:py:mod:`dissect.target.plugins.apps.ssh.opensshd` ================================================== .. py:module:: dissect.target.plugins.apps.ssh.opensshd Module Contents --------------- Classes ~~~~~~~ .. autoapisummary:: dissect.target.plugins.apps.ssh.opensshd.SSHServerPlugin Attributes ~~~~~~~~~~ .. autoapisummary:: dissect.target.plugins.apps.ssh.opensshd.SSHD_BOOLEAN_VALUES dissect.target.plugins.apps.ssh.opensshd.SSHD_BOOLEAN_FIELDS dissect.target.plugins.apps.ssh.opensshd.SSHD_INTEGER_FIELDS dissect.target.plugins.apps.ssh.opensshd.SSHD_MULTIPLE_DEFINITIONS_ALLOWED_FIELDS .. py:data:: SSHD_BOOLEAN_VALUES :value: ('yes', 'no') .. py:data:: SSHD_BOOLEAN_FIELDS :value: ('AllowAgentForwarding', 'DebianBanner', 'DisableForwarding', 'ChallengeResponseAuthentication',... .. py:data:: SSHD_INTEGER_FIELDS :value: ('ClientAliveCountMax', 'ClientAliveInterval', 'LoginGraceTime', 'MaxAuthTries', 'MaxSessions',... .. py:data:: SSHD_MULTIPLE_DEFINITIONS_ALLOWED_FIELDS :value: ('AcceptEnv', 'Include', 'ListenAddress', 'PermitListen', 'PermitOpen', 'Port') .. py:class:: SSHServerPlugin(target: dissect.target.Target) Bases: :py:obj:`dissect.target.plugins.apps.ssh.ssh.SSHPlugin` Base class for plugins. Plugins can optionally be namespaced by specifying the ``__namespace__`` class attribute. Namespacing results in your plugin needing to be prefixed with this namespace when being called. For example, if your plugin has specified ``test`` as namespace and a function called ``example``, you must call your plugin with ``test.example``:: A ``Plugin`` class has the following private class attributes: - ``__namespace__`` - ``__record_descriptors__`` With the following three being assigned in :func:`register`: - ``__plugin__`` - ``__functions__`` - ``__exports__`` Additionally, the methods and attributes of :class:`Plugin` receive more private attributes by using decorators. The :func:`export` decorator adds the following private attributes - ``__exported__`` - ``__output__``: Set with the :func:`export` decorator. - ``__record__``: Set with the :func:`export` decorator. The :func:`internal` decorator and :class:`InternalPlugin` set the ``__internal__`` attribute. Finally. :func:`args` decorator sets the ``__args__`` attribute. :param target: The :class:`~dissect.target.target.Target` object to load the plugin for. .. py:attribute:: __namespace__ :value: 'opensshd' .. py:method:: check_compatible() -> None Perform a compatibility check with the target. This function should return ``None`` if the plugin is compatible with the current target (``self.target``). For example, check if a certain file exists. Otherwise it should raise an ``UnsupportedPluginError``. :raises UnsupportedPluginError: If the plugin could not be loaded. .. py:method:: config() -> Iterator[dissect.target.helpers.record.DynamicDescriptor] Parse all fields in the SSH server config in /etc/ssh/sshd_config. This function parses each line (not starting with '#') as a key-value pair, delimited by whitespace. The values of these fields can be one of three types: string, integer and boolean (string is the default). We provide two lists that define the integer and boolean fields (SSHD_INTEGER_FIELDS and SSHD_BOOLEAN_FIELDS). The fields in SSHD_MULTIPLE_DEFINITIONS_ALLOWED_FIELDS can be defined multiple times. We set their type to a list of the underlying value (e.g. varint[] for the Port field). This parser does not (yet) follow Include directives. Resources: - https://github.com/openssh/openssh-portable - https://www.man7.org/linux/man-pages/man5/sshd_config.5.html