From e336c0712872cadcb4f53c2da03f4f89cee89527 Mon Sep 17 00:00:00 2001 From: Michael Peterson Date: Fri, 17 Aug 2018 13:10:40 -0400 Subject: [PATCH 1/4] Fix the osacript to work with versioned names of python (e.g. 'python3.7') --- blessclient/tokengui.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/blessclient/tokengui.py b/blessclient/tokengui.py index caaa83f..5728986 100644 --- a/blessclient/tokengui.py +++ b/blessclient/tokengui.py @@ -1,6 +1,7 @@ from __future__ import absolute_import import platform import os +import subprocess from six.moves.tkinter import Tk, Label, Entry, Button, ACTIVE, W, mainloop @@ -35,7 +36,10 @@ def doGUI(self, hostname=None): if platform.system() == 'Darwin': # Hack to get the GUI dialog focused in OSX - os.system('/usr/bin/osascript -e \'tell app "Finder" to set frontmost of process "python" to true\'') + # https://stackoverflow.com/questions/1892339/how-to-make-a-tkinter-window-jump-to-the-front/37235492#37235492 + tmpl = 'tell application "System Events" to set frontmost of every process whose unix id is {} to true' + script = tmpl.format(os.getpid()) + subprocess.check_call(['/usr/bin/osascript', '-e', script]) mainloop() From 2c35382e6bbee541ce1292661e10f575a3d42e62 Mon Sep 17 00:00:00 2001 From: James Addison <406005+jayaddison@users.noreply.github.com> Date: Wed, 12 Dec 2018 10:14:11 -0800 Subject: [PATCH 2/4] Remove stale documentation suggestion --- blessclient/client.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blessclient/client.py b/blessclient/client.py index 27b826f..e8b2439 100755 --- a/blessclient/client.py +++ b/blessclient/client.py @@ -199,7 +199,7 @@ def get_mfa_token_cli(): def get_mfa_token_gui(message): sys.stderr.write( - "Enter your AWS MFA token in the gui dialog. Alternatively, run mfa.sh first.\n") + "Enter your AWS MFA token in the gui dialog.\n") tig = tokengui.TokenInputGUI() if message == 'BLESS': message = None From 6df84b4089d7f74ddf5e0f660dc37b6c408a4137 Mon Sep 17 00:00:00 2001 From: James Addison Date: Wed, 12 Dec 2018 10:29:00 -0800 Subject: [PATCH 3/4] Ignore W504 --- setup.cfg | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup.cfg b/setup.cfg index e299fa9..31f59ba 100644 --- a/setup.cfg +++ b/setup.cfg @@ -20,4 +20,4 @@ format=pylint max-complexity = 25 max-line-length = 126 exclude = .git,__pycache__,venv,tests/ -ignore = E402, E124, W503 +ignore = E402, E124, W503, W504 From 437ae7ccee77d3612a25d9a34ae62ae6c7d0b79e Mon Sep 17 00:00:00 2001 From: Vivian <2908189+vivianho@users.noreply.github.com> Date: Thu, 6 Jun 2019 13:36:12 -0700 Subject: [PATCH 4/4] Update readme to deprecate blessclient (#53) --- README.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index a0bd2d4..ad209c4 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,7 @@ -# Blessclient +# Blessclient -- DEPRECATED + +**NOTE**: We have deprecated python-blessclient and it is no longer actively maintained. A recommended alternative is [blessclient in Go](https://github.com/chanzuckerberg/blessclient). + A client for interacting with [BLESS](https://github.com/lyft/bless) services from users' laptops. Blessclient optimizes to ensure that users can always use ssh as they normally would with a fixed key, with minimal delay. [Netflix's BLESS](https://github.com/netflix/bless) was designed to issue short-lived certificates to users after they logged into a bastion service, that would be used to authenticate the user to other hosts within the cluster. Lyft wanted to use ephemeral ssh certificates for our users too, but wanted to issue these certificates directly to users' laptops, instead of on the bastion. We were able to accomplish this by making a few modifications to Netflix's BLESS and deploying this project, blessclient, to our users' laptops. Doing this allowed Lyft to improve security by extending the existing multi-factor authentication (MFA) setup that we had with AWS to SSH, as well as simplifying our provisioning and deprovisioning process.