add oath two factor auth, bump version to 3.0-14

diff --git a/Makefile b/Makefile
index 561b71cfcc97d0141431fd3d22447dfb1ac55c25..eb7cb80371647d2aa5652be778aea776012b41cc 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@ RELEASE=3.2
 
 VERSION=3.0
 PACKAGE=libpve-access-control
-PKGREL=13
+PKGREL=14
 
 DESTDIR=
 PREFIX=/usr
@@ -35,10 +35,11 @@ pveum.1.pod: pveum
        mv $@.tmp $@
 
 .PHONY: install
-install: pveum.1.pod pveum.1.gz
+install: pveum.1.pod pveum.1.gz oathkeygen
        install -d ${DESTDIR}${BINDIR}
        install -d ${DESTDIR}${SBINDIR}
        install -m 0755 pveum ${DESTDIR}${SBINDIR}
+       install -m 0755 oathkeygen ${DESTDIR}${BINDIR}
        make -C PVE install
        perl -I. ./pveum verifyapi 
        install -d ${DESTDIR}/usr/share/man/man1

diff --git a/PVE/API2/Domains.pm b/PVE/API2/Domains.pm
index dac56608da05aec8e639187514433308d6b2e63f..fff3734a5969e2a3cd17f0f772cb8bde8076c1fc 100644 (file)
--- a/PVE/API2/Domains.pm
+++ b/PVE/API2/Domains.pm
@@ -37,7 +37,7 @@ __PACKAGE__->register_method ({
                tfa => {
                    description => "Two-factor authentication provider.",
                    type => 'string',
-                   enum => [ 'yubico' ],
+                   enum => [ 'yubico', 'oath' ],
                    optional => 1,
                },
                comment => { type => 'string', optional => 1 },

diff --git a/PVE/AccessControl.pm b/PVE/AccessControl.pm
index ef158fb62fb4ac1a1b98a58c2ae24120dca624be..5a74a8e5f7855b61c14f7767b347b278b97ba2e6 100644 (file)
--- a/PVE/AccessControl.pm
+++ b/PVE/AccessControl.pm
@@ -376,6 +376,9 @@ sub verify_one_time_pw {
     if ($type eq 'yubico') {
        my $keys = $usercfg->{users}->{$username}->{keys};
        yubico_verify_otp($otp, $keys, $tfa_cfg->{url}, $tfa_cfg->{id}, $tfa_cfg->{key}, $proxy);
+    } elsif ($type eq 'oath') {
+       my $keys = $usercfg->{users}->{$username}->{keys};
+       oath_verify_otp($otp, $keys);
     } else {
        die "unknown tfa type '$type'\n";
     }
@@ -753,7 +756,8 @@ sub parse_user_config {
            $cfg->{users}->{$user}->{email} = $email;
            $cfg->{users}->{$user}->{comment} = PVE::Tools::decode_text($comment) if $comment;
            $cfg->{users}->{$user}->{expire} = $expire;
-           $cfg->{users}->{$user}->{keys} = $keys if $keys; # allowed yubico key ids
+           # keys: allowed yubico key ids or oath secrets (base32 encoded)
+           $cfg->{users}->{$user}->{keys} = $keys if $keys; 
 
            #$cfg->{users}->{$user}->{groups}->{$group} = 1;
            #$cfg->{groups}->{$group}->{$user} = 1;
@@ -1224,4 +1228,34 @@ sub yubico_verify_otp {
     return $result;
 }
 
+sub oath_verify_otp {
+    my ($otp, $keys) = @_;
+
+    die "oath: missing password\n" if !defined($otp);
+    die "oath: no associated oath keys\n" if $keys =~ m/^\s+$/; 
+
+    my $step = 30;
+
+    my $found;
+
+    my $parser = sub {
+       my $line = shift;
+
+       if ($line =~ m/^\d{6}$/) {
+           print "GOT:$line\n";
+           $found = 1 if $otp eq $line;
+       }
+    };
+
+    foreach my $k (PVE::Tools::split_list($keys)) {
+       # Note: we generate 3 values to allow small time drift
+       my $now = localtime(time() - $step);
+       my $cmd = ['oathtool', '--totp', '-N', $now, '-s', $step, '-w', '2', '-b', $k];
+       eval { run_command($cmd, outfunc => $parser, errfunc => sub {}); };
+       last if $found;
+    }
+
+    die "oath auth failed\n" if !$found;
+}
+
 1;

diff --git a/PVE/Auth/Plugin.pm b/PVE/Auth/Plugin.pm
index f19a33cd696067562863ddbecaff23cbd6852a39..13083406a1c66f66be22473f670e3e525178f570 100755 (executable)
--- a/PVE/Auth/Plugin.pm
+++ b/PVE/Auth/Plugin.pm
@@ -108,7 +108,7 @@ sub parse_tfa_config {
 
     foreach my $kvp (split(/,/, $data)) {
 
-       if ($kvp =~ m/^type=(yubico)$/) {
+       if ($kvp =~ m/^type=(yubico|oath)$/) {
            $res->{type} = $1;
        } elsif ($kvp =~ m/^id=(\S+)$/) {
            $res->{id} = $1;

diff --git a/changelog.Debian b/changelog.Debian
index 5ee9bb20aa34164a1546554ed9a7b6381fc284f1..cc6d1b77ff56baefe808d99ce2e6a675cc167af9 100644 (file)
--- a/changelog.Debian
+++ b/changelog.Debian
@@ -1,3 +1,17 @@
+libpve-access-control (3.0-14) unstable; urgency=low
+  
+  * add oath two factor auth
+
+  * add oathkeygen binary to generate keys for oath
+  
+  * add yubico two factor auth
+
+  * dedend on oathtool
+  
+  * depend on libmime-base32-perl
+
+ -- Proxmox Support Team <support@proxmox.com>  Thu, 17 Jul 2014 13:09:56 +0200
+
 libpve-access-control (3.0-13) unstable; urgency=low
 
   * use correct connection string for AD auth

diff --git a/control.in b/control.in
index fffccb8dab4a9a6a2e4f2e99562384140f9844ff..876d3ddc0226fe242d440f7f66734178ebd144c0 100644 (file)
--- a/control.in
+++ b/control.in
@@ -3,7 +3,7 @@ Version: @@VERSION@@-@@PKGRELEASE@@
 Section: perl
 Priority: optional
 Architecture: @@ARCH@@
-Depends: libc6 (>= 2.3), perl (>= 5.6.0-16), libcrypt-openssl-rsa-perl, libcrypt-openssl-random-perl, libjson-xs-perl, libjson-perl, libterm-readline-gnu-perl,libnet-ldap-perl, libpve-common-perl, pve-cluster, libauthen-pam-perl, libnet-ssleay-perl, libdigest-hmac-perl, liburi-perl, libwww-perl
+Depends: libc6 (>= 2.3), perl (>= 5.6.0-16), libcrypt-openssl-rsa-perl, libcrypt-openssl-random-perl, libjson-xs-perl, libjson-perl, libterm-readline-gnu-perl,libnet-ldap-perl, libpve-common-perl, pve-cluster, libauthen-pam-perl, libnet-ssleay-perl, libdigest-hmac-perl, liburi-perl, libwww-perl, oathtool, libmime-base32-perl
 Maintainer: Proxmox Support Team <support@proxmox.com>
 Description: Proxmox VE access control library
  This package contains the role based user management and access

diff --git a/oathkeygen b/oathkeygen
new file mode 100755 (executable)
index 0000000..84b6441
--- /dev/null
+++ b/oathkeygen
@@ -0,0 +1,11 @@
+#!/usr/bin/perl
+
+use strict;
+use warnings;
+use MIME::Base32 qw(RFC); #libmime-base32-perl
+
+my $test;
+open(RND, "/dev/urandom");
+sysread(RND, $test, 10) == 10 || die "read randon data failed\n";
+print MIME::Base32::encode($test) . "\n";
+