Project

General

Profile

Download (5.7 KB) Statistics
| Branch: | Revision:

stabile / auth / AuthTktConfig.pm @ master

1
#
2
# Config settings for mod_auth_tkt CGI scripts
3
# 
4
# Customise as required
5
#
6

    
7
package AuthTktConfig;
8

    
9
#use strict;
10
use Tie::DBI;
11
use Digest::MD5 qw(md5 md5_hex md5_base64);
12
use Digest::SHA qw(sha512_base64);
13
use Sys::Syslog qw( :DEFAULT setlogsock);
14
use Net::Subnet;
15
use ConfigReader::Simple;
16
use Auth::GoogleAuth;
17

    
18
# CSS stylesheet to use (optional)
19
our $STYLESHEET = 'tkt.css';
20

    
21
# Page title (optional)
22
our $TITLE = `cat /etc/stabile/config.cfg | sed -n -e 's/^ENGINENAME=//p'`;
23
chomp $TITLE;
24
$TITLE = $TITLE || 'Stabile';
25
$TITLE = "$TITLE - login";
26

    
27
# Fixed back location, overriding any set via back cookie or back arg
28
our $FIXED_BACK_LOCATION = '';
29

    
30
# Default back location, if none set via back cookie or back arg
31
our $DEFAULT_BACK_LOCATION = '/stabile/auth/login';
32

    
33
# Boolean flag, whether to fallback to HTTP_REFERER for back location
34
our $BACK_REFERER = 1;
35

    
36
# For autologin, mode to fallback to if autologin fails ('login' or 'guest')
37
our $AUTOLOGIN_FALLBACK_MODE = 'login';
38

    
39
# Additional cookies to clear on logout e.g. PHPSESSID
40
our @NUKE_COOKIES = qw(steamaccount tktuser);
41

    
42
# Debug flag
43
our $DEBUG = 0;
44

    
45
our $COOKIE_BASE = '';
46
$COOKIE_BASE = `cat /etc/stabile/cookiebase` if -e "/etc/stabile/cookiebase";
47
chomp $COOKIE_BASE;
48
$COOKIE_BASE = ".$COOKIE_BASE" unless ($COOKIE_BASE =~ /^\./);
49

    
50

    
51
# Username/password validation for login mode
52
#   (modify or point $validate_sub somewhere appropriate).
53
# The validation routine should return a true value (e.g. 1) if the 
54
#   given username/password combination is valid, and a false value
55
#   (e.g. 0) otherwise.
56
# This version uses Apache::Htpasswd and a standard htpasswd file.
57
sub validate
58
{
59
	my ($username, $password, $totp) = @_;
60
	require Apache::Htpasswd;
61
	my $ht = Apache::Htpasswd->new({ passwdFile => '/etc/apache2/htpasswd-stabile', ReadOnly => 1 });
62
	return $ht->htCheckPassword($username, $password);
63
}
64

    
65
sub sqlvalidate {
66
	my ($username, $password, $totp) = @_;
67
	$username = lc $username;
68
	$username = $1 if ($username =~ /(.+)/); # Untaint
69
    my $config = ConfigReader::Simple->new("/etc/stabile/config.cfg",
70
        [qw(DBI_USER DBI_PASSWD)]);
71
    my $dbiuser =  $config->get('DBI_USER') || "irigo";
72
    my $dbipasswd = $config->get('DBI_PASSWD') || "";
73

    
74
	my %register;
75
	unless (tie %register,'Tie::DBI', {
76
		db=>'mysql:steamregister',
77
		table=>'users',
78
		key=>'username',
79
		autocommit=>0,
80
		CLOBBER=>1,
81
		user=>$dbiuser,
82
		password=>$dbipasswd}) {return 0};
83

    
84
	my $valid = 0;
85
	my $validip = 0;
86
	my $validuser = 0;
87

    
88
	my $u = $register{$username};
89
	my $allowfrom = $u->{'allowfrom'};
90
	my $totpsecret = $u->{'totpsecret'};
91

    
92
	my $from = $ENV{'REMOTE_ADDR'};
93
	if ($allowfrom) {
94
	    my @allows = split(/,\s*/, $allowfrom);
95
	    foreach my $ip (@allows) {
96
			if ($ip =~ /(\d+\.\d+\.\d+\.\d+\/\d+)/) { # Match a subnet definition
97
				$validip = 1 if (subnet_matcher($1)->($from));
98
			} else {
99
				$ip = $1 if ($ip =~ /(\d+\.)0\.0\.0/);
100
				$ip = $1 if ($ip =~ /(\d+\.\d+\.)0\.0/);
101
				$ip = $1 if ($ip =~ /(\d+\.\d+\.\d+\.)0/);
102
				$validip = 1 if ($from =~ /^$ip/);
103
			}
104
	    }
105
	} else {
106
	    $validip = 1;
107
	}
108
	if ($register{$username}) {
109
	    my $privileges = $register{$username}->{'privileges'};
110
	    $validuser = 1 unless ($privileges =~ /d/);
111
	}
112
	if ($validip && $validuser) {
113
        # First check if md5 checksums match
114
        my $upassword = $register{$username}->{'password'};
115
        if ($password && (
116
			$upassword eq md5_base64($password)
117
			|| $upassword eq sha512_base64($password)
118
			|| ($totp && ($upassword eq $password)) # password is hashed when sent from totp form
119
		)){
120
			if ($totpsecret && $totpsecret ne '--') { # User has 2fa enabled
121
				if ($totp) {
122
					my $auth = Auth::GoogleAuth->new();
123
					if ($auth->verify($totp, 1, $totpsecret)) {
124
						$valid = 1;
125
					} else {
126
						$valid = 2;
127
					}
128
				} else {
129
					$valid = 2;
130
				}
131
			} else {
132
				$valid = 1;
133
			}
134
        # If plaintexts match, then assume we are dealing with a new user and convert the password to it's md5 checksum
135
        } elsif ($password && $register{$username}->{'password'} eq $password) {
136
            $valid = 1;
137
            eval {syslogit('info', "Adding system user $username: " . `/usr/sbin/useradd -m "irigo-$username"`); 1;};
138
			`echo "[User]\nSystemAccount=true" > /var/lib/AccountsService/users/irigo-$username`; # Don't show in login screen
139
    #		eval {`/bin/echo irigo-$username:$password | /usr/sbin/chpasswd`; 1;}; # Doesn't work on Lucid, so we go through the hoops below...
140
            my $np = `/bin/echo irigo-$username:$password | /usr/sbin/chpasswd -S`; # -S option not supported on older versions
141
            $np =~ /irigo-$username:(.+)/;
142
            my $cpass = $1;
143
            eval {`/usr/sbin/usermod -p '$cpass' irigo-$username`; 1;};
144
            $register{$username}->{'password'} = sha512_base64($password);
145
    #        unless(-d "$basedir$username"){
146
    #            umask "0000";
147
    #            mkdir "$basedir$username" or syslogit("info", "Unable to create user dir for $username");
148
    #        }
149
        }
150
		$register{$username}->{'lastlogin'} = $register{$username}->{'curlogin'};
151
		$register{$username}->{'lastloginfrom'} = $register{$username}->{'curloginfrom'};
152
		$register{$username}->{'curlogin'} = time;
153
		$register{$username}->{'curloginfrom'} = $ENV{'REMOTE_ADDR'};
154
	}
155
	return $valid;
156
	untie %register;
157
}
158

    
159

    
160
#our $validate_sub = \&validate;
161
our $validate_sub = \&sqlvalidate;
162

    
163
# For guest mode (if used), setup guest username
164
#   Could use a counter or a random suffix etc.
165
sub guest_user { return 'guest' }
166
our $guest_sub = \&guest_user;
167

    
168
1;
169

    
170
sub syslogit {
171
	my ($priority, $msg) = @_;
172

    
173
	setlogsock('unix');
174
	# $programname is assumed to be a global.  Also log the PID
175
	# and to CONSole if there's a problem.  Use facility 'user'.
176
	openlog("", 'pid,cons', 'user');
177
	syslog($priority, $msg);
178
	closelog();
179
	return 1;
180
}
181

    
(1-1/5)