命令行自动登录 JumpServer：SSH、TOTP 与密码提示的自动化

1
brew install expect oath-toolkit jq

1
bw login

1
ssh_jumpserver_idc() {
2
  _ssh_jumpserver <ssh-host-alias> <bitwarden-item-name> --bw-password
3
}

1
_ssh_jumpserver() {
2
  local target="$1"
3
  local totp_item="$2"
4
  local password_source="${3:-}"
5
  local item_json totp_secret target_passwd
6

7
  if [[ -z "$target" || -z "$totp_item" ]]; then
8
    echo "usage: _ssh_jumpserver <ssh-target> <bitwarden-item> [--bw-password|password]"
9
    return 2
10
  fi
11

12
  for cmd in expect oathtool bw jq; do
13
    if ! command -v "$cmd" >/dev/null 2>&1; then
14
      echo "$cmd not found"
15
      return 127
16
    fi
17
  done
18

19
  case "$(bw status 2>/dev/null)" in
20
    *'"status":"unlocked"'*) ;;
21
    *'"status":"locked"'*)
22
      bw_unlock || return $?
23
      ;;
24
    *'"status":"unauthenticated"'*)
25
      echo "Bitwarden CLI is not logged in. Run bw login first."
26
      return 1
27
      ;;
28
    *)
29
      echo "Unexpected Bitwarden status. Run bw status to inspect it."
30
      return 1
31
      ;;
32
  esac
33

34
  bw sync --force >/dev/null 2>&1 || :
35

36
  item_json="$(_bw_get_exact_item "$totp_item")" || return $?
37
  totp_secret="$(_bw_totp_secret_from_json "$totp_item" "$item_json")" || return $?
38

39
  if [[ "$password_source" == "--bw-password" ]]; then
40
    target_passwd="$(_bw_password_from_json "$totp_item" "$item_json")" || return $?
41
  else
42
    target_passwd="$password_source"
43
  fi
44

45
  _ssh_jumpserver_expect "$target" "$totp_secret" "$target_passwd"
46
}

1
_bw_get_exact_item() {
2
  local item="$1"
3
  local item_json item_name
4

5
  item_json="$(bw get item "$item")" || return $?
6
  item_name="$(jq -r '.name // empty' <<<"$item_json")" || return $?
7

8
  if [[ "$item_name" != "$item" ]]; then
9
    echo "Bitwarden item mismatch: requested '$item', got '$item_name'" >&2
10
    return 1
11
  fi
12

13
  print -r -- "$item_json"
14
}

1
_bw_totp_secret_from_json() {
2
  local item="$1"
3
  local item_json="$2"
4
  local totp secret
5

6
  totp="$(jq -r '.login.totp // empty' <<<"$item_json")" || return $?
7
  if [[ -z "$totp" || "$totp" == "null" ]]; then
8
    echo "Bitwarden item has no login.totp: $item" >&2
9
    return 1
10
  fi
11

12
  if [[ "$totp" == otpauth://* ]]; then
13
    secret="${totp#*secret=}"
14
    secret="${secret%%&*}"
15
    secret="$(printf '%b' "${secret//\\%/\\\\x}")"
16
  else
17
    secret="$totp"
18
  fi
19

20
  print -r -- "${secret//[[:space:]]/}"
21
}

1
_ssh_jumpserver_expect() {
2
  local target="$1"
3
  local totp_secret="$2"
4
  local target_passwd="${3:-}"
5
  local expect_script expect_status
6

7
  expect_script="$(mktemp "${TMPDIR:-/tmp}/ssh-jumpserver.XXXXXX")" || return $?
8
  command cat > "$expect_script" <<'EXPECT'
9
set target [lindex $argv 0]
10
set secret [lindex $argv 1]
11
set target_passwd [lindex $argv 2]
12

13
set timeout 30
14
spawn ssh $target
15

16
expect {
17
  "*password:*" {
18
    if {$target_passwd eq ""} {
19
      send_error "SSH password prompt received, but no password was provided\\n"
20
      exit 1
21
    }
22
    send -- "$target_passwd\\r"
23
    exp_continue
24
  }
25

26
  "*Code]:" {
27
    set kdauth [exec oathtool --totp --base32 $secret]
28
    send -- "$kdauth\\r"
29
  }
30

31
  timeout {
32
    send_error "Timed out waiting for SSH jumpserver prompt\\n"
33
    exit 1
34
  }
35
}
36

37
interact
38
EXPECT
39

40
  expect -f "$expect_script" -- "$target" "$totp_secret" "$target_passwd"
41
  expect_status=$?
42
  rm -f "$expect_script"
43
  return $expect_status
44
}

1
ssh_jumpserver_idc