From 53bc51e67467014a303b499b41b73fd5b410b19c Mon Sep 17 00:00:00 2001 From: Ilya Sosnovsky Date: Mon, 14 Nov 2022 13:33:43 +0300 Subject: [PATCH] totp auth --- go.mod | 5 +- go.sum | 37 ++++++-- openvpn-user.go | 218 ++++++++++++++++++++++++++++++++++++++++++------ 3 files changed, 223 insertions(+), 37 deletions(-) diff --git a/go.mod b/go.mod index 7ee090a..0d42d0d 100644 --- a/go.mod +++ b/go.mod @@ -5,10 +5,9 @@ go 1.14 require ( github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 // indirect github.com/alecthomas/units v0.0.0-20201120081800-1786d5ef83d4 // indirect - github.com/iamacarpet/go-sqlite3-dynamic v0.0.0-20190515092955-345069c6d7b9 + github.com/dgryski/dgoogauth v0.0.0-20190221195224-5a805980a5f3 github.com/mattn/go-sqlite3 v1.14.6 - github.com/notti/nocgo v0.0.0-20190619201224-fc443047424c // indirect github.com/stretchr/testify v1.7.0 // indirect - golang.org/x/crypto v0.0.0-20201221181555-eec23a3978ad + golang.org/x/crypto v0.2.0 gopkg.in/alecthomas/kingpin.v2 v2.2.6 ) diff --git a/go.sum b/go.sum index b46dd97..bc45468 100644 --- a/go.sum +++ b/go.sum @@ -4,26 +4,45 @@ github.com/alecthomas/units v0.0.0-20201120081800-1786d5ef83d4 h1:EBTWhcAX7rNQ80 github.com/alecthomas/units v0.0.0-20201120081800-1786d5ef83d4/go.mod h1:OMCwj8VM1Kc9e19TLln2VL61YJF0x1XFtfdL4JdbSyE= github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/iamacarpet/go-sqlite3-dynamic v0.0.0-20190515092955-345069c6d7b9 h1:MDZ6mJ7Ouz9lSwLtD7v2QeDlbdL6rONTAJRNEQqRYC0= -github.com/iamacarpet/go-sqlite3-dynamic v0.0.0-20190515092955-345069c6d7b9/go.mod h1:HSsZaV17NZLgfHsNz3wzjE66Gd2EGlF8OuC0DdPpgPk= +github.com/dgryski/dgoogauth v0.0.0-20190221195224-5a805980a5f3 h1:AqeKSZIG/NIC75MNQlPy/LM3LxfpLwahICJBHwSMFNc= +github.com/dgryski/dgoogauth v0.0.0-20190221195224-5a805980a5f3/go.mod h1:hEfFauPHz7+NnjR/yHJGhrKo1Za+zStgwUETx3yzqgY= github.com/mattn/go-sqlite3 v1.14.6 h1:dNPt6NO46WmLVt2DLNpwczCmdV5boIZ6g/tlDrlRUbg= github.com/mattn/go-sqlite3 v1.14.6/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU= -github.com/notti/nocgo v0.0.0-20190619201224-fc443047424c h1:3fTZ9+GLtn9eqKC1RGLojMG7St2WsskOeGXKFEhNTlo= -github.com/notti/nocgo v0.0.0-20190619201224-fc443047424c/go.mod h1:kJHUidcvEI83gsDlB+I58aaOuzvJmPfbqrqYjTqmdHA= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4= github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= +github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= -golang.org/x/crypto v0.0.0-20201221181555-eec23a3978ad h1:DN0cp81fZ3njFcrLCytUHRSUkqBjfTo4Tx9RJTWs0EY= -golang.org/x/crypto v0.0.0-20201221181555-eec23a3978ad/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I= -golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= +golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= +golang.org/x/crypto v0.2.0 h1:BRXPfhNivWL5Yq0BGQ39a2sW6t44aODpfxkWjYdzewE= +golang.org/x/crypto v0.2.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4= +golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= +golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= +golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= +golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY= +golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= -golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw= +golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= +golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= +golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= +golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= +golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= +golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= +golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= +golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= +golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gopkg.in/alecthomas/kingpin.v2 v2.2.6 h1:jMFz6MfLP0/4fUyZle81rXUoxOBFi19VUFKVDOQfozc= gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM= diff --git a/openvpn-user.go b/openvpn-user.go index 79d97bd..8dfdc90 100644 --- a/openvpn-user.go +++ b/openvpn-user.go @@ -1,17 +1,22 @@ package main import ( + "crypto/rand" "database/sql" + "encoding/base32" "fmt" + "github.com/dgryski/dgoogauth" _ "github.com/mattn/go-sqlite3" "golang.org/x/crypto/bcrypt" "gopkg.in/alecthomas/kingpin.v2" + "log" "os" + "strings" "text/tabwriter" ) const ( - version = "1.0.4" + version = "1.0.5" ) var ( @@ -42,24 +47,52 @@ var ( authCommand = kingpin.Command("auth", "Auth user.") authCommandUserFlag = authCommand.Flag("user", "Username.").Required().String() - authCommandPasswordFlag = authCommand.Flag("password", "Password.").Required().String() + authCommandPasswordFlag = authCommand.Flag("password", "Password.").String() + authCommandTotpFlag = authCommand.Flag("totp", "TOTP code.").String() + //authCommandHotpFlag = authCommand.Flag("hotp", "HOTP code.").String() changePasswordCommand = kingpin.Command("change-password", "Change password") changePasswordCommandUserFlag = changePasswordCommand.Flag("user", "Username.").Required().String() changePasswordCommandPasswordFlag = changePasswordCommand.Flag("password", "Password.").Required().String() + updateSecretCommand = kingpin.Command("update-secret", "update OTP secret") + updateSecretCommandUserFlag = updateSecretCommand.Flag("user", "Username.").Required().String() + updateSecretCommandSecretFlag = updateSecretCommand.Flag("secret", "Secret.").Default("generate").String() + + registerAppCommand = kingpin.Command("register-app", "update OTP secret") + registerAppCommandUserFlag = registerAppCommand.Flag("user", "Username.").Required().String() + + getSecretCommand = kingpin.Command("get-secret", "gwt OTP secret") + getSecretCommandUserFlag = getSecretCommand.Flag("user", "Username.").Required().String() + debug = kingpin.Flag("debug", "Enable debug mode.").Default("false").Bool() ) -type User struct { - id int64 - name string - password string - revoked bool - deleted bool +type Migration struct { + id int64 + name string + sql string } +type User struct { + id int64 + name string + password string + revoked bool + deleted bool + secret string + appConfigured bool +} + +var ( + migrations []Migration +) + func main() { + + migrations = append(migrations, Migration{name: "users_add_secret_column_2022_11_10", sql: "ALTER TABLE users ADD COLUMN secret string"}) + migrations = append(migrations, Migration{name: "users_add_2fa_column_2022_11_11", sql: "ALTER TABLE users ADD COLUMN app_configured integer default 0"}) + kingpin.Version(version) switch kingpin.Parse() { case createCommand.FullCommand(): @@ -75,9 +108,30 @@ func main() { case checkCommand.FullCommand(): _ = checkUserExistent(*checkCommandUserFlag) case authCommand.FullCommand(): - authUser(*authCommandUserFlag, *authCommandPasswordFlag) + provideAuthType := 0 + if *authCommandPasswordFlag != "" { + provideAuthType += 1 + } + if *authCommandTotpFlag != "" { + provideAuthType += 1 + } + //if *authCommandHotpFlag != "" { + // provideAuthType += 1 + //} + if provideAuthType == 1 { + authUser(*authCommandUserFlag, *authCommandPasswordFlag, *authCommandTotpFlag) + } else { + fmt.Printf("Please provide only one type of auth paswword") + os.Exit(1) + } case changePasswordCommand.FullCommand(): changeUserPassword(*changePasswordCommandUserFlag, *changePasswordCommandPasswordFlag) + case updateSecretCommand.FullCommand(): + registerOtpSecret(*updateSecretCommandUserFlag, *updateSecretCommandSecretFlag) + case registerAppCommand.FullCommand(): + registerOtpApplication(*registerAppCommandUserFlag) + case getSecretCommand.FullCommand(): + getUserOtpSecret(*getSecretCommandUserFlag) case dbInitCommand.FullCommand(): initDb() case dbMigrateCommand.FullCommand(): @@ -98,11 +152,31 @@ func initDb() { // boolean fields are integer because of sqlite does not support boolean: 1 = true, 0 = false _, err := getDb().Exec("CREATE TABLE IF NOT EXISTS users(id integer not null primary key autoincrement, username string UNIQUE, password string, revoked integer default 0, deleted integer default 0)") checkErr(err) + _, err = getDb().Exec("CREATE TABLE IF NOT EXISTS migrations(id integer not null primary key autoincrement, name string)") + checkErr(err) fmt.Printf("Database initialized at %s\n", *dbPath) } func migrateDb() { - fmt.Println("STUB: Migrations are up to date") + var c int + for _, migration := range migrations { + c = -1 + err := getDb().QueryRow("SELECT count(*) FROM migrations WHERE name = $1", migration.name).Scan(&c) + if err != nil { + if err == sql.ErrNoRows { + continue + } + log.Fatal(err) + } + if c == 0 { + fmt.Printf("Migrating database with new migration %s\n", migration.name) + _, err := getDb().Exec(migration.sql) + checkErr(err) + _, err = getDb().Exec("INSERT INTO migrations(name) VALUES ($1)", migration.name) + checkErr(err) + } + } + fmt.Println("Migrations are up to date") } func createUser(username, password string) { @@ -184,7 +258,7 @@ func checkUserExistent(username string) bool { func userDeleted(username string) bool { // return true if user marked as deleted u := User{} - _ = getDb().QueryRow("SELECT * FROM users WHERE username = $1", username).Scan(&u) + _ = getDb().QueryRow("SELECT deleted FROM users WHERE username = $1", username).Scan(&u.deleted) if u.deleted { fmt.Printf("User %s marked as deleted\n", username) return true @@ -196,9 +270,18 @@ func userDeleted(username string) bool { func userIsActive(username string) bool { // return true if user exist and not deleted and revoked u := User{} - _ = getDb().QueryRow("SELECT * FROM users WHERE username = $1", username).Scan(&u) + err := getDb().QueryRow("SELECT revoked,deleted FROM users WHERE username = $1", username).Scan(&u.revoked, &u.deleted) + if err != nil { + if err == sql.ErrNoRows { + fmt.Println("User not found") + return false + } + return false + } if !u.revoked && !u.deleted { - fmt.Printf("User %s is active\n", username) + if *debug { + fmt.Printf("User %s is active\n", username) + } return true } else { fmt.Println("User may be deleted or revoked") @@ -212,7 +295,7 @@ func listUsers() []User { if *listAll { condition = "" } - query := "SELECT * FROM users " + condition + query := "SELECT id, username, password, revoked, deleted FROM users " + condition rows, err := getDb().Query(query) checkErr(err) @@ -251,30 +334,115 @@ func changeUserPassword(username, password string) { fmt.Println("Password changed") } -func authUser(username, password string) { +func registerOtpSecret(username, secret string) { + if userIsActive(username) { + if secret == "generate" { + randomStr := randStr(6, "alphanum") + + secret = base32.StdEncoding.EncodeToString([]byte(randomStr)) + if *debug { + fmt.Printf("new generated secret for user %s: %s\n", username, secret) + } + } + + _, err := getDb().Exec("UPDATE users SET secret = $1 WHERE username = $2", secret, username) + checkErr(err) + + fmt.Println("Secret updated") + } +} + +func registerOtpApplication(username string) { + if userIsActive(username) { + + _, err := getDb().Exec("UPDATE users SET app_configured = 1 WHERE username = $2") + checkErr(err) + + fmt.Printf("OTP application for user %s configured\n", username) + } +} + +func getUserOtpSecret(username string) { + if userIsActive(username) { + u := User{} + _ = getDb().QueryRow("SELECT secret FROM users WHERE username = $1", username).Scan(&u.secret) + + fmt.Println(u.secret) + } +} + +func authUser(username, password, totp string) { row := getDb().QueryRow("select * from users where username = $1", username) u := User{} - err := row.Scan(&u.id, &u.name, &u.password, &u.revoked, &u.deleted) + err := row.Scan(&u.id, &u.name, &u.password, &u.revoked, &u.deleted, &u.secret) checkErr(err) if userIsActive(username) { - err = bcrypt.CompareHashAndPassword([]byte(u.password), []byte(password)) - if err != nil { - fmt.Println("Authorization failed") - if *debug { - fmt.Println("Passwords mismatched") + if password == "" && len(totp) > 0 { + otpConfig := &dgoogauth.OTPConfig{ + Secret: strings.TrimSpace(u.secret), + WindowSize: 3, + HotpCounter: 0, + } + + // get rid of the extra \n from the token string + // otherwise the validation will fail + trimmedToken := strings.TrimSpace(totp) + + // Validate token + _, err := otpConfig.Authenticate(trimmedToken) + + if err != nil { + fmt.Println(err) + os.Exit(1) + } else { + fmt.Println("Authorization successful") + os.Exit(0) + } + } else if len(password) > 0 && totp == "" { + + err = bcrypt.CompareHashAndPassword([]byte(u.password), []byte(password)) + if err != nil { + fmt.Println("Authorization failed") + if *debug { + fmt.Println("Passwords mismatched") + } + os.Exit(1) + } else { + fmt.Println("Authorization successful") + os.Exit(0) } - os.Exit(1) - } else { - fmt.Println("Authorization successful") - os.Exit(0) } } fmt.Println("Authorization failed") os.Exit(1) } +func randStr(strSize int, randType string) string { + + var dictionary string + + if randType == "alphanum" { + dictionary = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz" + } + + if randType == "alpha" { + dictionary = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz" + } + + if randType == "number" { + dictionary = "0123456789" + } + + var bytes = make([]byte, strSize) + rand.Read(bytes) + for k, v := range bytes { + bytes[k] = dictionary[v%byte(len(dictionary))] + } + return string(bytes) +} + func checkErr(err error) { if err != nil { panic(err)