Added support for banning common passwords.
Ylian Saint-Hilaire committed
Aug 16, 2020 at 13:44 UTC
29a0392df3a1146fef6a5fe572e16fa7e4bd1ceb
5 files changed
+36
-11
meshcentral-config-schema.json
+2
-1
@@ -160,7 +160,8 @@
160
"reset": { "type": "integer", "description": "Number of days after which the user is required to change the account password." },
161
"force2factor": { "type": "boolean", "description": "Requires that all accounts setup 2FA." },
162
"skip2factor": { "type": "string", "description": "IP addresses where 2FA login is skipped, for example: 127.0.0.1,192.168.2.0/24" },
163
- "oldPasswordBan": { "type": "integer", "description": "Number of old passwords the server should remember and not allow the user to switch back to." }
163
+ "oldPasswordBan": { "type": "integer", "description": "Number of old passwords the server should remember and not allow the user to switch back to." },
164
+ "banCommonPasswords": { "type": "boolean", "description": "Uses WildLeek to block use of the 10000 most commonly used passwords." }
165
}
166
},
167
"agentInviteCodes": { "type": "boolean", "default": false, "description": "Enabled a feature where you can set one or more invitation codes in a device group. You can then give a invitation link to users who can use it to download the agent." },
meshcentral.js
+8
-3
@@ -2646,6 +2646,9 @@ function mainStart() {
2646
// Lowercase the auth value if present
2647
for (var i in config.domains) { if (typeof config.domains[i].auth == 'string') { config.domains[i].auth = config.domains[i].auth.toLowerCase(); } }
2648
2649
+ // Get the current node version
2650
+ var nodeVersion = Number(process.version.match(/^v(\d+\.\d+)/)[1]);
2651
+
2652
// Check if Windows SSPI, LDAP, Passport and YubiKey OTP will be used
2653
var sspi = false;
2654
var ldap = false;
@@ -2655,6 +2658,7 @@ function mainStart() {
2658
var mstsc = false;
2659
var recordingIndex = false;
2660
var domainCount = 0;
2661
+ var wildleek = false;
2662
if (require('os').platform() == 'win32') { for (var i in config.domains) { domainCount++; if (config.domains[i].auth == 'sspi') { sspi = true; } else { allsspi = false; } } } else { allsspi = false; }
2663
if (domainCount == 0) { allsspi = false; }
2664
for (var i in config.domains) {
@@ -2672,11 +2676,9 @@ function mainStart() {
2676
if ((typeof config.domains[i].authstrategies.saml == 'object') || (typeof config.domains[i].authstrategies.jumpcloud == 'object')) { passport.push('passport-saml'); }
2677
}
2678
if ((config.domains[i].sessionrecording != null) && (config.domains[i].sessionrecording.index == true)) { recordingIndex = true; }
2679
+ if ((config.domains[i].passwordrequirements != null) && (config.domains[i].passwordrequirements.bancommonpasswords == true)) { if (nodeVersion < 8) { config.domains[i].passwordrequirements = false; addServerWarning('Common password checking requires NodeJS v8 or above.'); } else { wildleek = true; } }
2680
}
2681
2677
- // Get the current node version
2678
- var nodeVersion = Number(process.version.match(/^v(\d+\.\d+)/)[1]);
2679
-
2682
// Build the list of required modules
2683
var modules = ['ws', 'cbor', 'nedb', 'https', 'yauzl', 'xmldom', 'ipcheck', 'express', 'archiver@4.0.2', 'multiparty', 'node-forge', 'express-ws', 'compression', 'body-parser', 'connect-redis', 'cookie-session', 'express-handlebars'];
2684
if (require('os').platform() == 'win32') { modules.push('node-windows@0.1.14'); if (sspi == true) { modules.push('node-sspi'); } } // Add Windows modules
@@ -2702,6 +2704,9 @@ function mainStart() {
2704
// Setup encrypted zip support if needed
2705
if (config.settings.autobackup && config.settings.autobackup.zippassword) { modules.push('archiver-zip-encrypted'); }
2706
2707
+ // Setup common password blocking
2708
+ if (wildleek == true) { modules.push('wildleek@2.0.0'); }
2709
+
2710
// Setup 2nd factor authentication
2711
if (config.settings.no2factorauth !== true) {
2712
// Setup YubiKey OTP if configured
meshuser.js
+4
-1
@@ -2375,9 +2375,12 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
2375
parent.checkUserPassword(domain, user, command.oldpass, function (result) {
2376
if (result == true) {
2377
parent.checkOldUserPasswords(domain, user, command.newpass, function (result) {
2378
- if (result == true) {
2378
+ if (result == 1) {
2379
// Send user notification of error
2380
displayNotificationMessage('Error, unable to change to previously used password.', 'Account Settings', 'ServerNotify');
2381
+ } else if (result == 2) {
2382
+ // Send user notification of error
2383
+ displayNotificationMessage('Error, unable to change to commonly used password.', 'Account Settings', 'ServerNotify');
2384
} else {
2385
// Update the password
2386
require('./pass').hash(command.newpass, function (err, salt, hash, tag) {
sample-config-advanced.json
+3
-1
@@ -136,7 +136,9 @@
136
"nonalpha": 1,
137
"reset": 90,
138
"force2factor": true,
139
- "skip2factor": "127.0.0.1,192.168.2.0/24"
139
+ "skip2factor": "127.0.0.1,192.168.2.0/24",
140
+ "oldPasswordBan": 5,
141
+ "banCommonPasswords": false
142
},
143
"_agentInviteCodes": true,
144
"_agentNoProxy": true,
webserver.js
+19
-5
@@ -1289,7 +1289,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1289
1290
// Check if the password is the same as a previous one
1291
obj.checkOldUserPasswords(domain, user, req.body.rpassword1, function (result) {
1292
- if (result == true) {
1292
+ if (result != 0) {
1293
// This is the same password as an older one, request a password change again
1294
parent.debug('web', 'handleResetPasswordRequest: password rejected, use a different one (2)');
1295
req.session.loginmode = '6';
@@ -1870,6 +1870,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1870
}
1871
1872
// Check a user's old passwords
1873
+ // Callback: 0=OK, 1=OldPass, 2=CommonPass
1874
obj.checkOldUserPasswords = function (domain, user, password, func) {
1875
// Check how many old passwords we need to check
1876
if ((typeof domain.passwordrequirements.oldpasswordban == 'number') && (domain.passwordrequirements.oldpasswordban > 0)) {
@@ -1884,11 +1885,21 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1885
// If there is no old passwords, exit now.
1886
var oldPassCount = 1;
1887
if (user.oldpasswords != null) { oldPassCount += user.oldpasswords.length; }
1887
- var oldPassCheckState = { response: false, count: oldPassCount, user: user, func: func };
1888
+ var oldPassCheckState = { response: 0, count: oldPassCount, user: user, func: func };
1889
+
1890
+ // Test against common passwords if this feature is enabled
1891
+ // Example of common passwords: 123456789, password123
1892
+ if ((domain.passwordrequirements != null) && (domain.passwordrequirements.bancommonpasswords == true)) {
1893
+ oldPassCheckState.count++;
1894
+ require('wildleek')(password).then(function (wild) {
1895
+ if (wild == true) { oldPassCheckState.response = 2; }
1896
+ if (--oldPassCheckState.count == 0) { oldPassCheckState.func(oldPassCheckState.response); }
1897
+ });
1898
+ }
1899
1900
// Try current password
1901
require('./pass').hash(password, user.salt, function oldPassCheck(err, hash, tag) {
1891
- if ((err == null) && (hash == tag.user.hash)) { tag.response = true; }
1902
+ if ((err == null) && (hash == tag.user.hash)) { tag.response = 1; }
1903
if (--tag.count == 0) { tag.func(tag.response); }
1904
}, oldPassCheckState);
1905
@@ -1898,7 +1909,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1909
const oldpassword = user.oldpasswords[i];
1910
// Default strong password hashing (pbkdf2 SHA384)
1911
require('./pass').hash(password, oldpassword.salt, function oldPassCheck(err, hash, tag) {
1901
- if ((err == null) && (hash == tag.oldPassword.hash)) { tag.state.response = true; }
1912
+ if ((err == null) && (hash == tag.oldPassword.hash)) { tag.state.response = 1; }
1913
if (--tag.state.count == 0) { tag.state.func(tag.state.response); }
1914
}, { oldPassword: oldpassword, state: oldPassCheckState });
1915
}
@@ -1939,9 +1950,12 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1950
if (result == true) {
1951
// Check if the new password is allowed, only do this if this feature is enabled.
1952
parent.checkOldUserPasswords(domain, user, command.newpass, function (result) {
1942
- if (result == true) {
1953
+ if (result == 1) {
1954
parent.debug('web', 'handlePasswordChangeRequest: old password reuse attempt.');
1955
if (direct === true) { handleRootRequestEx(req, res, domain); } else { res.redirect(domain.url + getQueryPortion(req)); }
1956
+ } else if (result == 2) {
1957
+ parent.debug('web', 'handlePasswordChangeRequest: commonly used password use attempt.');
1958
+ if (direct === true) { handleRootRequestEx(req, res, domain); } else { res.redirect(domain.url + getQueryPortion(req)); }
1959
} else {
1960
// Update the password
1961
require('./pass').hash(req.body.apassword1, function (err, salt, hash, tag) {