62 lines
2.5 KiB
Markdown
62 lines
2.5 KiB
Markdown
|
# 审计 — 3389 独立 RDP 主机（rdp_hosts）
|
|||
|
|
|
|||
|
|
**Changelog**: `docs/changelog/2026-06-10-rdp-hosts-standalone.md`
|
|||
|
|
|
|||
|
|
## 变更文件
|
|||
|
|
|
|||
|
|
| 文件 | 说明 |
|
|||
|
|
|------|------|
|
|||
|
|
| `server/domain/models/__init__.py` | `RdpHost` 模型 |
|
|||
|
|
| `server/infrastructure/database/migrations.py` | `rdp_hosts` 表 |
|
|||
|
|
| `server/infrastructure/database/rdp_host_repo.py` | 仓储 |
|
|||
|
|
| `server/api/rdp_hosts.py` | CRUD + connect REST |
|
|||
|
|
| `server/api/rdp.py` | WS `/ws/rdp/hosts/{host_id}` |
|
|||
|
|
| `server/main.py` | 注册 `rdp_hosts_router` |
|
|||
|
|
| `frontend/src/pages/RdpPage.vue` | 列表/添加/连接 |
|
|||
|
|
| `frontend/src/components/rdp/RdpHostFormDialog.vue` | 添加/编辑对话框 |
|
|||
|
|
| `frontend/src/composables/rdp/useRdpHostList.ts` | 列表与 CUD |
|
|||
|
|
| `frontend/src/composables/rdp/useRdpSession.ts` | 改连 `rdp_hosts` |
|
|||
|
|
| `frontend/src/components/servers/ServerFormDialog.vue` | 移除 RDP 区块 |
|
|||
|
|
| `frontend/src/composables/servers/useServerFormDialog.ts` | 移除 rdp 字段 |
|
|||
|
|
| `frontend/src/pages/ServersPage.vue` | 移除 RDP 跳转 |
|
|||
|
|
| `tests/test_rdp_hosts.py` | 模型/端口单测 |
|
|||
|
|
|
|||
|
|
## 入口表
|
|||
|
|
|
|||
|
|
| 方法 | 路径 | 鉴权 | 说明 |
|
|||
|
|
|------|------|------|------|
|
|||
|
|
| GET | `/api/rdp/hosts/` | admin JWT | 列表（无密码） |
|
|||
|
|
| POST | `/api/rdp/hosts/` | admin JWT + 审计 | 创建，密码 Fernet |
|
|||
|
|
| PUT | `/api/rdp/hosts/{id}` | admin JWT + 审计 | 更新 |
|
|||
|
|
| DELETE | `/api/rdp/hosts/{id}` | admin JWT + 审计 | 删除 |
|
|||
|
|
| GET | `/api/rdp/hosts/{id}/connect` | admin JWT | 返回明文密码供 Guacamole |
|
|||
|
|
| WS | `/ws/rdp/hosts/{id}?token=` | access JWT | guacd 透明桥 |
|
|||
|
|
|
|||
|
|
## Step 3（规则扫描）
|
|||
|
|
|
|||
|
|
| 规则 | 结论 | 说明 |
|
|||
|
|
|------|------|------|
|
|||
|
|
| 鉴权 | PASS | 全部 REST/WS 需管理员 JWT |
|
|||
|
|
| IDOR | PASS（平台模型） | 与终端一致：管理员可连任意 RDP 主机 |
|
|||
|
|
| 密钥落库 | PASS | `password` 列 Fernet；列表仅 `password_set` |
|
|||
|
|
| 明文 connect | RISK 接受 | Guacamole 客户端必需；HTTPS |
|
|||
|
|
| CUD 审计 | PASS | create/update/delete_rdp_host |
|
|||
|
|
| guacd | PASS | 仍仅内网侧车 |
|
|||
|
|
| 静默吞错 | PASS | API HTTPException；WS close code |
|
|||
|
|
|
|||
|
|
## Closure（走读）
|
|||
|
|
|
|||
|
|
| 文件 | 结论 |
|
|||
|
|
|------|------|
|
|||
|
|
| `rdp_hosts.py` | SAFE — 名称唯一 IntegrityError→409；connect 校验 guacd |
|
|||
|
|
| `rdp_host_repo.py` | SAFE — 标准 CRUD |
|
|||
|
|
| `rdp.py` | SAFE — host 存在性校验后桥接 |
|
|||
|
|
| `RdpPage.vue` | SAFE — 无 v-html；添加后 `host_id` 连接 |
|
|||
|
|
| `useRdpHostList.ts` | SAFE — formatApiError |
|
|||
|
|
|
|||
|
|
## DoD
|
|||
|
|
|
|||
|
|
- [x] changelog + 本审计
|
|||
|
|
- [x] `local_verify` + type-check
|
|||
|
|
- [ ] 生产部署与浏览器验收
|