Fixed loginkey, allow invalid login filter to be disabled.
Ylian Saint-Hilaire committed
Feb 18, 2020 at 10:57 UTC
a65396358e92512e5157a667a2ef36b984a5e23e
4 files changed
+40
-24
meshcentral.js
+10
-3
@@ -1217,10 +1217,17 @@ function CreateMeshCentralServer(config, args) {
1217
obj.DispatchEvent(['*'], obj, { etype: 'server', action: 'started', msg: 'Server started' });
1218
1219
// Plugin hook. Need to run something at server startup? This is the place.
1220
- if (obj.pluginHandler) { obj.pluginHandler.callHook("server_startup"); }
1220
+ if (obj.pluginHandler) { obj.pluginHandler.callHook('server_startup'); }
1221
1222
- // Load the login cookie encryption key from the database if allowed
1223
- if ((obj.config) && (obj.config.settings) && (obj.config.settings.allowlogintoken == true)) {
1222
+ // Setup the login cookie encryption key
1223
+ if ((obj.config) && (obj.config.settings) && (typeof obj.config.settings.logincookieencryptionkey == 'string')) {
1224
+ // We have a string, hash it and use that as a key
1225
+ try { obj.loginCookieEncryptionKey = Buffer.from(obj.config.settings.logincookieencryptionkey, 'hex'); } catch (ex) { }
1226
+ if ((obj.loginCookieEncryptionKey == null) || (obj.loginCookieEncryptionKey.length != 80)) { addServerWarning("Invalid \"LoginCookieEncryptionKey\" in config.json."); obj.loginCookieEncryptionKey = null; }
1227
+ }
1228
+
1229
+ // Login cookie encryption key not set, use one from the database
1230
+ if (obj.loginCookieEncryptionKey == null) {
1231
obj.db.Get('LoginCookieEncryptionKey', function (err, docs) {
1232
if ((docs.length > 0) && (docs[0].key != null) && (obj.args.logintokengen == null) && (docs[0].key.length >= 160)) {
1233
obj.loginCookieEncryptionKey = Buffer.from(docs[0].key, 'hex');
meshuser.js
+18
-14
@@ -700,26 +700,30 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
700
break;
701
}
702
case 'badlogins': {
703
- if (typeof parent.parent.config.settings.maxinvalidlogin.coolofftime == 'number') {
704
- r = "Max is " + parent.parent.config.settings.maxinvalidlogin.count + " bad login(s) in " + parent.parent.config.settings.maxinvalidlogin.time + " minute(s), " + parent.parent.config.settings.maxinvalidlogin.coolofftime + " minute(s) cooloff.\r\n";
703
+ if (parent.parent.config.settings.maxinvalidlogin == false) {
704
+ r = 'Bad login filter is disabled.';
705
} else {
706
- r = "Max is " + parent.parent.config.settings.maxinvalidlogin.count + " bad login(s) in " + parent.parent.config.settings.maxinvalidlogin.time + " minute(s).\r\n";
707
- }
708
- var badLoginCount = 0;
709
- parent.cleanBadLoginTable();
710
- for (var i in parent.badLoginTable) {
711
- badLoginCount++;
712
- if (typeof parent.badLoginTable[i] == 'number') {
713
- r += "Cooloff for " + Math.floor((parent.badLoginTable[i] - Date.now()) / 60000) + " minute(s)\r\n";
706
+ if (typeof parent.parent.config.settings.maxinvalidlogin.coolofftime == 'number') {
707
+ r = "Max is " + parent.parent.config.settings.maxinvalidlogin.count + " bad login(s) in " + parent.parent.config.settings.maxinvalidlogin.time + " minute(s), " + parent.parent.config.settings.maxinvalidlogin.coolofftime + " minute(s) cooloff.\r\n";
708
} else {
715
- if (parent.badLoginTable[i].length > 1) {
716
- r += (i + ' - ' + parent.badLoginTable[i].length + " records\r\n");
709
+ r = "Max is " + parent.parent.config.settings.maxinvalidlogin.count + " bad login(s) in " + parent.parent.config.settings.maxinvalidlogin.time + " minute(s).\r\n";
710
+ }
711
+ var badLoginCount = 0;
712
+ parent.cleanBadLoginTable();
713
+ for (var i in parent.badLoginTable) {
714
+ badLoginCount++;
715
+ if (typeof parent.badLoginTable[i] == 'number') {
716
+ r += "Cooloff for " + Math.floor((parent.badLoginTable[i] - Date.now()) / 60000) + " minute(s)\r\n";
717
} else {
718
- r += (i + ' - ' + parent.badLoginTable[i].length + " record\r\n");
718
+ if (parent.badLoginTable[i].length > 1) {
719
+ r += (i + ' - ' + parent.badLoginTable[i].length + " records\r\n");
720
+ } else {
721
+ r += (i + ' - ' + parent.badLoginTable[i].length + " record\r\n");
722
+ }
723
}
724
}
725
+ if (badLoginCount == 0) { r += 'No bad logins.'; }
726
}
722
- if (badLoginCount == 0) { r += 'No bad logins.'; }
727
break;
728
}
729
case 'dispatchtable': {
package.json
+1
-1
@@ -1,6 +1,6 @@
1
{
2
"name": "meshcentral",
3
- "version": "0.4.9-i",
3
+ "version": "0.4.9-j",
4
"keywords": [
5
"Remote Management",
6
"Intel AMT",
webserver.js
+11
-6
@@ -2676,8 +2676,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2676
// Fetch the mesh object
2677
ws.meshid = 'mesh/' + domain.id + '/' + req.query.id;
2678
const mesh = obj.meshes[ws.meshid];
2679
- if (mesh == null) { delete ws.meshid; ws.send(JSON.stringify({ errorText: 'Invalid device group' })); ws.close(); return; }
2680
- if (mesh.mtype != 1) { ws.send(JSON.stringify({ errorText: 'Invalid device group type' })); ws.close(); return; }
2679
+ if (mesh == null) { delete ws.meshid; ws.send(JSON.stringify({ errorText: 'Invalid device group: ' + ws.meshid })); ws.close(); return; }
2680
+ if (mesh.mtype != 1) { ws.send(JSON.stringify({ errorText: 'Invalid device group type:' + ws.meshid })); ws.close(); return; }
2681
2682
// Fetch the remote IP:Port for logging
2683
ws.remoteaddr = cleanRemoteAddr(req.ip);
@@ -4516,11 +4516,14 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4516
obj.badLoginTable = {};
4517
obj.badLoginTableLastClean = 0;
4518
if (parent.config.settings == null) { parent.config.settings = {}; }
4519
- if (parent.config.settings.maxinvalidlogin == null) { parent.config.settings.maxinvalidlogin = { time: 10, count: 10 }; }
4520
- if (typeof parent.config.settings.maxinvalidlogin.time != 'number') { parent.config.settings.maxinvalidlogin.time = 10; }
4521
- if (typeof parent.config.settings.maxinvalidlogin.count != 'number') { parent.config.settings.maxinvalidlogin.count = 10; }
4522
- if ((typeof parent.config.settings.maxinvalidlogin.coolofftime != 'number') || (parent.config.settings.maxinvalidlogin.coolofftime < 1)) { parent.config.settings.maxinvalidlogin.coolofftime = null; }
4519
+ if (parent.config.settings.maxinvalidlogin !== false) {
4520
+ if (typeof parent.config.settings.maxinvalidlogin != 'object') { parent.config.settings.maxinvalidlogin = { time: 10, count: 10 }; }
4521
+ if (typeof parent.config.settings.maxinvalidlogin.time != 'number') { parent.config.settings.maxinvalidlogin.time = 10; }
4522
+ if (typeof parent.config.settings.maxinvalidlogin.count != 'number') { parent.config.settings.maxinvalidlogin.count = 10; }
4523
+ if ((typeof parent.config.settings.maxinvalidlogin.coolofftime != 'number') || (parent.config.settings.maxinvalidlogin.coolofftime < 1)) { parent.config.settings.maxinvalidlogin.coolofftime = null; }
4524
+ }
4525
obj.setbadLogin = function (ip) { // Set an IP address that just did a bad login request
4526
+ if (parent.config.settings.maxinvalidlogin === false) return;
4527
if (typeof ip == 'object') { ip = cleanRemoteAddr(ip.ip); }
4528
var splitip = ip.split('.');
4529
if (splitip.length == 4) { ip = (splitip[0] + '.' + splitip[1] + '.' + splitip[2] + '.*'); }
@@ -4532,6 +4535,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4535
}
4536
}
4537
obj.checkAllowLogin = function (ip) { // Check if an IP address is allowed to login
4538
+ if (parent.config.settings.maxinvalidlogin === false) return true;
4539
if (typeof ip == 'object') { ip = cleanRemoteAddr(ip.ip); }
4540
var splitip = ip.split('.');
4541
if (splitip.length == 4) { ip = (splitip[0] + '.' + splitip[1] + '.' + splitip[2] + '.*'); } // If this is IPv4, keep only the 3 first
@@ -4544,6 +4548,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4548
return (ipTable.length < parent.config.settings.maxinvalidlogin.count); // No more than x bad logins in x minutes
4549
}
4550
obj.cleanBadLoginTable = function () { // Clean up the IP address login blockage table, we do this occasionaly.
4551
+ if (parent.config.settings.maxinvalidlogin === false) return;
4552
var cutoffTime = Date.now() - (parent.config.settings.maxinvalidlogin.time * 60000); // Time in minutes
4553
for (var ip in obj.badLoginTable) {
4554
var ipTable = obj.badLoginTable[ip];