feat: implement MFA-based sudo approval system #101

hyunwoo-alps · 2025-08-06T07:44:39Z

Summary

Implement centralized sudo privilege verification through MFA authentication system.

Key Features

1. Auth Manager (Unix Socket Server)

Creates Unix domain socket server at /var/run/alpamon/auth.sock
Handles check_user requests from pam_alpamon.so
Handles sudo_approval requests from alpacon_approval.so
Manages PID-to-session mapping for Alpacon users

2. MFA Request Flow

Detects sudo command execution via PAM module
Routes MFA requests to alpacon-server for authenticated users
Returns {success: false, reason: "session missing"} for non-Alpacon users
Delivers MFA responses back to PAM module

3. User Management

Automatically adds new Alpacon users to sudo group on creation
Enables sudo access for Alpacon-managed users

4. Development Improvements

Added local test user in Dockerfile for convenient testing
Integrated PAM module build tools for easier development

Integration Points

alpacon-server: MFA verification endpoint
pam_alpamon.so: User authentication module
alpacon_approval.so: Sudo approval plugin

Related Issues

Closes #99

Co-authored-by: Copilot <[email protected]>

….Close() calls

pkg/runner/auth_manager.go

…nation

Copilot

Pull Request Overview

This PR implements sudo privilege verification and centralized management via MFA authentication by adding an Auth Manager component that handles sudo requests through a Unix domain socket and communicates with the alpacon server for MFA approval.

Introduces Auth Manager as a singleton service that maps PTY sessions to process IDs for sudo request handling
Adds Unix domain socket communication between PAM module and Auth Manager for sudo approval workflow
Extends WebSocket client to handle sudo approval responses from alpacon server and automatically adds new users to sudo group

Reviewed Changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pkg/runner/auth_manager.go	New Auth Manager implementation with sudo request handling and MFA communication
pkg/runner/pty.go	Adds PID-to-session mapping when PTY sessions are created
pkg/runner/command.go	Adds sudo group assignment for new users and sudo approval response handling
pkg/runner/client.go	Extends WebSocket client to process sudo approval responses
cmd/alpamon/command/root.go	Integrates Auth Manager startup and shutdown into main application lifecycle
configs/tmpfile.conf	Adds directory configuration for auth socket
Dockerfiles/ubuntu/22.04/Dockerfile	Adds development tools and test user for sudo functionality
Dockerfiles/ubuntu/22.04/entrypoint.sh	Creates auth socket directory at runtime

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

pkg/runner/pty.go

pkg/runner/auth_manager.go

Co-authored-by: Copilot <[email protected]>

…nt-via-mfa-authentication' of https://github.com/alpacax/alpamon into 99-sudo-privilege-verification-and-centralized-management-via-mfa-authentication

…tion-and-centralized-management-via-mfa-authentication

- Add alpamon-pam as recommended dependency in .goreleaser.yaml - Debian/Ubuntu: recommends alpamon-pam - CentOS/RHEL: recommends alpamon-pam - Update README.md with PAM module documentation - Add installation instructions with/without PAM module - Document PAM configuration steps for /etc/pam.d/sudo and /etc/sudo.conf - Add note about Alpamon service requirement for PAM authentication

…tion-and-centralized-management-via-mfa-authentication

Convert Korean comment in Dockerfile to English for better maintainability. Changes: - Dockerfiles/ubuntu/22.04/Dockerfile: Convert GOARCH architecture comment

Add AuthManager for centralized sudo privilege verification: - Unix domain socket server (/var/run/alpamon/auth.sock) - Handle check_user requests from pam_alpamon.so - Handle sudo_approval requests from alpacon_approval.so - Distinguish Alpacon users (pidToSessionMap) vs local users (localSudoRequests) - Retry logic with exponential backoff for WebSocket communication - Response routing back to PAM/sudo plugin via Unix socket Security improvements: - Root-only socket permissions (0600) - 30-second timeout to prevent DoS - Request ID based mapping for concurrent requests - Proper cleanup on timeout and connection errors Integration: - WebSocket communication with alpacon-server - Coordinate with PtyClient session management - Support both authenticated and local user approval flows

…atting Replace Msg(fmt.Sprintf(...)) with Msgf(...) to fix staticcheck SA1006 linting error. This resolves the golangci-lint failure in CI while maintaining the same functionality.

Use Str() instead of Err(fmt.Errorf()) to fix staticcheck SA1006 error. The result variable is already a string, so we use structured logging with Str().

- Fix critical mutex double unlock bug in HandleSudoApprovalResponse - Previously unlocked mutex inside loop, causing panic on second unlock - Now unlocks once after checking both alpacon and local requests - Improve connection lifecycle management in handleSudoRequest - Remove defer close() to prevent double-close with manual cleanup - Explicitly close connections after check_user requests - Document that sudo_approval connections are managed by response handlers - Add default case for unknown request types with proper cleanup - Improve timeout handling with explicit service shutdown cleanup

- Rename is_alpcon_user to is_alpacon_user for consistency - SudoApprovalRequest, SudoApprovalResponse structs - MFAResponse, IsAlpconResponse structs

…tion-and-centralized-management-via-mfa-authentication

- Remove hardcoded sudo group addition in adduser - Sudo privilege is now controlled by alpacon-server via gids

.goreleaser.yaml

- Add ControlClient to handle control WebSocket connection - Refactor client.go to separate control logic into control_client.go - Support sudo_approval request/response via control channel

…response)

pkg/runner/control_client.go

pkg/runner/auth_manager.go

pkg/runner/command.go

pkg/runner/auth_manager.go

- Rename variables to camelCase (unix_conn -> unixConn, sudo_approval_req -> sudoApprovalReq) - Add BaseRequest struct for type-safe request parsing - Extract createSendOperation method from sendSudoRequestWithRetry - Add completion channels for proper timeout handling - Close connection after sendSudoApprovalResponse in cleanupTimeoutRequest - Call RemovePIDSessionMapping when PtyClient disconnects

geunwoonoh

I think we can merge this PR as soon as the conflicts are resolved. Thank you!

…tion-and-centralized-management-via-mfa-authentication

hyunwoo hwang added 2 commits August 5, 2025 14:40

add auth manager and related changes

2af27c6

add test code and fix authmanager

a6e2e7e

Copilot AI review requested due to automatic review settings August 6, 2025 07:44

hyunwoo-alps linked an issue Aug 6, 2025 that may be closed by this pull request

Sudo Privilege Verification and Centralized Management via MFA Authentication #99

Closed

This comment was marked as outdated.

Sign in to view

hyunwoo-alps and others added 2 commits August 6, 2025 16:46

Update cmd/alpamon/command/root.go

b44eff0

Co-authored-by: Copilot <[email protected]>

Update pkg/runner/auth_manager.go

8c8ea5f

Co-authored-by: Copilot <[email protected]>

hyunwoo-alps closed this Aug 6, 2025

Fix connection leak in handleSudoRequest by adding explicit unix_conn…

2d22993

….Close() calls

hyunwoo-alps reopened this Aug 6, 2025

Fix golangci-lint issues: handle error return values and unused fields

2842fd2

eunyoung14 reviewed Aug 6, 2025

View reviewed changes

pkg/runner/auth_manager.go Outdated Show resolved Hide resolved

eunyoung14 reviewed Aug 6, 2025

View reviewed changes

pkg/runner/auth_manager.go Outdated Show resolved Hide resolved

Fix staticcheck SA1006 by using fmt.Sprintf instead of string concate…

1a36799

…nation

hyunwoo-alps requested a review from junho226 August 6, 2025 08:34

hyunwoo hwang added 3 commits August 7, 2025 10:21

modify socket path directory management

82b8b33

add local fall back and alpacon_approval.c

5589152

fix mistake

c12ee1a

hyunwoo-alps closed this Aug 18, 2025

hyunwoo-alps reopened this Aug 18, 2025

hyunwoo-alps requested a review from Copilot August 19, 2025 01:32

Copilot AI reviewed Aug 19, 2025

View reviewed changes

pkg/runner/pty.go Show resolved Hide resolved

pkg/runner/auth_manager.go Outdated Show resolved Hide resolved

hyunwoo-alps and others added 8 commits August 19, 2025 10:45

Update pkg/runner/pty.go

1ba9fd6

Co-authored-by: Copilot <[email protected]>

Update pkg/runner/auth_manager.go

8419b0e

Co-authored-by: Copilot <[email protected]>

update build

8c89095

Merge branch '99-sudo-privilege-verification-and-centralized-manageme…

36d51ae

…nt-via-mfa-authentication' of https://github.com/alpacax/alpamon into 99-sudo-privilege-verification-and-centralized-management-via-mfa-authentication

Merge remote-tracking branch 'origin' into 99-sudo-privilege-verifica…

0ea7abb

…tion-and-centralized-management-via-mfa-authentication

Merge remote-tracking branch 'origin' into 99-sudo-privilege-verifica…

779bf92

…tion-and-centralized-management-via-mfa-authentication

refactor: convert Korean comments to English

ab7a614

Convert Korean comment in Dockerfile to English for better maintainability. Changes: - Dockerfiles/ubuntu/22.04/Dockerfile: Convert GOARCH architecture comment

junho226 added 3 commits November 25, 2025 16:31

fix(runner): use Msgf instead of Msg with fmt.Sprintf for proper form…

d92a672

…atting Replace Msg(fmt.Sprintf(...)) with Msgf(...) to fix staticcheck SA1006 linting error. This resolves the golangci-lint failure in CI while maintaining the same functionality.

fix(runner): replace Err with Str for string error logging

79aeaad

Use Str() instead of Err(fmt.Errorf()) to fix staticcheck SA1006 error. The result variable is already a string, so we use structured logging with Str().

junho226 changed the title ~~99 sudo privilege verification and centralized management via mfa authentication~~ feat: implement MFA-based sudo approval system Nov 25, 2025

junho226 requested review from geunwoonoh and removed request for junho226 November 25, 2025 08:41

junho226 added 2 commits November 25, 2025 18:53

refactor: standardize is_alpacon_user field naming in auth structs

4a43682

- Rename is_alpcon_user to is_alpacon_user for consistency - SudoApprovalRequest, SudoApprovalResponse structs - MFAResponse, IsAlpconResponse structs

junho226 marked this pull request as draft November 26, 2025 07:57

junho226 added 2 commits November 26, 2025 17:15

Merge remote-tracking branch 'origin' into 99-sudo-privilege-verifica…

8d7dc9b

…tion-and-centralized-management-via-mfa-authentication

refactor(runner): remove unconditional sudo group addition

828d370

- Remove hardcoded sudo group addition in adduser - Sudo privilege is now controlled by alpacon-server via gids

geunwoonoh reviewed Nov 28, 2025

View reviewed changes

.goreleaser.yaml Outdated Show resolved Hide resolved

junho226 added 3 commits November 28, 2025 16:05

feat(runner): add ControlClient for server control channel

b2a1fae

- Add ControlClient to handle control WebSocket connection - Refactor client.go to separate control logic into control_client.go - Support sudo_approval request/response via control channel

fix: correct typo in response type (is_alpcon_response -> is_alpacon_…

90ab531

…response)

fix(package): change alpamon-pam dependency from recommends to suggests

25203cb

junho226 marked this pull request as ready for review December 1, 2025 10:22

junho226 self-assigned this Dec 1, 2025

geunwoonoh reviewed Dec 5, 2025

View reviewed changes

geunwoonoh previously approved these changes Dec 23, 2025

View reviewed changes

Merge remote-tracking branch 'origin' into 99-sudo-privilege-verifica…

ea20dfe

…tion-and-centralized-management-via-mfa-authentication

junho226 dismissed geunwoonoh’s stale review via ea20dfe December 23, 2025 02:08

geunwoonoh approved these changes Dec 23, 2025

View reviewed changes

junho226 merged commit 66268e2 into main Dec 23, 2025
5 checks passed

junho226 deleted the 99-sudo-privilege-verification-and-centralized-management-via-mfa-authentication branch December 23, 2025 02:13

This was referenced Dec 29, 2025

[Alpamon Agent Refactoring] Integrate Main Branch Changes into Refactored Architecture #162

Closed

Resolve "[Alpamon Agent Refactoring] Integrate Main Branch Changes into Refactored Architecture" #163

Merged

Resolve "Alpamon Agent Refactoring" #164

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: implement MFA-based sudo approval system #101

feat: implement MFA-based sudo approval system #101

Uh oh!

hyunwoo-alps commented Aug 6, 2025 •

edited by junho226

Loading

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

geunwoonoh left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

feat: implement MFA-based sudo approval system #101

feat: implement MFA-based sudo approval system #101

Uh oh!

Conversation

hyunwoo-alps commented Aug 6, 2025 • edited by junho226 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Key Features

1. Auth Manager (Unix Socket Server)

2. MFA Request Flow

3. User Management

4. Development Improvements

Integration Points

Related Issues

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

geunwoonoh left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

hyunwoo-alps commented Aug 6, 2025 •

edited by junho226

Loading