Feature Request - Allow Greater Session Customization Based on Object Attributes

[adparis99]

Hello there!

The idea of this feature request is somewhat two-fold:

• Allow for the customization of session options via the config file
• Allow for the entirety of an object's attribute set to be available for use in those options and others

Some sample use cases:

• Sessions created from virtual machine objects having their connection protocol set to RDP (as opposed to the current default of SSH2)
• Sessions created from devices with a particular custom field value having their connection protocol set to telnet or another protocol of the user's choice (we have a number of legacy devices that don't support SSH)
• Sessions created from objects in a given tenant having one set of credentials, while sessions created from objects in another tenant have a different set

I imagine the end-user implementation in the config file would look something like this:

netbox_url: https://nb-prod.domain.com
netbox_token: 12345678
root_path: NetBox
session_options:
    connection_protocol: {{ 'RDP' if obj.type is virtual_machine else obj.cf.my_custom_field }} # <<< example logic
    credential: {{ }} # <<< more logic here
...

Let me know what you think.

[patrickfnielsen]

I like the idea, and actually have a use case in our team for connection_protocol changes as well. I'll have a look at how to tackle this in a fleksible way - your suggestion is definitely not bad!

[patrickfnielsen]

I have played around with a few things, and found the following to be pretty flexible (but breaking change in the config):

netbox_url: <url>e
netbox_token: <token>
root_path: NetBox
periodic_sync_enable: true
periodic_sync_interval: 120

session:
  path: "{tenant_name}/{region_name}/{site_name}/{device_role}"
  device_name: "{device_name}"
  session_options:
    connection_protocol: "{{ findTag(device.Tags, 'connection_protocol') ?? 'SSH' }}"
    credential: t0_panie

  overrides:
    - target: path
      condition: "{{ site_group == 'test' }}"
      value: _Test/{region_name}/{site_name}

    - target: path
      condition: "{{ type == 'virtual_machine' }}"
      value: _Servers/{region_name}

    - target: device_name
      condition: "{{ device_name endsWith '.1' }}"
      value: "{{ replace(device_name, '.1', '') }}"

Overrides have the following values: target: The target attribute to override, can be one of: path, device_name, description, credentials, connection_protocol condition: Any expression that returns true or false value: The value to apply, can also be an expression

Expressions use https://expr-lang.org/ - and they have access to the device, and site (and a number of predefined options that should be documented).

Do you think the above would fit the use-case you had in mind? If you look at the expression in connection_protocol you can see how I have used a tag to be able to override it, and default to SSH.

[stranden]

Hi Patrick,

Would it be possible to implement support for proxy/jumphost connections with this approach?

session:
  path: "{tenant_name}/{region_name}/{site_name}/{device_role}"
  device_name: "{device_name}"
  session_options:
    connection_protocol: "{{ findTag(device.Tags, 'connection_protocol') ?? 'SSH' }}"
    proxy: "{{ findTag(device.Tags, 'proxy') ?? 'None' }}"

I can create a separate issue for it if you think that is needed.

[patrickfnielsen]

@stranden that should be easy enough to add - though currently it would have to be the absolute path, so like NetBox/_Servers/Denmark/jumphost01.test.com or jumphost01.test.com if it is defined at the root outside of the netbox sync.

[stranden]

Sounds good @patrickfnielsen!

I think it would be possible to override the path for the jumphost, and then have the tag proxy: NetBox/jumphost01.test.com (which must match your override?)

netbox_url: <url>e
netbox_token: <token>
root_path: NetBox
periodic_sync_enable: true
periodic_sync_interval: 120

session:
  path: "{tenant_name}/{region_name}/{site_name}/{device_role}"
  device_name: "{device_name}"
  session_options:
    connection_protocol: "{{ findTag(device.Tags, 'connection_protocol') ?? 'SSH' }}"
    proxy: "{{ findTag(device.Tags, 'proxy') ?? 'None' }}"
    credential: t0_panie

  overrides:
    - target: path
      condition: "{{ device_name == 'jumphost01.test.com' }}"
      value: {device_name}

I think this is an awesome project! 👍

[patrickfnielsen]

My work in progress branch is up here: https://github.com/jysk-oss/netbox-securecrt-inventory/tree/session-customization - I hope to be able to cut a release sometime next week.