Added backupcode2factor and single2factorWarning options, #3608
Ylian Saint-Hilaire committed
Feb 7, 2022 at 18:06 UTC
fc480539e1a456abc40388dfa4d4c2836b7f0257
5 files changed
+20
-4
meshcentral-config-schema.json
+2
@@ -443,6 +443,8 @@
443
"sms2factor": { "type": "boolean", "default": true, "description": "Set to false to disable SMS 2FA." },
444
"push2factor": { "type": "boolean", "default": true, "description": "Set to false to disable push notification 2FA." },
445
"otp2factor": { "type": "boolean", "default": true, "description": "Set to false to disable one-time-password 2FA." },
446
+ "backupcode2factor": { "type": "boolean", "default": true, "description": "Set to false to disable 2FA backup codes." },
447
+ "single2factorWarning": { "type": "boolean", "default": true, "description": "Set to false to disable single 2FA warning." },
448
"lock2factor": { "type": "boolean", "default": false, "description": "When set to true, prevents any changes to 2FA." },
449
"force2factor": { "type": "boolean", "default": false, "description": "Requires that all accounts setup 2FA." },
450
"skip2factor": { "type": "string", "description": "IP addresses where 2FA login is skipped, for example: 127.0.0.1,192.168.2.0/24" },
meshuser.js
+12
@@ -3183,6 +3183,9 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
3183
// Do not allow this command if 2FA's are locked
3184
if ((domain.passwordrequirements) && (domain.passwordrequirements.lock2factor == true)) return;
3185
3186
+ // Do not allow this command if backup codes are not allowed
3187
+ if ((domain.passwordrequirements) && (domain.passwordrequirements.backupcode2factor == false)) return;
3188
+
3189
// Do not allow this command when logged in using a login token
3190
if (req.session.loginToken != null) break;
3191
@@ -3211,6 +3214,9 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
3214
// Do not allow this command if 2FA's are locked
3215
if ((domain.passwordrequirements) && (domain.passwordrequirements.lock2factor == true)) return;
3216
3217
+ // Do not allow this command if backup codes are not allowed
3218
+ if ((domain.passwordrequirements) && (domain.passwordrequirements.backupcode2factor == false)) return;
3219
+
3220
// Do not allow this command when logged in using a login token
3221
if (req.session.loginToken != null) break;
3222
@@ -3250,6 +3256,9 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
3256
// Do not allow this command if 2FA's are locked
3257
if ((domain.passwordrequirements) && (domain.passwordrequirements.lock2factor == true)) return;
3258
3259
+ // Do not allow this command if backup codes are not allowed
3260
+ if ((domain.passwordrequirements) && (domain.passwordrequirements.backupcode2factor == false)) return;
3261
+
3262
// Do not allow this command when logged in using a login token
3263
if (req.session.loginToken != null) break;
3264
@@ -3281,6 +3290,9 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
3290
// Do not allow this command if 2FA's are locked
3291
if ((domain.passwordrequirements) && (domain.passwordrequirements.lock2factor == true)) return;
3292
3293
+ // Do not allow this command if backup codes are not allowed
3294
+ if ((domain.passwordrequirements) && (domain.passwordrequirements.backupcode2factor == false)) return;
3295
+
3296
// Do not allow this command when logged in using a login token
3297
if (req.session.loginToken != null) break;
3298
views/default-mobile.handlebars
+1
-1
@@ -1372,7 +1372,7 @@
1372
QV('p2AccountImage', !accountSettingsLocked);
1373
QV('verifyEmailId', (userinfo.emailVerified !== true) && (userinfo.email != null) && (serverinfo.emailcheck == true));
1374
QV('manageAuthApp', (serverinfo.lock2factor != true) && (features & 4096) && ((userinfo.otpsecret == 1) || ((features2 & 0x00020000) == 0)));
1375
- QV('manageOtp', (serverinfo.lock2factor != true) && (features & 4096) && ((userinfo.otpsecret == 1) || (userinfo.otphkeys > 0)));
1375
+ QV('manageOtp', (serverinfo.lock2factor != true) && ((features2 & 0x40000) == 0) && (features & 4096) && ((userinfo.otpsecret == 1) || (userinfo.otphkeys > 0)));
1376
QV('authPhoneNumberCheck', (userinfo.phone != null));
1377
QV('authEmailSetupCheck', (userinfo.otpekey == 1) && (userinfo.email != null) && (userinfo.emailVerified == true));
1378
QV('authAppSetupCheck', userinfo.otpsecret == 1);
views/default.handlebars
+3
-3
@@ -2116,7 +2116,7 @@
2116
if (userinfo.otphkeys > 0) { authFactorCount += userinfo.otphkeys; } // FIDO hardware factor
2117
if ((features & 0x00800000) && (userinfo.otpekey == 1)) { authFactorCount++; } // EMail factor
2118
if ((features & 0x02000000) && (features & 0x04000000) && (userinfo.phone != null)) { authFactorCount++; } // SMS factor
2119
- if ((authFactorCount > 0) && (userinfo.otpkeys > 0)) { authFactorCount++; } // Backup keys
2119
+ if ((authFactorCount > 0) && (userinfo.otpkeys > 0) && ((features & 0x40000) == 0)) { authFactorCount++; } // Backup keys
2120
return authFactorCount;
2121
}
2122
@@ -2126,7 +2126,7 @@
2126
var accountSettingsLocked = ((userinfo.siteadmin != 0xFFFFFFFF) && ((userinfo.siteadmin & 1024) != 0));
2127
QV('verifyEmailId', (userinfo.emailVerified !== true) && (userinfo.email != null) && (serverinfo.emailcheck == true));
2128
QV('verifyEmailId2', (userinfo.emailVerified !== true) && (userinfo.email != null) && (serverinfo.emailcheck == true) && (accountSettingsLocked == false));
2129
- QV('manageOtp', (serverinfo.lock2factor != true) && (authFactorCount > 0));
2129
+ QV('manageOtp', (serverinfo.lock2factor != true) && (authFactorCount > 0) && ((features2 & 0x40000) == 0));
2130
QV('authPhoneNumberCheck', (userinfo.phone != null));
2131
QV('authEmailSetupCheck', (userinfo.otpekey == 1) && (userinfo.email != null) && (userinfo.emailVerified == true));
2132
QV('authAppSetupCheck', userinfo.otpsecret == 1);
@@ -2139,7 +2139,7 @@
2139
mainUpdate(4 + 128 + 4096);
2140
2141
// Check if none or at least 2 factors are enabled.
2142
- if ((backupCodesWarningDone == false) && (authFactorCount == 1)) {
2142
+ if ((backupCodesWarningDone == false) && (authFactorCount == 1) && ((features2 & 0x80000) == 0)) {
2143
addNotification({ text: "Please add two-factor backup codes. If the current factor is lost, there is no way to recover this account.", title: "Two factor authentication", tag: 'backupcodes' });
2144
backupCodesWarningDone = true;
2145
}
webserver.js
+2
@@ -2885,6 +2885,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
2885
if (domain.devicesearchbarserverandclientname) { features2 += 0x00008000; } // Search bar will find both server name and client name
2886
if (domain.ipkvm) { features2 += 0x00010000; } // Indicates support for IP KVM device groups
2887
if ((domain.passwordrequirements) && (domain.passwordrequirements.otp2factor == false)) { features2 += 0x00020000; } // Indicates support for OTP 2FA is disabled
2888
+ if ((typeof domain.passwordrequirements != 'object') || (domain.passwordrequirements.backupcode2factor === false)) { features2 += 0x00040000; } // Indicates 2FA backup codes are disabled
2889
+ if ((typeof domain.passwordrequirements != 'object') || (domain.passwordrequirements.single2factorwarning === false)) { features2 += 0x00080000; } // Indicates no warning if a single 2FA is in use
2890
return { features: features, features2: features2 };
2891
}
2892