new --createaccount and improved --resetaccount and --adminaccount.
Ylian Saint-Hilaire committed
Apr 20, 2020 at 16:59 UTC
582273fa97a77a4c540c0d5e24aa5bad7695967b
1 file changed
+31
-14
meshcentral.js
+31
-14
@@ -128,7 +128,7 @@ function CreateMeshCentralServer(config, args) {
128
try { require('./pass').hash('test', function () { }, 0); } catch (e) { console.log('Old version of node, must upgrade.'); return; } // TODO: Not sure if this test works or not.
129
130
// Check for invalid arguments
131
- var validArguments = ['_', 'notls', 'user', 'port', 'aliasport', 'mpsport', 'mpsaliasport', 'redirport', 'rediraliasport', 'cert', 'mpscert', 'deletedomain', 'deletedefaultdomain', 'showall', 'showusers', 'listuserids', 'showusergroups', 'shownodes', 'showmeshes', 'showevents', 'showsmbios', 'showpower', 'clearpower', 'showiplocations', 'help', 'exactports', 'xinstall', 'xuninstall', 'install', 'uninstall', 'start', 'stop', 'restart', 'debug', 'filespath', 'datapath', 'noagentupdate', 'launch', 'noserverbackup', 'mongodb', 'mongodbcol', 'wanonly', 'lanonly', 'nousers', 'mpspass', 'ciralocalfqdn', 'dbexport', 'dbexportmin', 'dbimport', 'dbmerge', 'dbencryptkey', 'selfupdate', 'tlsoffload', 'userallowedip', 'userblockedip', 'swarmallowedip', 'agentallowedip', 'agentblockedip', 'fastcert', 'swarmport', 'logintoken', 'logintokenkey', 'logintokengen', 'logintokengen', 'mailtokengen', 'admin', 'unadmin', 'sessionkey', 'sessiontime', 'minify', 'minifycore', 'dblistconfigfiles', 'dbshowconfigfile', 'dbpushconfigfiles', 'dbpullconfigfiles', 'dbdeleteconfigfiles', 'vaultpushconfigfiles', 'vaultpullconfigfiles', 'vaultdeleteconfigfiles', 'configkey', 'loadconfigfromdb', 'npmpath', 'memorytracking', 'serverid', 'recordencryptionrecode', 'vault', 'token', 'unsealkey', 'name', 'log', 'dbstats', 'translate', 'resetaccount', 'pass', 'adminaccount'];
131
+ var validArguments = ['_', 'notls', 'user', 'port', 'aliasport', 'mpsport', 'mpsaliasport', 'redirport', 'rediraliasport', 'cert', 'mpscert', 'deletedomain', 'deletedefaultdomain', 'showall', 'showusers', 'listuserids', 'showusergroups', 'shownodes', 'showmeshes', 'showevents', 'showsmbios', 'showpower', 'clearpower', 'showiplocations', 'help', 'exactports', 'xinstall', 'xuninstall', 'install', 'uninstall', 'start', 'stop', 'restart', 'debug', 'filespath', 'datapath', 'noagentupdate', 'launch', 'noserverbackup', 'mongodb', 'mongodbcol', 'wanonly', 'lanonly', 'nousers', 'mpspass', 'ciralocalfqdn', 'dbexport', 'dbexportmin', 'dbimport', 'dbmerge', 'dbencryptkey', 'selfupdate', 'tlsoffload', 'userallowedip', 'userblockedip', 'swarmallowedip', 'agentallowedip', 'agentblockedip', 'fastcert', 'swarmport', 'logintoken', 'logintokenkey', 'logintokengen', 'logintokengen', 'mailtokengen', 'admin', 'unadmin', 'sessionkey', 'sessiontime', 'minify', 'minifycore', 'dblistconfigfiles', 'dbshowconfigfile', 'dbpushconfigfiles', 'dbpullconfigfiles', 'dbdeleteconfigfiles', 'vaultpushconfigfiles', 'vaultpullconfigfiles', 'vaultdeleteconfigfiles', 'configkey', 'loadconfigfromdb', 'npmpath', 'memorytracking', 'serverid', 'recordencryptionrecode', 'vault', 'token', 'unsealkey', 'name', 'log', 'dbstats', 'translate', 'createaccount', 'resetaccount', 'pass', 'adminaccount', 'domain', 'email'];
132
for (var arg in obj.args) { obj.args[arg.toLocaleLowerCase()] = obj.args[arg]; if (validArguments.indexOf(arg.toLocaleLowerCase()) == -1) { console.log('Invalid argument "' + arg + '", use --help.'); return; } }
133
if (obj.args.mongodb == true) { console.log('Must specify: --mongodb [connectionstring] \r\nSee https://docs.mongodb.com/manual/reference/connection-string/ for MongoDB connection string.'); return; }
134
for (i in obj.config.settings) { obj.args[i] = obj.config.settings[i]; } // Place all settings into arguments, arguments have already been placed into settings so arguments take precedence.
@@ -146,13 +146,13 @@ function CreateMeshCentralServer(config, args) {
146
}
147
console.log(' --user [username] Always login as [username] if account exists.');
148
console.log(' --port [number] Web server port number.');
149
- console.log(' --mpsport [number] Intel AMT server port number.');
149
console.log(' --redirport [number] Creates an additional HTTP server to redirect users to the HTTPS server.');
150
console.log(' --exactports Server must run with correct ports or exit.');
151
console.log(' --noagentupdate Server will not update mesh agent native binaries.');
152
console.log(' --listuserids Show a list of a user identifiers in the database.');
154
- console.log(' --resetaccount [userid] Unlock an account, disable 2FA and set a new account password.');
155
- console.log(' --adminaccount [userid] Promote account to site administrator.');
153
+ console.log(' --createaccount [username] Create a new user account.');
154
+ console.log(' --resetaccount [username] Unlock an account, disable 2FA and set a new account password.');
155
+ console.log(' --adminaccount [username] Promote account to site administrator.');
156
console.log(' --cert [name], (country), (org) Create a web server certificate with [name] server name.');
157
console.log(' country and organization can optionaly be set.');
158
return;
@@ -668,22 +668,39 @@ function CreateMeshCentralServer(config, args) {
668
if (obj.args.logintokenkey) { obj.showLoginTokenKey(function (r) { console.log(r); process.exit(); }); return; }
669
if (obj.args.recordencryptionrecode) { obj.db.performRecordEncryptionRecode(function (count) { console.log('Re-encoded ' + count + ' record(s).'); process.exit(); }); return; }
670
if (obj.args.dbstats) { obj.db.getDbStats(function (stats) { console.log(stats); process.exit(); }); return; }
671
- if (obj.args.resetaccount) {
672
- if ((obj.args.pass == null) || (obj.args.pass == '') || (obj.args.resetaccount.startsWith('user/') == false)) { console.log('Usage: --resetaccount [userid] --pass [password].'); process.exit(); return; }
673
- obj.db.Get(obj.args.resetaccount, function (err, docs) {
674
- if ((err != null) || (docs == null) || (docs.length == 0)) { console.log('Unknown userid, usage: --resetaccount [userid] --pass [password].'); process.exit(); return; }
671
+ if (obj.args.createaccount) { // Create a new user account
672
+ if ((typeof obj.args.createaccount != 'string') || (obj.args.pass == null) || (obj.args.pass == '') || (obj.args.createaccount.indexOf(' ') >= 0)) { console.log("Usage: --createaccount [username] --pass [password] --domain (domain) --email (email)."); process.exit(); return; }
673
+ var userid = 'user/' + (obj.args.domain ? obj.args.domain : '') + '/' + obj.args.createaccount.toLowerCase(), domainid = obj.args.domain ? obj.args.domain : '';
674
+ obj.db.Get(userid, function (err, docs) {
675
+ if (err != null) { console.log("Database error: " + err); process.exit(); return; }
676
+ if ((docs != null) && (docs.length != 0)) { console.log('User already exists.'); process.exit(); return; }
677
+ if ((domainid != '') && ((config.domains == null) || (config.domains[domainid] == null))) { console.log("Invalid domain."); process.exit(); return; }
678
+ var user = { _id: userid, type: 'user', name: obj.args.createaccount, domain: domainid, creation: Math.floor(Date.now() / 1000), links: {} };
679
+ if (typeof obj.args.email == 'string') { user.email = obj.args.email; user.emailVerified = true; }
680
+ require('./pass').hash(obj.args.pass, function (err, salt, hash, tag) { if (err) { console.log("Unable create account password: " + err); process.exit(); return; } user.salt = salt; user.hash = hash; obj.db.Set(user, function () { console.log("Done."); process.exit(); return; }); }, 0);
681
+ });
682
+ return;
683
+ }
684
+ if (obj.args.resetaccount) { // Unlock a user account, set a new password and remove 2FA
685
+ if ((typeof obj.args.resetaccount != 'string') || (obj.args.pass == null) || (obj.args.pass == '') || (obj.args.resetaccount.indexOf(' ') >= 0)) { console.log("Usage: --resetaccount [username] --domain (domain) --pass [password]."); process.exit(); return; }
686
+ var userid = 'user/' + (obj.args.domain ? obj.args.domain : '') + '/' + obj.args.resetaccount.toLowerCase(), domainid = obj.args.domain ? obj.args.domain : '';
687
+ obj.db.Get(userid, function (err, docs) {
688
+ if (err != null) { console.log("Database error: " + err); process.exit(); return; }
689
+ if ((docs == null) || (docs.length == 0)) { console.log("Unknown username, usage: --resetaccount [username] --domain (domain) --pass [password]."); process.exit(); return; }
690
var user = docs[0]; if ((user.siteadmin) && (user.siteadmin != 0xFFFFFFFF) && (user.siteadmin & 32) != 0) { user.siteadmin -= 32; } // Unlock the account.
691
delete user.otpekey; delete user.otpsecret; delete user.otpkeys; delete user.otphkeys; // Disable 2FA
677
- require('./pass').hash(obj.args.pass, user.salt, function (err, hash, tag) { if (err) { console.log('Unable to reset password: ' + err); process.exit(); return; } user.hash = hash; obj.db.Set(user, function () { console.log('Done.'); process.exit(); return; }); }, 0);
692
+ require('./pass').hash(obj.args.pass, user.salt, function (err, hash, tag) { if (err) { console.log("Unable to reset password: " + err); process.exit(); return; } user.hash = hash; obj.db.Set(user, function () { console.log("Done."); process.exit(); return; }); }, 0);
693
});
694
return;
695
}
681
- if (obj.args.adminaccount) {
682
- if (obj.args.resetaccount.startsWith('user/') == false) { console.log('Invalid userid, usage: --adminaccount [userid].'); process.exit(); return; }
683
- obj.db.Get(obj.args.adminaccount, function (err, docs) {
684
- if ((err != null) || (docs == null) || (docs.length == 0)) { console.log('Unknown userid, usage: --adminaccount [userid].'); process.exit(); return; }
696
+ if (obj.args.adminaccount) { // Set a user account to server administrator
697
+ if ((typeof obj.args.adminaccount != 'string') || (obj.args.adminaccount.indexOf(' ') >= 0)) { console.log("Invalid userid, usage: --adminaccount [username] --domain (domain)."); process.exit(); return; }
698
+ var userid = 'user/' + (obj.args.domain ? obj.args.domain : '') + '/' + obj.args.adminaccount.toLowerCase(), domainid = obj.args.domain ? obj.args.domain : '';
699
+ obj.db.Get(userid, function (err, docs) {
700
+ if (err != null) { console.log("Database error: " + err); process.exit(); return; }
701
+ if ((docs == null) || (docs.length == 0)) { console.log("Unknown username, usage: --adminaccount [username] --domain (domain)."); process.exit(); return; }
702
docs[0].siteadmin = 0xFFFFFFFF; // Set user as site administrator
686
- obj.db.Set(docs[0], function () { console.log('Done.'); process.exit(); return; });
703
+ obj.db.Set(docs[0], function () { console.log("Done."); process.exit(); return; });
704
});
705
return;
706
}