@cryptotaxi247 / MeshCentral / commits / 08430a5f

add missing login events to duo and pushlogin

Signed-off-by: si458 <simonsmith5521@gmail.com>

si458 committed Apr 7, 2025 at 15:14 UTC 08430a5fa7b0227e8c84951cd06226e86f39943a

1 file changed +18 -1

webserver.js

+18 -1

@@ -3514,7 +3514,13 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF

3514 const twoFactorCookie = obj.parent.encodeCookie({ userid: cookie.u, expire: maxCookieAge * 24 * 60 /*, ip: req.clientIp*/ }, obj.parent.loginCookieEncryptionKey);

3515 res.cookie('twofactor', twoFactorCookie, { maxAge: (maxCookieAge * 24 * 60 * 60 * 1000), httpOnly: true, sameSite: parent.config.settings.sessionsamesite, secure: true });

3516 }

3517 -

3517 + var user = obj.users[cookie.u];

3518 + // Notify account login

3519 + var targets = ['*', 'server-users', user._id];

3520 + if (user.groups) { for (var i in user.groups) { targets.push('server-users:' + i); } }

3521 + const ua = obj.getUserAgentInfo(req);

3522 + const loginEvent = { etype: 'user', userid: user._id, username: user.name, account: obj.CloneSafeUser(user), action: 'login', msgid: 107, msgArgs: [req.clientIp, ua.browserStr, ua.osStr], msg: 'Account login', domain: domain.id, ip: req.clientIp, userAgent: req.headers['user-agent'], twoFactorType: 'pushlogin' };

3523 + obj.parent.DispatchEvent(targets, obj, loginEvent);

3524 handleRootRequestEx(req, res, domain);

3525 return;

3526 }

@@ -7067,6 +7073,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF

7073 // User credentials are stored in session, just check again and get userid

7074 obj.authenticate(sec.tuser, sec.tpass, domain, function (err, userid, passhint, loginOptions) {

7075 if ((userid != null) && (err == null)) {

7076 + var user = obj.users[userid]; // Get user object

7077 // Login data correct, now exchange authorization code for 2FA

7078 client.exchangeAuthorizationCodeFor2FAResult(req.query.duo_code, userid.split('/')[2]).then(function (data) {

7079 const sec = parent.decryptSessionData(req.session.e);

@@ -7082,6 +7089,12 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF

7089 delete sec.tpass;

7090 req.session.e = parent.encryptSessionData(sec);

7091 obj.parent.authLog('https', 'Accepted Duo authentication for ' + userid + ' from ' + req.clientIp + ':' + req.connection.remotePort, { useragent: req.headers['user-agent'], sessionid: req.session.x });

7092 + // Notify account login

7093 + var targets = ['*', 'server-users', user._id];

7094 + if (user.groups) { for (var i in user.groups) { targets.push('server-users:' + i); } }

7095 + const ua = obj.getUserAgentInfo(req);

7096 + const loginEvent = { etype: 'user', userid: user._id, username: user.name, account: obj.CloneSafeUser(user), action: 'login', msgid: 107, msgArgs: [req.clientIp, ua.browserStr, ua.osStr], msg: 'Account login', domain: domain.id, ip: req.clientIp, userAgent: req.headers['user-agent'], twoFactorType: 'duo' };

7097 + obj.parent.DispatchEvent(targets, obj, loginEvent);

7098 res.redirect(domain.url + getQueryPortion(req));

7099 }).catch(function (err) {

7100 const sec = parent.decryptSessionData(req.session.e);

@@ -7092,6 +7105,10 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF

7105 req.session.e = parent.encryptSessionData(sec);

7106 req.session.loginmode = 1;

7107 req.session.messageid = 117; // Invalid security check

7108 + // Notify account 2fa failed login

7109 + const ua = obj.getUserAgentInfo(req);

7110 + obj.parent.DispatchEvent(['*', 'server-users', user._id], obj, { action: 'authfail', username: user.name, userid: user._id, domain: domain.id, msg: 'User login attempt with incorrect 2nd factor from ' + req.clientIp, msgid: 108, msgArgs: [req.clientIp, ua.browserStr, ua.osStr] });

7111 + obj.setbad2Fa(req);

7112 res.redirect(domain.url + getQueryPortion(req));

7113 });

7114 } else {