a-z]|[A-Z]|[0-9]|[!^(){}\-_~])+)?\w$/.test(req.query.sshterm) &&
+      req.query.sshterm) || config.ssh.term,
+    allowreplay: validator.isBoolean(req.headers.allowreplay + '') || false,
+    serverlog: {
+      client: config.serverlog.client || false,
+      server: config.serverlog.server || false
+    }
+  }
+  req.session.ssh.header.name && validator.escape(req.session.ssh.header.name)
+  req.session.ssh.header.background &&
+    validator.escape(req.session.ssh.header.background)
+})
+
+// express error handling
+app.use(function (req, res, next) {
+  res.status(404).send("Sorry can't find that!")
+})
+
+app.use(function (err, req, res, next) {
+  console.error(err.stack)
+  res.status(500).send('Something broke!')
+})
+
+// socket.io
+// expose express session with socket.request.session
+io.use(function (socket, next) {
+  (socket.request.res) ? session(socket.request, socket.request.res, next)
+    : next()
+})
+
+// bring up socket
+io.on('connection', socket)
+
+module.exports = {server: server, config: config}

config.json

@@ -52,5 +52,10 @@
       "zlib@openssh.com",
       "zlib"
     ]
-  }
-}
+  },
+  "serverlog": {
+    "client": false, // proof-of-concept to log commands from client to server
+    "server": false  // not yet implemented
+  },
+  "accesslog": false // http style access logging to console.log
+}

expressOptions.js

@@ -0,0 +1,11 @@
+module.exports = {
+  dotfiles: 'ignore',
+  etag: false,
+  extensions: ['htm', 'html'],
+  index: false,
+  maxAge: '1s',
+  redirect: false,
+  setHeaders: function (res, path, stat) {
+    res.set('x-timestamp', Date.now())
+  }
+}

index.js

@@ -1,97 +1,24 @@
+// server.js
 /*
  * WebSSH2 - Web to SSH2 gateway
  * Bill Church - https://github.com/billchurch/WebSSH2 - May 2017
  *
  */
-var express = require('express')
-var app = express()
-var server = require('http').Server(app)
-var io = require('socket.io')(server)
-var path = require('path')
-var config = require('read-config')(path.join(__dirname, 'config.json'))
-var myutil = require('./util')
-var socket = require('./socket/index.js')
-var validator = require('validator')
-var session = require('express-session')({
-  secret: config.session.secret,
-  name: config.session.name,
-  resave: true,
-  saveUninitialized: false,
-  unset: 'destroy'
-})
-
-// express
-var expressOptions = {
-  dotfiles: 'ignore',
-  etag: false,
-  extensions: ['htm', 'html'],
-  index: false,
-  maxAge: '1s',
-  redirect: false,
-  setHeaders: function (res, path, stat) {
-    res.set('x-timestamp', Date.now())
-  }
-}
-
-app.use(session)
-app.use(myutil.basicAuth)
-
-app.disable('x-powered-by')
-
-app.get('/ssh/host/:host?', function (req, res, next) {
-  res.sendFile(path.join(path.join(__dirname, 'public', (config.useminified) ? 'client-min.htm' : 'client-full.htm')))
-  // capture and assign variables
-  req.session.ssh = {
-    host: (validator.isIP(req.params.host + '') && req.params.host) || (validator.isFQDN(req.params.host) && req.params.host) || (/^(([a-z]|[A-Z]|[0-9]|[!^(){}\-_~])+)?\w$/.test(req.params.host) && req.params.host) || config.ssh.host,
-    port: (validator.isInt(req.query.port + '', {min: 1, max: 65535}) && req.query.port) || config.ssh.port,
-    header: {
-      name: req.query.header || config.header.text,
-      background: req.query.headerBackground || config.header.background
-    },
-    algorithms: config.algorithms,
-    term: (/^(([a-z]|[A-Z]|[0-9]|[!^(){}\-_~])+)?\w$/.test(req.query.sshterm) && req.query.sshterm) || config.ssh.term,
-    allowreplay: validator.isBoolean(req.headers.allowreplay + '') || false
-  }
-  req.session.ssh.header.name && validator.escape(req.session.ssh.header.name)
-  req.session.ssh.header.background && validator.escape(req.session.ssh.header.background)
-})
-
-// static files
-app.use(express.static(path.join(__dirname, 'public'), expressOptions))
-
-// express error handling
-app.use(function (req, res, next) {
-  res.status(404).send("Sorry can't find that!")
-})
-
-app.use(function (err, req, res, next) {
-  console.error(err.stack)
-  res.status(500).send('Something broke!')
-})
-
-// socket.io
-// expose express session with socket.request.session
-io.use(function (socket, next) {
-  (socket.request.res) ? session(socket.request, socket.request.res, next) : next()
-})
 
-// bring up socket
-io.on('connection', socket)
+var config = require('./app').config
+var server = require('./app').server
 
-// server
-server.listen({
-  host: config.listen.ip,
-  port: config.listen.port
+server.listen({ host: config.listen.ip, port: config.listen.port
 })
 
 server.on('error', function (err) {
   if (err.code === 'EADDRINUSE') {
     config.listen.port++
-    console.warn('Address in use, retrying on port ' + config.listen.port)
+    console.warn('WebSSH2 Address in use, retrying on port ' + config.listen.port)
     setTimeout(function () {
       server.listen(config.listen.port)
     }, 250)
   } else {
-    console.log('server.listen ERROR: ' + err.code)
+    console.log('WebSSH2 server.listen ERROR: ' + err.code)
   }
 })

package.json

@@ -1,6 +1,6 @@
 {
   "name": "WebSSH2",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "ignore": [
     ".gitignore"
   ],
@@ -32,8 +32,9 @@
     "debug": "^2.6.8",
     "express": "^4.15.3",
     "express-session": "^1.15.3",
+    "morgan": "^1.8.2",
     "read-config": "^1.6.0",
-    "socket.io": "^1.6.0",
+    "socket.io": "^1.7.4",
     "ssh2": "^0.5.4",
     "validator": "^7.0.0"
   },

public/client-full.htm

@@ -11,9 +11,12 @@
     <div id="bottomdiv">
       <div id="footer"></div>
       <div id="status"></div>
-      <div id="credentials"><a class="credentials" href="javascript:void(0);" onclick="replayCredentials()">CREDENTIALS</a></div>
-      <div id="downloadLog"><a class="downloadLog" href="javascript:void(0);" onclick="downloadLog()">Download Log</a></div>      
-      <div id="toggleLog"><a class="toggleLog" href="javascript:void(0);" onclick="toggleLog();">Start Log</a></div>      
+      <div id="credentials"><a class="credentials" href="javascript:void(0);"
+        onclick="replayCredentials()">CREDENTIALS</a></div>
+      <div id="downloadLog"><a class="downloadLog" href="javascript:void(0);"
+        onclick="downloadLog()">Download Log</a></div>
+      <div id="toggleLog"><a class="toggleLog" href="javascript:void(0);"
+        onclick="toggleLog();">Start Log</a></div>
     </div>
   </div>
 </body>

public/client-min.htm

@@ -11,9 +11,12 @@
     <div id="bottomdiv">
       <div id="footer"></div>
       <div id="status"></div>
-      <div id="credentials"><a class="credentials" href="javascript:void(0);" onclick="replayCredentials()">CREDENTIALS</a></div>
-      <div id="downloadLog"><a class="downloadLog" href="javascript:void(0);" onclick="downloadLog()">Download Log</a></div>      
-      <div id="toggleLog"><a class="toggleLog" href="javascript:void(0);" onclick="toggleLog();">Start Log</a></div>      
+      <div id="credentials"><a class="credentials" href="javascript:void(0);"
+        onclick="replayCredentials()">CREDENTIALS</a></div>
+      <div id="downloadLog"><a class="downloadLog" href="javascript:void(0);"
+        onclick="downloadLog()">Download Log</a></div>
+      <div id="toggleLog"><a class="toggleLog" href="javascript:void(0);"
+        onclick="toggleLog();">Start Log</a></div>
     </div>
   </div>
 </body>