PVE/API2/AccessControl.pm

   1 package PVE::API2::AccessControl;
   2
   3 use strict;
   4 use warnings;
   5
   6 use JSON;
   7 use MIME::Base64;
   8
   9 use PVE::Exception qw(raise raise_perm_exc);
  10 use PVE::SafeSyslog;
  11 use PVE::RPCEnvironment;
  12 use PVE::Cluster qw(cfs_read_file);
  13 use PVE::Corosync;
  14 use PVE::RESTHandler;
  15 use PVE::AccessControl;
  16 use PVE::JSONSchema qw(get_standard_option);
  17 use PVE::API2::Domains;
  18 use PVE::API2::User;
  19 use PVE::API2::Group;
  20 use PVE::API2::Role;
  21 use PVE::API2::ACL;
  22 use PVE::OTP;
  23 use PVE::Tools;
  24
  25 my $u2f_available = 0;
  26 eval {
  27     require PVE::U2F;
  28     $u2f_available = 1;
  29 };
  30
  31 use base qw(PVE::RESTHandler);
  32
  33 __PACKAGE__->register_method ({
  34     subclass => "PVE::API2::User",
  35     path => 'users',
  36 });
  37
  38 __PACKAGE__->register_method ({
  39     subclass => "PVE::API2::Group",
  40     path => 'groups',
  41 });
  42
  43 __PACKAGE__->register_method ({
  44     subclass => "PVE::API2::Role",
  45     path => 'roles',
  46 });
  47
  48 __PACKAGE__->register_method ({
  49     subclass => "PVE::API2::ACL",
  50     path => 'acl',
  51 });
  52
  53 __PACKAGE__->register_method ({
  54     subclass => "PVE::API2::Domains",
  55     path => 'domains',
  56 });
  57
  58 __PACKAGE__->register_method ({
  59     name => 'index',
  60     path => '',
  61     method => 'GET',
  62     description => "Directory index.",
  63     permissions => {
  64         user => 'all',
  65     },
  66     parameters => {
  67         additionalProperties => 0,
  68         properties => {},
  69     },
  70     returns => {
  71         type => 'array',
  72         items => {
  73             type => "object",
  74             properties => {
  75                 subdir => { type => 'string' },
  76             },
  77         },
  78         links => [ { rel => 'child', href => "{subdir}" } ],
  79     },
  80     code => sub {
  81         my ($param) = @_;
  82
  83         my $res = [];
  84
  85         my $ma = __PACKAGE__->method_attributes();
  86
  87         foreach my $info (@$ma) {
  88             next if !$info->{subclass};
  89
  90             my $subpath = $info->{match_re}->[0];
  91
  92             push @$res, { subdir => $subpath };
  93         }
  94
  95         push @$res, { subdir => 'ticket' };
  96         push @$res, { subdir => 'password' };
  97
  98         return $res;
  99     }});
 100
 101
 102 my $verify_auth = sub {
 103     my ($rpcenv, $username, $pw_or_ticket, $otp, $path, $privs) = @_;
 104
 105     my $normpath = PVE::AccessControl::normalize_path($path);
 106
 107     my $ticketuser;
 108     if (($ticketuser = PVE::AccessControl::verify_ticket($pw_or_ticket, 1)) &&
 109         ($ticketuser eq $username)) {
 110         # valid ticket
 111     } elsif (PVE::AccessControl::verify_vnc_ticket($pw_or_ticket, $username, $normpath, 1)) {
 112         # valid vnc ticket
 113     } else {
 114         $username = PVE::AccessControl::authenticate_user($username, $pw_or_ticket, $otp);
 115     }
 116
 117     my $privlist = [ PVE::Tools::split_list($privs) ];
 118     if (!($normpath && scalar(@$privlist) && $rpcenv->check($username, $normpath, $privlist))) {
 119         die "no permission ($path, $privs)\n";
 120     }
 121
 122     return { username => $username };
 123 };
 124
 125 my $create_ticket = sub {
 126     my ($rpcenv, $username, $pw_or_ticket, $otp) = @_;
 127
 128     my ($ticketuser, undef, $tfa_info) = PVE::AccessControl::verify_ticket($pw_or_ticket, 1);
 129     if (defined($ticketuser) && ($ticketuser eq 'root@pam' || $ticketuser eq $username)) {
 130         if (defined($tfa_info)) {
 131             die "incomplete ticket\n";
 132         }
 133         # valid ticket. Note: root@pam can create tickets for other users
 134     } else {
 135         ($username, $tfa_info) = PVE::AccessControl::authenticate_user($username, $pw_or_ticket, $otp);
 136     }
 137
 138     my %extra;
 139     my $ticket_data = $username;
 140     if (defined($tfa_info)) {
 141         $extra{NeedTFA} = 1;
 142         if ($tfa_info->{type} eq 'u2f') {
 143             my $u2finfo = $tfa_info->{data};
 144             my $u2f = get_u2f_instance($rpcenv, $u2finfo->@{qw(publicKey keyHandle)});
 145             my $challenge = $u2f->auth_challenge()
 146                 or die "failed to get u2f challenge\n";
 147             $challenge = decode_json($challenge);
 148             $extra{U2FChallenge} = $challenge;
 149             $ticket_data = "u2f!$username!$challenge->{challenge}";
 150         } else {
 151             # General half-login / 'missing 2nd factor' ticket:
 152             $ticket_data = "tfa!$username";
 153         }
 154     }
 155
 156     my $ticket = PVE::AccessControl::assemble_ticket($ticket_data);
 157     my $csrftoken = PVE::AccessControl::assemble_csrf_prevention_token($username);
 158
 159     return {
 160         ticket => $ticket,
 161         username => $username,
 162         CSRFPreventionToken => $csrftoken,
 163         %extra,
 164     };
 165 };
 166
 167 my $compute_api_permission = sub {
 168     my ($rpcenv, $authuser) = @_;
 169
 170     my $usercfg = $rpcenv->{user_cfg};
 171
 172     my $res = {};
 173     my $priv_re_map = {
 174         vms => qr/VM\.|Permissions\.Modify/,
 175         access => qr/(User|Group)\.|Permissions\.Modify/,
 176         storage => qr/Datastore\.|Permissions\.Modify/,
 177         nodes => qr/Sys\.|Permissions\.Modify/,
 178         dc => qr/Sys\.Audit/,
 179     };
 180     map { $res->{$_} = {} } keys %$priv_re_map;
 181
 182     my $required_paths = ['/', '/nodes', '/access/groups', '/vms', '/storage'];
 183
 184     my $checked_paths = {};
 185     foreach my $path (@$required_paths, keys %{$usercfg->{acl}}) {
 186         next if $checked_paths->{$path};
 187         $checked_paths->{$path} = 1;
 188
 189         my $path_perm = $rpcenv->permissions($authuser, $path);
 190
 191         my $toplevel = ($path =~ /^\/(\w+)/) ? $1 : 'dc';
 192         if ($toplevel eq 'pool') {
 193             foreach my $priv (keys %$path_perm) {
 194                 if ($priv =~ m/^VM\./) {
 195                     $res->{vms}->{$priv} = 1;
 196                 } elsif ($priv =~ m/^Datastore\./) {
 197                     $res->{storage}->{$priv} = 1;
 198                 } elsif ($priv eq 'Permissions.Modify') {
 199                     $res->{storage}->{$priv} = 1;
 200                     $res->{vms}->{$priv} = 1;
 201                 }
 202             }
 203         } else {
 204             my $priv_regex = $priv_re_map->{$toplevel} // next;
 205             foreach my $priv (keys %$path_perm) {
 206                 next if $priv !~ m/^($priv_regex)/;
 207                 $res->{$toplevel}->{$priv} = 1;
 208             }
 209         }
 210     }
 211
 212     return $res;
 213 };
 214
 215 __PACKAGE__->register_method ({
 216     name => 'get_ticket',
 217     path => 'ticket',
 218     method => 'GET',
 219     permissions => { user => 'world' },
 220     description => "Dummy. Useful for formatters which want to provide a login page.",
 221     parameters => {
 222         additionalProperties => 0,
 223     },
 224     returns => { type => "null" },
 225     code => sub { return undef; }});
 226
 227 __PACKAGE__->register_method ({
 228     name => 'create_ticket',
 229     path => 'ticket',
 230     method => 'POST',
 231     permissions => {
 232         description => "You need to pass valid credientials.",
 233         user => 'world'
 234     },
 235     protected => 1, # else we can't access shadow files
 236     description => "Create or verify authentication ticket.",
 237     parameters => {
 238         additionalProperties => 0,
 239         properties => {
 240             username => {
 241                 description => "User name",
 242                 type => 'string',
 243                 maxLength => 64,
 244                 completion => \&PVE::AccessControl::complete_username,
 245             },
 246             realm =>  get_standard_option('realm', {
 247                 description => "You can optionally pass the realm using this parameter. Normally the realm is simply added to the username <username>\@<relam>.",
 248                 optional => 1,
 249                 completion => \&PVE::AccessControl::complete_realm,
 250             }),
 251             password => {
 252                 description => "The secret password. This can also be a valid ticket.",
 253                 type => 'string',
 254             },
 255             otp => {
 256                 description => "One-time password for Two-factor authentication.",
 257                 type => 'string',
 258                 optional => 1,
 259             },
 260             path => {
 261                 description => "Verify ticket, and check if user have access 'privs' on 'path'",
 262                 type => 'string',
 263                 requires => 'privs',
 264                 optional => 1,
 265                 maxLength => 64,
 266             },
 267             privs => {
 268                 description => "Verify ticket, and check if user have access 'privs' on 'path'",
 269                 type => 'string' , format => 'pve-priv-list',
 270                 requires => 'path',
 271                 optional => 1,
 272                 maxLength => 64,
 273             },
 274         }
 275     },
 276     returns => {
 277         type => "object",
 278         properties => {
 279             username => { type => 'string' },
 280             ticket => { type => 'string', optional => 1},
 281             CSRFPreventionToken => { type => 'string', optional => 1 },
 282             clustername => { type => 'string', optional => 1 },
 283             # cap => computed api permissions, unless there's a u2f challenge
 284         }
 285     },
 286     code => sub {
 287         my ($param) = @_;
 288
 289         my $username = $param->{username};
 290         $username .= "\@$param->{realm}" if $param->{realm};
 291
 292         my $rpcenv = PVE::RPCEnvironment::get();
 293
 294         my $res;
 295         eval {
 296             # test if user exists and is enabled
 297             $rpcenv->check_user_enabled($username);
 298
 299             if ($param->{path} && $param->{privs}) {
 300                 $res = &$verify_auth($rpcenv, $username, $param->{password}, $param->{otp},
 301                                      $param->{path}, $param->{privs});
 302             } else {
 303                 $res = &$create_ticket($rpcenv, $username, $param->{password}, $param->{otp});
 304             }
 305         };
 306         if (my $err = $@) {
 307             my $clientip = $rpcenv->get_client_ip() || '';
 308             syslog('err', "authentication failure; rhost=$clientip user=$username msg=$err");
 309             # do not return any info to prevent user enumeration attacks
 310             die PVE::Exception->new("authentication failure\n", code => 401);
 311         }
 312
 313         $res->{cap} = &$compute_api_permission($rpcenv, $username)
 314             if !defined($res->{NeedTFA});
 315
 316         if (PVE::Corosync::check_conf_exists(1)) {
 317             if ($rpcenv->check($username, '/', ['Sys.Audit'], 1)) {
 318                 eval {
 319                     my $conf = cfs_read_file('corosync.conf');
 320                     my $totem = PVE::Corosync::totem_config($conf);
 321                     if ($totem->{cluster_name}) {
 322                         $res->{clustername} = $totem->{cluster_name};
 323                     }
 324                 };
 325                 warn "$@\n" if $@;
 326             }
 327         }
 328
 329         PVE::Cluster::log_msg('info', 'root@pam', "successful auth for user '$username'");
 330
 331         return $res;
 332     }});
 333
 334 __PACKAGE__->register_method ({
 335     name => 'change_password',
 336     path => 'password',
 337     method => 'PUT',
 338     permissions => {
 339         description => "Each user is allowed to change his own password. A user can change the password of another user if he has 'Realm.AllocateUser' (on the realm of user <userid>) and 'User.Modify' permission on /access/groups/<group> on a group where user <userid> is member of.",
 340         check => [ 'or',
 341                    ['userid-param', 'self'],
 342                    [ 'and',
 343                      [ 'userid-param', 'Realm.AllocateUser'],
 344                      [ 'userid-group', ['User.Modify']]
 345                    ]
 346             ],
 347     },
 348     protected => 1, # else we can't access shadow files
 349     description => "Change user password.",
 350     parameters => {
 351         additionalProperties => 0,
 352         properties => {
 353             userid => get_standard_option('userid-completed'),
 354             password => {
 355                 description => "The new password.",
 356                 type => 'string',
 357                 minLength => 5,
 358                 maxLength => 64,
 359             },
 360         }
 361     },
 362     returns => { type => "null" },
 363     code => sub {
 364         my ($param) = @_;
 365
 366         my $rpcenv = PVE::RPCEnvironment::get();
 367         my $authuser = $rpcenv->get_user();
 368
 369         my ($userid, $ruid, $realm) = PVE::AccessControl::verify_username($param->{userid});
 370
 371         $rpcenv->check_user_exist($userid);
 372
 373         if ($authuser eq 'root@pam') {
 374             # OK - root can change anything
 375         } else {
 376             if ($authuser eq $userid) {
 377                 $rpcenv->check_user_enabled($userid);
 378                 # OK - each user can change its own password
 379             } else {
 380                 # only root may change root password
 381                 raise_perm_exc() if $userid eq 'root@pam';
 382                 # do not allow to change system user passwords
 383                 raise_perm_exc() if $realm eq 'pam';
 384             }
 385         }
 386
 387         PVE::AccessControl::domain_set_password($realm, $ruid, $param->{password});
 388
 389         PVE::Cluster::log_msg('info', 'root@pam', "changed password for user '$userid'");
 390
 391         return undef;
 392     }});
 393
 394 sub get_u2f_config() {
 395     die "u2f support not available\n" if !$u2f_available;
 396
 397     my $dc = cfs_read_file('datacenter.cfg');
 398     my $u2f = $dc->{u2f};
 399     die "u2f not configured in datacenter.cfg\n" if !$u2f;
 400     $u2f = PVE::JSONSchema::parse_property_string($PVE::Cluster::u2f_format, $u2f);
 401     return $u2f;
 402 }
 403
 404 sub get_u2f_instance {
 405     my ($rpcenv, $publicKey, $keyHandle) = @_;
 406
 407     # We store the public key base64 encoded (as the api provides it in binary)
 408     $publicKey = decode_base64($publicKey) if defined($publicKey);
 409
 410     my $u2fconfig = get_u2f_config();
 411     my $u2f = PVE::U2F->new();
 412
 413     # via the 'Host' header (in case a node has multiple hosts available).
 414     my $origin = $u2fconfig->{origin};
 415     if (!defined($origin)) {
 416         $origin = $rpcenv->get_request_host(1);
 417         if ($origin) {
 418             $origin = "https://$origin";
 419         } else {
 420             die "failed to figure out u2f origin\n";
 421         }
 422     }
 423
 424     my $appid = $u2fconfig->{appid} // $origin;
 425     $u2f->set_appid($appid);
 426     $u2f->set_origin($origin);
 427     $u2f->set_publicKey($publicKey) if defined($publicKey);
 428     $u2f->set_keyHandle($keyHandle) if defined($keyHandle);
 429     return $u2f;
 430 }
 431
 432 sub verify_user_tfa_config {
 433     my ($type, $tfa_cfg, $value) = @_;
 434
 435     if (!defined($type)) {
 436         die "missing tfa 'type'\n";
 437     }
 438
 439     if ($type ne 'oath') {
 440         die "invalid type for custom tfa authentication\n";
 441     }
 442
 443     my $secret = $tfa_cfg->{keys}
 444         or die "missing TOTP secret\n";
 445     $tfa_cfg = $tfa_cfg->{config};
 446     # Copy the hash to verify that we have no unexpected keys without modifying the original hash.
 447     $tfa_cfg = {%$tfa_cfg};
 448
 449     # We can only verify 1 secret but oath_verify_otp allows multiple:
 450     if (scalar(PVE::Tools::split_list($secret)) != 1) {
 451         die "only exactly one secret key allowed\n";
 452     }
 453
 454     my $digits = delete($tfa_cfg->{digits}) // 6;
 455     my $step = delete($tfa_cfg->{step}) // 30;
 456     # Maybe also this?
 457     #     my $algorithm = delete($tfa_cfg->{algorithm}) // 'sha1';
 458
 459     if (length(my $more = join(', ', keys %$tfa_cfg))) {
 460         die "unexpected tfa config keys: $more\n";
 461     }
 462
 463     PVE::OTP::oath_verify_otp($value, $secret, $step, $digits);
 464 }
 465
 466 __PACKAGE__->register_method ({
 467     name => 'change_tfa',
 468     path => 'tfa',
 469     method => 'PUT',
 470     permissions => {
 471         description => 'A user can change their own u2f or totp token.',
 472         check => [ 'or',
 473                    ['userid-param', 'self'],
 474                    [ 'and',
 475                      [ 'userid-param', 'Realm.AllocateUser'],
 476                      [ 'userid-group', ['User.Modify']]
 477                    ]
 478             ],
 479     },
 480     protected => 1, # else we can't access shadow files
 481     description => "Change user u2f authentication.",
 482     parameters => {
 483         additionalProperties => 0,
 484         properties => {
 485             userid => get_standard_option('userid', {
 486                 completion => \&PVE::AccessControl::complete_username,
 487             }),
 488             password => {
 489                 optional => 1, # Only required if not root@pam
 490                 description => "The current password.",
 491                 type => 'string',
 492                 minLength => 5,
 493                 maxLength => 64,
 494             },
 495             action => {
 496                 description => 'The action to perform',
 497                 type => 'string',
 498                 enum => [qw(delete new confirm)],
 499             },
 500             response => {
 501                 optional => 1,
 502                 description =>
 503                     'Either the the response to the current u2f registration challenge,'
 504                     .' or, when adding TOTP, the currently valid TOTP value.',
 505                 type => 'string',
 506             },
 507             key => {
 508                 optional => 1,
 509                 description => 'When adding TOTP, the shared secret value.',
 510                 type => 'string',
 511                 # This is what pve-common's PVE::OTP::oath_verify_otp accepts.
 512                 # Should we move this to pve-common's JSONSchema as a named format?
 513                 pattern => qr/[A-Z2-7=]{16}|[A-Fa-f0-9]{40}/,
 514             },
 515             config => {
 516                 optional => 1,
 517                 description => 'A TFA configuration. This must currently be of type TOTP of not set at all.',
 518                 type => 'string',
 519                 format => 'pve-tfa-config',
 520                 maxLength => 128,
 521             },
 522         }
 523     },
 524     returns => { type => 'object' },
 525     code => sub {
 526         my ($param) = @_;
 527
 528         my $rpcenv = PVE::RPCEnvironment::get();
 529         my $authuser = $rpcenv->get_user();
 530
 531         my $action = delete $param->{action};
 532         my $response = delete $param->{response};
 533         my $password = delete($param->{password}) // '';
 534         my $key = delete($param->{key});
 535         my $config = delete($param->{config});
 536
 537         my ($userid, $ruid, $realm) = PVE::AccessControl::verify_username($param->{userid});
 538         $rpcenv->check_user_exist($userid);
 539
 540         # Only root may modify root
 541         raise_perm_exc() if $userid eq 'root@pam' && $authuser ne 'root@pam';
 542
 543         # Regular users need to confirm their password to change u2f settings.
 544         if ($authuser ne 'root@pam') {
 545             raise_param_exc('password' => 'password is required to modify u2f data')
 546                 if !defined($password);
 547             my $domain_cfg = cfs_read_file('domains.cfg');
 548             my $cfg = $domain_cfg->{ids}->{$realm};
 549             die "auth domain '$realm' does not exists\n" if !$cfg;
 550             my $plugin = PVE::Auth::Plugin->lookup($cfg->{type});
 551             $plugin->authenticate_user($cfg, $realm, $ruid, $password);
 552         }
 553
 554         if ($action eq 'delete') {
 555             PVE::AccessControl::user_set_tfa($userid, $realm, undef, undef);
 556             PVE::Cluster::log_msg('info', $authuser, "deleted u2f data for user '$userid'");
 557         } elsif ($action eq 'new') {
 558             if (defined($config)) {
 559                 $config = PVE::Auth::Plugin::parse_tfa_config($config);
 560                 my $type = delete($config->{type});
 561                 my $tfa_cfg = {
 562                     keys => $key,
 563                     config => $config,
 564                 };
 565                 verify_user_tfa_config($type, $tfa_cfg, $response);
 566                 PVE::AccessControl::user_set_tfa($userid, $realm, $type, $tfa_cfg);
 567             } else {
 568                 # The default is U2F:
 569                 my $u2f = get_u2f_instance($rpcenv);
 570                 my $challenge = $u2f->registration_challenge()
 571                     or raise("failed to get u2f challenge");
 572                 $challenge = decode_json($challenge);
 573                 PVE::AccessControl::user_set_tfa($userid, $realm, 'u2f', $challenge);
 574                 return $challenge;
 575             }
 576         } elsif ($action eq 'confirm') {
 577             raise_param_exc('response' => "confirm action requires the 'response' parameter to be set")
 578                 if !defined($response);
 579
 580             my ($type, $u2fdata) = PVE::AccessControl::user_get_tfa($userid, $realm);
 581             raise("no u2f data available")
 582                 if (!defined($type) || $type ne 'u2f');
 583
 584             my $challenge = $u2fdata->{challenge}
 585                 or raise("no active challenge");
 586
 587             my $u2f = get_u2f_instance($rpcenv);
 588             $u2f->set_challenge($challenge);
 589             my ($keyHandle, $publicKey) = $u2f->registration_verify($response);
 590             PVE::AccessControl::user_set_tfa($userid, $realm, 'u2f', {
 591                 keyHandle => $keyHandle,
 592                 publicKey => encode_base64($publicKey, ''),
 593             });
 594         } else {
 595             die "invalid action: $action\n";
 596         }
 597
 598         return {};
 599     }});
 600
 601 __PACKAGE__->register_method({
 602     name => 'verify_tfa',
 603     path => 'tfa',
 604     method => 'POST',
 605     permissions => { user => 'all' },
 606     protected => 1, # else we can't access shadow files
 607     description => 'Finish a u2f challenge.',
 608     parameters => {
 609         additionalProperties => 0,
 610         properties => {
 611             response => {
 612                 type => 'string',
 613                 description => 'The response to the current authentication challenge.',
 614             },
 615         }
 616     },
 617     returns => {
 618         type => 'object',
 619         properties => {
 620             ticket => { type => 'string' },
 621             # cap
 622         }
 623     },
 624     code => sub {
 625         my ($param) = @_;
 626
 627         my $rpcenv = PVE::RPCEnvironment::get();
 628         my $authuser = $rpcenv->get_user();
 629         my ($username, undef, $realm) = PVE::AccessControl::verify_username($authuser);
 630
 631         my ($tfa_type, $tfa_data) = PVE::AccessControl::user_get_tfa($username, $realm);
 632         if (!defined($tfa_type)) {
 633             raise('no u2f data available');
 634         }
 635
 636         eval {
 637             if ($tfa_type eq 'u2f') {
 638                 my $challenge = $rpcenv->get_u2f_challenge()
 639                    or raise('no active challenge');
 640
 641                 my $keyHandle = $tfa_data->{keyHandle};
 642                 my $publicKey = $tfa_data->{publicKey};
 643                 raise("incomplete u2f setup")
 644                     if !defined($keyHandle) || !defined($publicKey);
 645
 646                 my $u2f = get_u2f_instance($rpcenv, $publicKey, $keyHandle);
 647                 $u2f->set_challenge($challenge);
 648
 649                 my ($counter, $present) = $u2f->auth_verify($param->{response});
 650                 # Do we want to do anything with these?
 651             } else {
 652                 # sanity check before handing off to the verification code:
 653                 my $keys = $tfa_data->{keys} or die "missing tfa keys\n";
 654                 my $config = $tfa_data->{config} or die "bad tfa entry\n";
 655                 PVE::AccessControl::verify_one_time_pw($tfa_type, $authuser, $keys, $config, $param->{response});
 656             }
 657         };
 658         if (my $err = $@) {
 659             my $clientip = $rpcenv->get_client_ip() || '';
 660             syslog('err', "authentication verification failure; rhost=$clientip user=$authuser msg=$err");
 661             die PVE::Exception->new("authentication failure\n", code => 401);
 662         }
 663
 664         return {
 665             ticket => PVE::AccessControl::assemble_ticket($authuser),
 666             cap => &$compute_api_permission($rpcenv, $authuser),
 667         }
 668     }});
 669
 670 1;