@cryptotaxi247 / MeshCentral / commits / 5cdfd7e0

Partial work on mobile device 2FA.

Ylian Saint-Hilaire committed Apr 13, 2021 at 19:59 UTC 5cdfd7e0b992cd938cf91ac7dc34ad7a250c03c0

4 files changed +139 -22

meshagent.js

+44

@@ -1516,6 +1516,50 @@ module.exports.CreateMeshAgent = function (parent, db, ws, req, args, domain) {

1516 }

1517 break;

1518 }

1519 + case '2faauth': {

1520 + // Validate input

1521 + if ((typeof command.url != 'string') || (typeof command.approved != 'boolean') || (command.url.startsWith('2fa://') == false)) return;

1522 +

1523 + // parse the URL

1524 + var url = null;

1525 + try { url = require('url').parse(command.url); } catch (ex) { }

1526 + if (url == null) return;

1527 +

1528 + // For now, do nothing if authentication is not approved.

1529 + if (command.approve == false) return;

1530 +

1531 + // Decode the cookie

1532 + var urlSplit = url.query.split('&c=');

1533 + if (urlSplit.length != 2) return;

1534 + const authCookie = parent.parent.decodeCookie(urlSplit[1], null, 1);

1535 + if ((authCookie == null) || (typeof authCookie.c != 'string') || (('code=' + authCookie.c) != urlSplit[0])) return;

1536 + if ((typeof authCookie.n != 'string') || (authCookie.n != obj.dbNodeKey) || (typeof authCookie.u != 'string')) return;

1537 +

1538 + // Fetch the user

1539 + const user = parent.users[authCookie.u];

1540 + if (user == null) return;

1541 +

1542 + // Add this device as the authentication push notification device for this user

1543 + if (authCookie.a == 'addAuth') {

1544 + // Change the user

1545 + user.otpdev = obj.dbNodeKey;

1546 + parent.db.SetUser(user);

1547 +

1548 + // Notify change

1549 + var targets = ['*', 'server-users', user._id];

1550 + if (user.groups) { for (var i in user.groups) { targets.push('server-users:' + i); } }

1551 + var event = { etype: 'user', userid: user._id, username: user.name, account: parent.CloneSafeUser(user), action: 'accountchange', msgid: 113, msg: "Added push notification authentication device", domain: domain.id };

1552 + if (db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to change the user. Another event will come.

1553 + parent.parent.DispatchEvent(targets, obj, event);

1554 + }

1555 +

1556 + // Complete 2FA checking

1557 + if (authCookie.a == 'checkAuth') {

1558 + // TODO

1559 + }

1560 +

1561 + break;

1562 + }

1563 default: {

1564 parent.agentStats.unknownAgentActionCount++;

1565 parent.parent.debug('agent', 'Unknown agent action (' + obj.remoteaddrport + '): ' + JSON.stringify(command) + '.');

meshuser.js

+64 -21

@@ -1284,7 +1284,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use

1284 break;

1285 }

1286 case 'showpaths': {

1287 - r = 'Parent: ' + parent.parent.parentpath + '\r\n';

1287 + r = 'Parent: ' + parent.parent.parentpath + '\r\n';

1288 r += 'Data: ' + parent.parent.datapath + '\r\n';

1289 r += 'Files: ' + parent.parent.filespath + '\r\n';

1290 r += 'Backup: ' + parent.parent.backuppath + '\r\n';

@@ -1338,7 +1338,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use

1338 }

1339 case 'relays': {

1340 for (var i in parent.wsrelays) {

1341 - r += 'id: ' + i + ', ' + ((parent.wsrelays[i].state == 2)?'connected':'pending');

1341 + r += 'id: ' + i + ', ' + ((parent.wsrelays[i].state == 2) ? 'connected' : 'pending');

1342 if (parent.wsrelays[i].peer1 != null) {

1343 r += ', ' + cleanRemoteAddr(parent.wsrelays[i].peer1.req.clientIp);

1344 if (parent.wsrelays[i].peer1.user) { r += ' (User:' + parent.wsrelays[i].peer1.user.name + ')' }

@@ -1864,7 +1864,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use

1864 case 'adduserbatch':

1865 {

1866 var err = null;

1867 -

1867 +

1868 // Add many new user accounts

1869 if ((user.siteadmin & 2) == 0) { err = 'Access denied'; }

1870 else if ((domain.auth == 'sspi') || (domain.auth == 'ldap')) { err = 'Unable to create users when in SSPI or LDAP mode'; }

@@ -1881,13 +1881,13 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use

1881 userCount++;

1882 }

1883 }

1884 -

1884 +

1885 // Handle any errors

1886 if (err != null) {

1887 if (command.responseid != null) { try { ws.send(JSON.stringify({ action: 'adduserbatch', responseid: command.responseid, result: err })); } catch (ex) { } }

1888 break;

1889 }

1890 -

1890 +

1891 // Check if we exceed the maximum number of user accounts

1892 db.isMaxType(domain.limits.maxuseraccounts + userCount, 'user', domain.id, function (maxExceed) {

1893 if (maxExceed) {

@@ -2249,7 +2249,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use

2249 // We are not user group administrator, return a list with limited data for our domain.

2250 var groups = {}, groupCount = 0;

2251 for (var i in parent.userGroups) { if (parent.userGroups[i].domain == domain.id) { groupCount++; groups[i] = { name: parent.userGroups[i].name }; } }

2252 - try { ws.send(JSON.stringify({ action: 'usergroups', ugroups: groupCount?groups:null, tag: command.tag })); } catch (ex) { }

2252 + try { ws.send(JSON.stringify({ action: 'usergroups', ugroups: groupCount ? groups : null, tag: command.tag })); } catch (ex) { }

2253 } else {

2254 // We are user group administrator, return a full user group list for our domain.

2255 var groups = {}, groupCount = 0;

@@ -2750,14 +2750,14 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use

2750 chguser.passhint = hint;

2751 }

2752 if (command.resetNextLogin === true) { chguser.passchange = -1; } else { chguser.passchange = Math.floor(Date.now() / 1000); }

2753 - delete chguser.passtype; // Remove the password type if one was present.

2754 - if (command.removeMultiFactor == true) {

2755 - if (chguser.otpekey != null) { delete chguser.otpekey; }

2756 - if (chguser.otpsecret != null) { delete chguser.otpsecret; }

2757 - if (chguser.otphkeys != null) { delete chguser.otphkeys; }

2758 - if (chguser.otpkeys != null) { delete chguser.otpkeys; }

2759 - if ((chguser.otpekey != null) && (((typeof domain.passwordrequirements != 'object') || (domain.passwordrequirements.email2factor != false)) && (domain.mailserver != null))) { delete chguser.otpekey; }

2760 - if ((chguser.phone != null) && (parent.parent.smsserver != null)) { delete chguser.phone; }

2753 + delete chguser.passtype; // Remove the password type if one was present.

2754 + if (command.removeMultiFactor === true) {

2755 + delete chguser.otpkeys; // One time backup codes

2756 + delete chguser.otpsecret; // OTP Google Authenticator

2757 + delete chguser.otphkeys; // FIDO keys

2758 + delete chguser.otpekey; // Email 2FA

2759 + delete chguser.phone; // SMS 2FA

2760 + delete chguser.otpdev; // Push notification 2FA

2761 }

2762 db.SetUser(chguser);

2763

@@ -3096,7 +3096,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use

3096

3097 // Handle any errors

3098 if (err != null) { if (command.responseid != null) { try { ws.send(JSON.stringify({ action: 'editmesh', responseid: command.responseid, result: err })); } catch (ex) { } } break; }

3099 -

3099 +

3100 change = '';

3101

3102 // Check if this user has rights to do this

@@ -3126,7 +3126,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use

3126 }

3127 if (dup != null) {

3128 // A duplicate was found, don't allow this change.

3129 - displayNotificationMessage("Error, invite code \"" + dup + "\" already in use.", "Invite Codes", null, 6, 22, [ dup ]);

3129 + displayNotificationMessage("Error, invite code \"" + dup + "\" already in use.", "Invite Codes", null, 6, 22, [dup]);

3130 return;

3131 }

3132 mesh.invite = { codes: command.invite.codes, flags: command.invite.flags };

@@ -3366,7 +3366,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use

3366 node.links[newuserid] = { rights: command.rights }

3367 nodeChanged = true;

3368 }

3369 -

3369 +

3370 // Save the user to the database

3371 if (newuserid.startsWith('user/')) {

3372 db.SetUser(newuser);

@@ -4003,13 +4003,13 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use

4003 command.nodeids = nodeids;

4004 }

4005 } catch (ex) { console.log(ex); err = "Validation exception: " + ex; }

4006 -

4006 +

4007 // Handle any errors

4008 if (err != null) {

4009 if (command.responseid != null) { try { ws.send(JSON.stringify({ action: 'toast', responseid: command.responseid, result: err })); } catch (ex) { } }

4010 break;

4011 }

4012 -

4012 +

4013 for (i in command.nodeids) {

4014 // Get the node and the rights for this node

4015 parent.GetNodeWithRights(domain, user, command.nodeids[i], function (node, rights, visible) {

@@ -4361,7 +4361,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use

4361

4362 // Check input

4363 if (typeof command.enabled != 'boolean') return;

4364 -

4364 +

4365 // See if we really need to change the state

4366 if ((command.enabled === true) && (user.otpekey != null)) return;

4367 if ((command.enabled === false) && (user.otpekey == null)) return;

@@ -4374,7 +4374,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use

4374 // Notify change

4375 var targets = ['*', 'server-users', user._id];

4376 if (user.groups) { for (var i in user.groups) { targets.push('server-users:' + i); } }

4377 - var event = { etype: 'user', userid: user._id, username: user.name, account: parent.CloneSafeUser(user), action: 'accountchange', msgid: command.enabled ? 88 : 89, msg: command.enabled ? "Enabled email two-factor authentication." :"Disabled email two-factor authentication.", domain: domain.id };

4377 + var event = { etype: 'user', userid: user._id, username: user.name, account: parent.CloneSafeUser(user), action: 'accountchange', msgid: command.enabled ? 88 : 89, msg: command.enabled ? "Enabled email two-factor authentication." : "Disabled email two-factor authentication.", domain: domain.id };

4378 if (db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to change the user. Another event will come.

4379 parent.parent.DispatchEvent(targets, obj, event);

4380 break;

@@ -4588,6 +4588,49 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use

4588 }

4589 });

4590

4591 + break;

4592 + }

4593 + case 'otpdev-clear':

4594 + {

4595 + // Remove the authentication push notification device

4596 + if (user.otpdev != null) {

4597 + // Change the user

4598 + user.otpdev = obj.dbNodeKey;

4599 + parent.db.SetUser(user);

4600 +

4601 + // Notify change

4602 + var targets = ['*', 'server-users', user._id];

4603 + if (user.groups) { for (var i in user.groups) { targets.push('server-users:' + i); } }

4604 + var event = { etype: 'user', userid: user._id, username: user.name, account: parent.CloneSafeUser(user), action: 'accountchange', msgid: 114, msg: "Removed push notification authentication device", domain: domain.id };

4605 + if (db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to change the user. Another event will come.

4606 + parent.parent.DispatchEvent(targets, obj, event);

4607 + }

4608 + break;

4609 + }

4610 + case 'otpdev-set':

4611 + {

4612 + // Attempt to add a authentication push notification device

4613 + // This will only send a push notification to the device, the device needs to confirm for the auth device to be added.

4614 + if (common.validateString(command.nodeid, 1, 1024) == false) break; // Check nodeid

4615 + parent.GetNodeWithRights(domain, user, command.nodeid, function (node, rights, visible) {

4616 + // Only allow use of devices with full rights

4617 + if ((node == null) || (visible == false) || (rights != 0xFFFFFFFF) || (node.agent == null) || (node.agent.id != 14) || (node.pmt == null)) return;

4618 +

4619 + // Encode the cookie

4620 + const code = Buffer.from(user.name).toString('base64');

4621 + const authCookie = parent.parent.encodeCookie({ a: 'addAuth', c: code, u: user._id, n: node._id });

4622 +

4623 + // Send out a push message to the device

4624 + var payload = { notification: { title: "MeshCentral", body: user.name + " authentication" }, data: { url: '2fa://auth?code=' + code + '&c=' + authCookie } };

4625 + var options = { priority: 'High', timeToLive: 60 }; // TTL: 1 minute

4626 + parent.parent.firebase.sendToDevice(node, payload, options, function (id, err, errdesc) {

4627 + if (err == null) {

4628 + parent.parent.debug('email', 'Successfully auth addition send push message to device ' + node.name);

4629 + } else {

4630 + parent.parent.debug('email', 'Failed auth addition push message to device ' + node.name + ', error: ' + errdesc);

4631 + }

4632 + });

4633 + });

4634 break;

4635 }

4636 case 'webauthn-startregister':

views/default.handlebars

+30 -1

@@ -363,6 +363,7 @@

363 <div id="manageEmail2FA"><div class="p2AccountActions"><span id="authEmailSetupCheck"><strong>✓</strong></span></div><span><a href=# onclick="return account_manageAuthEmail()">Manage email authentication</a><br /></span></div>

364 <div id="manageAuthApp"><div class="p2AccountActions"><span id="authAppSetupCheck"><strong>✓</strong></span></div><span><a href=# onclick="return account_manageAuthApp()">Manage authenticator app</a><br /></span></div>

365 <div id="manageHardwareOtp"><div class="p2AccountActions"><span id="authKeySetupCheck"><strong>✓</strong></span></div><span><a href=# onclick="return account_manageHardwareOtp(0)">Manage security keys</a><br /></span></div>

366 + <div id="managePushAuthDev"><div class="p2AccountActions"><span id="authPushAuthDevCheck"><strong>✓</strong></span></div><span><a href=# onclick="return account_managePushAuthDev()">Manage push authentication</a><br /></span></div>

367 <div id="manageOtp"><div class="p2AccountActions"><span id="authCodesSetupCheck"><strong>✓</strong></span></div><span><a href=# onclick="return account_manageOtp(0)">Manage backup codes</a><br /></span></div>

368 <div class="p2AccountActions"></div><span><a href=# onclick="return account_viewPreviousLogins()">View previous logins</a><br /></span>

369 </div>

@@ -2029,6 +2030,7 @@

2030 QV('authEmailSetupCheck', (userinfo.otpekey == 1) && (userinfo.email != null) && (userinfo.emailVerified == true));

2031 QV('authAppSetupCheck', userinfo.otpsecret == 1);

2032 QV('authKeySetupCheck', userinfo.otphkeys > 0);

2033 + QV('authPushAuthDevCheck', (userinfo.otpdev > 0) && ((features2 & 2) != 0));

2034 QV('authCodesSetupCheck', userinfo.otpkeys > 0);

2035 mainUpdate(4 + 128 + 4096);

2036

@@ -10052,6 +10054,31 @@

10054 return false;

10055 }

10056

10057 + function account_managePushAuthDev() {

10058 + if (xxdialogMode || ((features2 & 2) == 0)) return;

10059 + if (userinfo.otpdev == 1) {

10060 + // Remove the 2FA device

10061 + setDialogMode(2, "Authentication Device", 3, function () { meshserver.send({ action: 'otpdev-clear' }); }, "Confirm removal of push authentication device?");

10062 + } else {

10063 + // Create a list of all mobile devices

10064 + var mobileDevices = [];

10065 + for (var i in nodes) { var node = nodes[i]; if ((node.agent != null) && (node.agent.id == 14) && (node.pmt == 1) && (GetNodeRights(node) == 0xFFFFFFFF)) { mobileDevices.push(node); } }

10066 + if (mobileDevices.length == 0) {

10067 + // No mobile devices found

10068 + setDialogMode(2, "Authentication Device", 1, null, "In order to use push notification authentication, a mobile device must be setup in your account with full rights.");

10069 + } else {

10070 + // Set a 2FA device

10071 + var x = "Select a device to register for push notification authentication. Once selected, the device will prompt for confirmation." + '<br /><br />';

10072 + var y = '<select id=d2devselect style=width:240px>';

10073 + for (var i in mobileDevices) { y += '<option value="' + mobileDevices[i]._id + '">' + EscapeHtml(mobileDevices[i].name) + '</option>'; }

10074 + y += '</select>';

10075 + x += addHtmlValue("Device", y);

10076 + setDialogMode(2, "Authentication Device", 3, function () { meshserver.send({ action: 'otpdev-set', nodeid: Q('d2devselect').value }); }, x);

10077 + }

10078 + }

10079 + return false;

10080 + }

10081 +

10082 function account_manageHardwareOtp() {

10083 if ((xxdialogMode == 2) && (xxdialogTag == 'otpauth-hardware-manage')) { dialogclose(0); }

10084 if (xxdialogMode || ((features & 4096) == 0)) return false;

@@ -11961,7 +11988,9 @@

11988 109: "User login attempt on locked account from {0}, {1}, {2}",

11989 110: "Invalid user login attempt from {0}, {1}, {2}",

11990 111: "Device requested Intel(R) AMT ACM TLS activation, FQDN: {0}",

11964 - 112: "Ended messenger session \"{0}\" from {1} to {2}, {3} second(s)"

11991 + 112: "Ended messenger session \"{0}\" from {1} to {2}, {3} second(s)",

11992 + 113: "Added push notification authentication device",

11993 + 114: "Removed push notification authentication device"

11994 };

11995

11996 // Highlights the device being hovered

webserver.js

@@ -6642,6 +6642,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {

6642 if ((typeof user2.otpsecret == 'string') && (user2.otpsecret != null)) { user2.otpsecret = 1; } // Indicates a time secret is present.

6643 if ((typeof user2.otpkeys == 'object') && (user2.otpkeys != null)) { user2.otpkeys = 0; if (user.otpkeys != null) { for (var i = 0; i < user.otpkeys.keys.length; i++) { if (user.otpkeys.keys[i].u == true) { user2.otpkeys = 1; } } } } // Indicates the number of one time backup codes that are active.

6644 if ((typeof user2.otphkeys == 'object') && (user2.otphkeys != null)) { user2.otphkeys = user2.otphkeys.length; } // Indicates the number of hardware keys setup

6645 + if ((typeof user2.otpdev == 'string') && (user2.otpdev != null)) { user2.otpdev = 1; } // Indicates device for 2FA push notification

6646 if ((typeof user2.webpush == 'object') && (user2.webpush != null)) { user2.webpush = user2.webpush.length; } // Indicates the number of web push sessions we have

6647 return user2;

6648 }