[collector] bugfix sshd cannot use private key to connect (#1084)

Co-authored-by: Musk.Chen <[email protected]>
Co-authored-by: tomsun28 <[email protected]>

collector/src/main/java/org/dromara/hertzbeat/collector/collect/ssh/SshCollectImpl.java

@@ -17,15 +17,16 @@
 
 package org.dromara.hertzbeat.collector.collect.ssh;
 
+import org.apache.sshd.common.util.security.SecurityUtils;
 import org.dromara.hertzbeat.collector.collect.AbstractCollect;
 import org.dromara.hertzbeat.collector.collect.common.cache.CacheIdentifier;
 import org.dromara.hertzbeat.collector.collect.common.cache.CommonCache;
 import org.dromara.hertzbeat.collector.collect.common.cache.SshConnect;
 import org.dromara.hertzbeat.collector.collect.common.ssh.CommonSshClient;
 import org.dromara.hertzbeat.collector.dispatch.DispatchConstants;
 import org.dromara.hertzbeat.collector.util.CollectUtil;
+import org.dromara.hertzbeat.collector.util.PrivateKeyUtils;
 import org.dromara.hertzbeat.common.constants.CollectorConstants;
-import org.dromara.hertzbeat.collector.util.KeyPairUtil;
 import org.dromara.hertzbeat.common.entity.job.Metrics;
 import org.dromara.hertzbeat.common.entity.job.protocol.SshProtocol;
 import org.dromara.hertzbeat.common.entity.message.CollectRep;
@@ -39,8 +40,10 @@
 import org.springframework.util.StringUtils;
 
 import java.io.ByteArrayOutputStream;
+import java.io.FileInputStream;
 import java.io.IOException;
 import java.net.ConnectException;
+import java.security.GeneralSecurityException;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashMap;
@@ -55,15 +58,14 @@
  * ssh协议采集实现
  *
  * @author tom
- *
  */
 @Slf4j
 public class SshCollectImpl extends AbstractCollect {
 
     private static final String PARSE_TYPE_ONE_ROW = "oneRow";
     private static final String PARSE_TYPE_MULTI_ROW = "multiRow";
     private static final String PARSE_TYPE_NETCAT = "netcat";
-    
+
     private static final int DEFAULT_TIMEOUT = 10_000;
 
     public SshCollectImpl() {
@@ -236,7 +238,7 @@ private void parseResponseDataByMulti(String result, List<String> aliasFields,
             builder.addValues(valueRowBuilder.build());
         }
     }
-    
+
     private void removeConnectSessionCache(SshProtocol sshProtocol) {
         CacheIdentifier identifier = CacheIdentifier.builder()
                 .ip(sshProtocol.getHost()).port(sshProtocol.getPort())
@@ -245,7 +247,7 @@ private void removeConnectSessionCache(SshProtocol sshProtocol) {
         CommonCache.getInstance().removeCache(identifier);
     }
 
-    private ClientSession getConnectSession(SshProtocol sshProtocol, int timeout) throws IOException {
+    private ClientSession getConnectSession(SshProtocol sshProtocol, int timeout) throws IOException, GeneralSecurityException {
         CacheIdentifier identifier = CacheIdentifier.builder()
                 .ip(sshProtocol.getHost()).port(sshProtocol.getPort())
                 .username(sshProtocol.getUsername()).password(sshProtocol.getPassword())
@@ -274,14 +276,11 @@ private ClientSession getConnectSession(SshProtocol sshProtocol, int timeout) th
         if (StringUtils.hasText(sshProtocol.getPassword())) {
             clientSession.addPasswordIdentity(sshProtocol.getPassword());
         } else if (StringUtils.hasText(sshProtocol.getPrivateKey())) {
-            var keyPair = KeyPairUtil.getKeyPairFromPrivateKey(sshProtocol.getPrivateKey());
-            if (keyPair != null) {
-                clientSession.addPublicKeyIdentity(keyPair);
-            }
-        } else {
-            clientSession.close();
-            throw new IllegalArgumentException("please input password or secret.");
-        }
+            var resourceKey = PrivateKeyUtils.writePrivateKey(sshProtocol.getHost(), sshProtocol.getPrivateKey());
+            SecurityUtils.loadKeyPairIdentities(null, () -> resourceKey, new FileInputStream(resourceKey), null)
+                    .forEach(clientSession::addPublicKeyIdentity);
+        }  // else auth with localhost private public key certificates
+
         // auth
         if (!clientSession.auth().verify(timeout, TimeUnit.MILLISECONDS).isSuccess()) {
             clientSession.close();

collector/src/main/java/org/dromara/hertzbeat/collector/util/PrivateKeyUtils.java

@@ -0,0 +1,48 @@
+package org.dromara.hertzbeat.collector.util;
+
+import lombok.experimental.UtilityClass;
+import lombok.extern.slf4j.Slf4j;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import java.util.Objects;
+
+/**
+ * 将私钥写入~/.ssh
+ *
+ * @author <a href="mailto:[email protected]">gcdd1993</a>
+ * Created by gcdd1993 on 2023/7/9
+ */
+@Slf4j
+@UtilityClass
+public class PrivateKeyUtils {
+
+    private static final String KEY_PATH = System.getProperty("user.home") + "/.ssh";
+
+    /**
+     * write private key to ~/.ssh, filename is ~/.ssh/id_rsa_${host}
+     *
+     * @param host   host
+     * @param keyStr key string
+     * @return key file path
+     * @throws IOException if ~/.ssh is not exist and create dir error
+     */
+    public static String writePrivateKey(String host, String keyStr) throws IOException {
+        var sshPath = Paths.get(KEY_PATH);
+        if (!Files.exists(sshPath)) {
+            Files.createDirectories(sshPath);
+        }
+        var keyPath = Paths.get(KEY_PATH, "id_rsa_" + host);
+        if (!Files.exists(keyPath)) {
+            Files.writeString(keyPath, keyStr);
+        } else {
+            var oldKey = Files.readString(keyPath);
+            if (!Objects.equals(oldKey, keyStr)) {
+                Files.writeString(keyPath, keyStr);
+            }
+        }
+        return keyPath.toString();
+    }
+
+}

collector/src/test/java/org/dromara/hertzbeat/collector/util/PrivateKeyUtilsTest.java

@@ -0,0 +1,61 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.dromara.hertzbeat.collector.util;
+
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import java.io.IOException;
+
+/**
+ * @author <a href="mailto:[email protected]">gcdd1993</a>
+ * Created by gcdd1993 on 2023/7/9
+ */
+class PrivateKeyUtilsTest {
+
+    @DisplayName("write key to ~/.ssh")
+    @Test
+    void writePrivateKey() throws IOException {
+        var key = "-----BEGIN RSA PRIVATE KEY-----\n" +
+                "MIIEogIBAAKCAQEA4ctFYk/xy89L6/6YFeeMrwCW9lCP/ThXMn+9G63s5bGn4oIN\n" +
+                "8cEf/JYkmGw8vMP41IAP9dyH8ji2wIZSLeTPWucEK6P6jA01iIBQ95ng6RTsnQgL\n" +
+                "h4pYHxlEaNHcXkjy5GlMdzaWadjdRevpThGR1VOtWFtK3yoC0c/te2Junu04f+11\n" +
+                "cpk8QvmVfzrBUooVnG0/7oekwUy1c5sSl0qVoLzXOv4XG9w34cyvacFC30zv1Nl8\n" +
+                "ASi2pmOBVx9njPvqQ7qZrDk0nwn+RZUmGh/PbmHxrBV7ZA5NjZcEnf2VGIfjGUVu\n" +
+                "qE4VnkbvS4j03afV2rsp1yo74K+k/ZC6GCHB5QIBIwKCAQBG9r4I9I3SVxfcdJYy\n" +
+                "xR2WFiDREgFeNkdKYqkl9NVsws5dIY9am8g5cQQv54DNnK1KGZ6dulaclXtD0nGZ\n" +
+                "ZSs505OYr+EHcd2f7dBN0Uavp32QcD4jSLycD0FixZ0HsIbaEnceJxlUd1t8YBYf\n" +
+                "2aLcpUUbxOulORbUOgjPAa286uDeQYN5IbdruDfvbuFFm7hBoGZoKLJ7FPcJ0U3A\n" +
+                "14KRK+Z1oCYJIS0ubaHbhaPIVPPQEmTNHpsvxIJXfZtVy9+XIuBGmD3+Aq6SSFPC\n" +
+                "A8mU1iKzzdRCXZwvPeUiivIIZc6DRXjhtJ2Lya/XndKidOT/QUj8Z+f9pWAonlzM\n" +
+                "3PMXAoGBAPvzctkkDjUJjLyEuYQq8soYokS4n4ykFTP5oFgnodK/cYocbxTT6Tn9\n" +
+                "vH7b6lK6ZAf+tZk8rcEeIO650pOvmaa1/OuZSxfcFUGBvOvYXiHF7zmkePh/pQgB\n" +
+                "7Cl0RYrI52Cjbd9aCUIYK3A82qsUq30INGeOhMNrfaHn2pgx8xlDAoGBAOVsNctw\n" +
+                "CHnLaIQX8eS+eUcQEm+NZppnDBJavdpP48ZZM/t5v/2fQ5ytbYqk0KEzIGu0dP8g\n" +
+                "jfB76JbMvStvTfB+TrXsfhGyA3oJrEcG+3IUshsRU2sohT1ScY27z2VMLgilnWvF\n" +
+                "7t49sQm9uB/yn669n8LIciHxDItOpvqgKdG3AoGBAO2NxA6PtZ+4jAIz/19bsbc7\n" +
+                "zDIqaovrKe8tMMglXg/ZE0e0aLvdvqRkRAKU1Z51Ob5lLuDwEYoyWZCgk1gL90Vp\n" +
+                "wpT+P3zlcyCBo39IWMDB8C8IydRbF/GbaaNtoKds92m+qWwwUd87XCf+3M0wvvI6\n" +
+                "75TW1PLEbyOgFz8Khh8hAoGBAJbDc87Ul9sCAtp2Ip2hvWk2coPR8vfADz9C8cn5\n" +
+                "/BShBOcVfipSt2b1n8GCP/TnFU4XgBVeiSkA9+4Rg6AzMzejdY1+JvWvfqCnRVM/\n" +
+                "GkOnMzZb17tyZi+ck8OKC/IcHkAyUYFWL0GWQSOojvBsPQxt+0V8aEIwsHjNSSha\n" +
+                "nyNpAoGAd0XqdByRxbWgg5ZsvM0tvrpMITpEZsGMG9VeQPGl0wsQvC2zw5QGLvz/\n" +
+                "57YhofOOr0M3yElcFA9Imvek5CYZsyL8eIWGZyadfRiYvGOUyvDDO3BYRG4DmhyF\n" +
+                "KVk3URjEuOCC29ORvZ/7HaCO9iuEbvAA/mrAtd7KdCA+3PzfEOw=\n" +
+                "-----END RSA PRIVATE KEY-----";
+        PrivateKeyUtils.writePrivateKey("127.0.0.1", key);
+    }
+}

manager/src/main/resources/define/app-almalinux.yml

@@ -123,6 +123,7 @@ params:
     # type-param field type(most mapping the html input type)
     # type-字段类型,样式(大部分映射input标签type属性)
     type: textarea
+    placeholder: -----BEGIN RSA PRIVATE KEY-----
     # required-true or false
     # required-是否是必输项 true-必填 false-可选
     required: false

manager/src/main/resources/define/app-centos.yml

@@ -123,6 +123,7 @@ params:
     # type-param field type(most mapping the html input type)
     # type-字段类型,样式(大部分映射input标签type属性)
     type: textarea
+    placeholder: -----BEGIN RSA PRIVATE KEY-----
     # required-true or false
     # required-是否是必输项 true-必填 false-可选
     required: false

manager/src/main/resources/define/app-coreos.yml

@@ -123,6 +123,7 @@ params:
     # type-param field type(most mapping the html input type)
     # type-字段类型,样式(大部分映射input标签type属性)
     type: textarea
+    placeholder: -----BEGIN RSA PRIVATE KEY-----
     # required-true or false
     # required-是否是必输项 true-必填 false-可选
     required: false

manager/src/main/resources/define/app-debian.yml

@@ -123,6 +123,7 @@ params:
     # type-param field type(most mapping the html input type)
     # type-字段类型,样式(大部分映射input标签type属性)
     type: textarea
+    placeholder: -----BEGIN RSA PRIVATE KEY-----
     # required-true or false
     # required-是否是必输项 true-必填 false-可选
     required: false

manager/src/main/resources/define/app-euleros.yml

@@ -123,6 +123,7 @@ params:
     # type-param field type(most mapping the html input type)
     # type-字段类型,样式(大部分映射input标签type属性)
     type: textarea
+    placeholder: -----BEGIN RSA PRIVATE KEY-----
     # required-true or false
     # required-是否是必输项 true-必填 false-可选
     required: false

manager/src/main/resources/define/app-freebsd.yml

@@ -123,6 +123,7 @@ params:
     # type-param field type(most mapping the html input type)
     # type-字段类型,样式(大部分映射input标签type属性)
     type: textarea
+    placeholder: -----BEGIN RSA PRIVATE KEY-----
     # required-true or false
     # required-是否是必输项 true-必填 false-可选
     required: false

manager/src/main/resources/define/app-linux.yml

@@ -123,6 +123,7 @@ params:
     # type-param field type(most mapping the html input type)
     # type-字段类型,样式(大部分映射input标签type属性)
     type: textarea
+    placeholder: -----BEGIN RSA PRIVATE KEY-----
     # required-true or false
     # required-是否是必输项 true-必填 false-可选
     required: false