mondoohq / cnquery

open source, cloud-native, graph-based asset inventory
https://cnquery.io
Other
323 stars 23 forks source link

ports.listening tls params not shown when queried via ssh #890

Open czunker opened 1 year ago

czunker commented 1 year ago

Describe the bug When querying tls parameters for ports, it works with local but not via ssh.

This is how it looks like on ssh:

cnquery run --sudo ssh -i /home/christian/workspace/mondoo/examples/.vagrant/machines/default/virtualbox/private_key vagrant@127.0.0.1:2222 -c "ports.listening.where(port == 443){ tls.certificates.length }" 
→ discover related assets for 1 asset(s)
→ resolved assets resolved-assets=1
ports.listening.where: [
  0: {
    tls.certificates.length: 0
  }
  1: {
    tls.certificates.length: 0
  }
]

This is how it looks like when run with local:

ports.listening.where: [
  0: {
    tls.certificates.length: 1
  }
  1: {
    tls.certificates.length: 1
  }
]

To Reproduce Steps to reproduce the behavior:

  1. Create process with TLS port
  2. Run above command
  3. See empty result.

Expected behavior Local and ssh should show the same.

Desktop (please complete the following information):

joelddiaz commented 1 year ago

I wasn't able to repro this by doing and ssh from my local system to my local system. I believe this is because the cnquery process running locally is just able to connect to the same ip/port pairs while it bypasses the ssh connection.

My guess is that we will need to tunnel the tcp connections through the ssh connection to make sure the ip/port connections resolve on the remote host instead of on the host where the cnquery binary is running.