pve-access-control.git
3 years agobump version to 4.0-18
Wolfgang Bumiller [Thu, 21 Jul 2016 06:44:25 +0000 (08:44 +0200)]
bump version to 4.0-18

3 years agofix #1062: use correct length for base32 keys
Dominik Csapak [Wed, 20 Jul 2016 11:31:33 +0000 (13:31 +0200)]
fix #1062: use correct length for base32 keys

we wrongly assumed the keys to be 32 chars long,
instead of 16

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
3 years agobump version to 4.0-17
Wolfgang Bumiller [Mon, 11 Jul 2016 10:04:39 +0000 (12:04 +0200)]
bump version to 4.0-17

3 years agodrop oathtool dependency
Wolfgang Bumiller [Fri, 1 Jul 2016 08:15:28 +0000 (10:15 +0200)]
drop oathtool dependency

Generate hotp/totp in perl directly, also support keys in
hex notation (this is how eg. the
yubikey-personalization-gui displays them, but without the
whitespaces).

3 years agodrop libdigest-hmac-perl dependency
Wolfgang Bumiller [Fri, 1 Jul 2016 08:15:27 +0000 (10:15 +0200)]
drop libdigest-hmac-perl dependency

Its functionality is provided by perl core's Digest::SHA
module now.

3 years agoremove unused inline docs
Dietmar Maurer [Fri, 8 Apr 2016 05:08:23 +0000 (07:08 +0200)]
remove unused inline docs

3 years agouse pve-doc-generator, bump version to 4.0-16
Dietmar Maurer [Fri, 8 Apr 2016 05:06:27 +0000 (07:06 +0200)]
use pve-doc-generator, bump version to 4.0-16

3 years agobump version to 4.0-15
Dietmar Maurer [Fri, 1 Apr 2016 05:11:24 +0000 (07:11 +0200)]
bump version to 4.0-15

3 years agoFix uninitialized warning
Fabian Grünbichler [Wed, 30 Mar 2016 10:09:12 +0000 (12:09 +0200)]
Fix uninitialized warning

when shadow.cfg does not exist, parsing should return an
empty hash instead of displaying a warning

3 years agobump version to 4.0-14
Dietmar Maurer [Tue, 15 Mar 2016 15:47:51 +0000 (16:47 +0100)]
bump version to 4.0-14

3 years agoAdd is_worker to RPCEnvironment
Fabian Grünbichler [Tue, 15 Mar 2016 12:58:44 +0000 (13:58 +0100)]
Add is_worker to RPCEnvironment

after forking the actual worker process, the child/worker
sets a flag that can be checked later on by methods called
in the worker.

used in the ZFS storage plugins in pve-storage to decide on
a short or long default timeout for ZFS operations.

3 years agobump version to 4.0-13
Dietmar Maurer [Mon, 14 Mar 2016 10:39:43 +0000 (11:39 +0100)]
bump version to 4.0-13

3 years agofix typos and grammar
Fabian Grünbichler [Mon, 14 Mar 2016 10:25:03 +0000 (11:25 +0100)]
fix typos and grammar

3 years agofix #916: allow HTTPS to access custom yubico url
Fabian Grünbichler [Mon, 14 Mar 2016 10:25:02 +0000 (11:25 +0100)]
fix #916: allow HTTPS to access custom yubico url

remove the limit to HTTP only, since it would only apply for
custom yubico validation server urls anyway.

3 years agobump version to 4.0-12
Dietmar Maurer [Wed, 9 Mar 2016 13:41:35 +0000 (14:41 +0100)]
bump version to 4.0-12

3 years agoCatch error instead of segfaulting
Fabian Grünbichler [Tue, 8 Mar 2016 15:17:55 +0000 (16:17 +0100)]
Catch error instead of segfaulting

when trying to parse a certificate subject, Net::SSLeay
will segfault in libcrypto when given 0 as input. Catch
this and die with a meaningful error message instead.

3 years agobump version to 4.0-11
Dietmar Maurer [Fri, 8 Jan 2016 11:53:03 +0000 (12:53 +0100)]
bump version to 4.0-11

3 years agoFix #861: use safer sprintf formatting
Wolfgang Bumiller [Fri, 8 Jan 2016 11:43:43 +0000 (12:43 +0100)]
Fix #861: use safer sprintf formatting

3 years agoset RELEASE=4.1
Dietmar Maurer [Thu, 3 Dec 2015 11:12:43 +0000 (12:12 +0100)]
set RELEASE=4.1

3 years agobump version to 4.0-10
Dietmar Maurer [Thu, 3 Dec 2015 11:09:51 +0000 (12:09 +0100)]
bump version to 4.0-10

3 years agoAuth::LDAP, Auth::AD: ipv6 support
Wolfgang Bumiller [Wed, 2 Dec 2015 15:06:46 +0000 (16:06 +0100)]
Auth::LDAP, Auth::AD: ipv6 support

Also had to change server1/server2 schema from a pattern to
the 'address' format.

3 years agoimprove manual page
Dietmar Maurer [Fri, 2 Oct 2015 08:59:40 +0000 (10:59 +0200)]
improve manual page

3 years agomake read_password a CLIHandler class method
Dietmar Maurer [Fri, 2 Oct 2015 08:45:58 +0000 (10:45 +0200)]
make read_password a CLIHandler class method

And use new run_cli_handler() method.

3 years agobump version to 4.0-9
Dietmar Maurer [Thu, 1 Oct 2015 15:23:12 +0000 (17:23 +0200)]
bump version to 4.0-9

3 years agopveum: implement bash completion hooks
Dietmar Maurer [Thu, 1 Oct 2015 15:22:09 +0000 (17:22 +0200)]
pveum: implement bash completion hooks

3 years agopveum: install bash completion config
Dietmar Maurer [Thu, 1 Oct 2015 14:53:01 +0000 (16:53 +0200)]
pveum: install bash completion config

3 years agoconvert pveum into a PVE::CLI class
Dietmar Maurer [Thu, 1 Oct 2015 14:44:43 +0000 (16:44 +0200)]
convert pveum into a PVE::CLI class

4 years agobump version to 4.0-8
Dietmar Maurer [Wed, 19 Aug 2015 13:39:34 +0000 (15:39 +0200)]
bump version to 4.0-8

4 years agoremove_storage_access: cleanup of access permissions for removed storage
Alen Grizonic [Wed, 19 Aug 2015 08:32:19 +0000 (10:32 +0200)]
remove_storage_access: cleanup of access permissions for removed storage

Signed-off-by: Alen Grizonic <a.grizonic@proxmox.com>
4 years agobump version to 4.0-7
Dietmar Maurer [Fri, 14 Aug 2015 05:57:29 +0000 (07:57 +0200)]
bump version to 4.0-7

4 years agocleanup: avoid writing user.cfg twice
Dietmar Maurer [Fri, 14 Aug 2015 05:55:36 +0000 (07:55 +0200)]
cleanup: avoid writing user.cfg twice

4 years agowhite space cleanup
Dietmar Maurer [Fri, 14 Aug 2015 05:49:18 +0000 (07:49 +0200)]
white space cleanup

4 years agoaccess permissions cleanup fix
Alen Grizonic [Thu, 13 Aug 2015 11:41:33 +0000 (13:41 +0200)]
access permissions cleanup fix

for removed vms and pools

Signed-off-by: Alen Grizonic <a.grizonic@proxmox.com>
4 years agofix access of possibly undefined variable
Wolfgang Bumiller [Fri, 7 Aug 2015 07:49:53 +0000 (09:49 +0200)]
fix access of possibly undefined variable

4 years agobump version to 4.0-6
Dietmar Maurer [Mon, 27 Jul 2015 11:14:54 +0000 (13:14 +0200)]
bump version to 4.0-6

4 years agoimprove parse_user_config, parse_shadow_config
Wolfgang Bumiller [Wed, 15 Jul 2015 08:25:42 +0000 (10:25 +0200)]
improve parse_user_config, parse_shadow_config

same as in pve-common: replace substituting line parsing
with /gm modified match regexps.

4 years agobump version to 4.0-5
Dietmar Maurer [Wed, 10 Jun 2015 08:40:28 +0000 (10:40 +0200)]
bump version to 4.0-5

4 years agopveum: check for $cmd being defined
Wolfgang Bumiller [Wed, 10 Jun 2015 07:20:00 +0000 (09:20 +0200)]
pveum: check for $cmd being defined

fixes an 'undefined value' error when no command is
specified.

4 years agobump version to 4.0-4
Dietmar Maurer [Mon, 1 Jun 2015 10:25:48 +0000 (12:25 +0200)]
bump version to 4.0-4

4 years agouse activate-noawait triggers
Dietmar Maurer [Mon, 1 Jun 2015 08:03:48 +0000 (10:03 +0200)]
use activate-noawait triggers

4 years agobump version to 4.0-3
Dietmar Maurer [Wed, 27 May 2015 09:16:01 +0000 (11:16 +0200)]
bump version to 4.0-3

4 years agoremote_viewer_config: brackets around ipv6 http address
Wolfgang Bumiller [Wed, 27 May 2015 07:30:55 +0000 (09:30 +0200)]
remote_viewer_config: brackets around ipv6 http address

4 years agonon-root buildfix
Wolfgang Bumiller [Wed, 27 May 2015 07:30:54 +0000 (09:30 +0200)]
non-root buildfix

4 years agobump version to 4.0-2
Dietmar Maurer [Tue, 5 May 2015 13:06:53 +0000 (15:06 +0200)]
bump version to 4.0-2

4 years agotrigger pve-api-updates event
Dietmar Maurer [Tue, 5 May 2015 13:06:06 +0000 (15:06 +0200)]
trigger pve-api-updates event

4 years agobump version for Debian Jessie
Dietmar Maurer [Thu, 26 Feb 2015 10:31:54 +0000 (11:31 +0100)]
bump version for Debian Jessie

4 years agobump version to 3.0-16
Dietmar Maurer [Fri, 30 Jan 2015 05:20:42 +0000 (06:20 +0100)]
bump version to 3.0-16

4 years agoFix: disable root
Wolfgang Link [Wed, 28 Jan 2015 09:36:49 +0000 (10:36 +0100)]
Fix: disable root

root can now be disabled in GUI.

Signed-off-by: Wolfgang Link <w.link@proxmox.com>
5 years agoremove debugging code
Dietmar Maurer [Wed, 23 Jul 2014 05:02:37 +0000 (07:02 +0200)]
remove debugging code

5 years agobump version to 3.0-15
Dietmar Maurer [Wed, 23 Jul 2014 05:01:04 +0000 (07:01 +0200)]
bump version to 3.0-15

5 years agoadd step/digits option to oath configuration
Dietmar Maurer [Wed, 23 Jul 2014 04:59:01 +0000 (06:59 +0200)]
add step/digits option to oath configuration

5 years agoallow to write builtin auth domains
Dietmar Maurer [Fri, 18 Jul 2014 09:24:55 +0000 (11:24 +0200)]
allow to write builtin auth domains

So that we can set tfa, comment, default with the GUI.

5 years agoadd oath two factor auth, bump version to 3.0-14
Dietmar Maurer [Thu, 17 Jul 2014 11:59:53 +0000 (13:59 +0200)]
add oath two factor auth, bump version to 3.0-14

5 years agoenable yubico OTP (by removing debuging code)
Dietmar Maurer [Tue, 15 Jul 2014 12:18:17 +0000 (14:18 +0200)]
enable yubico OTP (by removing debuging code)

5 years agoadd basic support for two factor auth
Dietmar Maurer [Mon, 23 Jun 2014 09:42:44 +0000 (11:42 +0200)]
add basic support for two factor auth

5 years agoadd experimental code for yubico OTP verification
Dietmar Maurer [Fri, 20 Jun 2014 10:58:17 +0000 (12:58 +0200)]
add experimental code for yubico OTP verification

5 years agobump version to 3.0-13
Dietmar Maurer [Thu, 22 May 2014 05:16:36 +0000 (07:16 +0200)]
bump version to 3.0-13

5 years agouse correct connection string for AD auth (use encryption and port info).
Dietmar Maurer [Thu, 22 May 2014 05:12:25 +0000 (07:12 +0200)]
use correct connection string for AD auth (use encryption and port info).

5 years agobump version to 3.0-12
Dietmar Maurer [Wed, 30 Apr 2014 12:48:27 +0000 (14:48 +0200)]
bump version to 3.0-12

5 years agoadd dummy API for login page
Dietmar Maurer [Wed, 30 Apr 2014 12:45:57 +0000 (14:45 +0200)]
add dummy API for login page

5 years agobump version tp 3.0-11
Dietmar Maurer [Fri, 31 Jan 2014 09:26:17 +0000 (10:26 +0100)]
bump version tp 3.0-11

5 years agocleanup previous patch
Dietmar Maurer [Wed, 22 Jan 2014 06:25:09 +0000 (07:25 +0100)]
cleanup previous patch

5 years agoSets common hot keys for spice client
Lindsay Mathieson [Thu, 16 Jan 2014 13:14:01 +0000 (23:14 +1000)]
Sets common hot keys for spice client

 * "Ctl-Alt-Insert" for secure-attention (Ctrl-Alt-del)
 * "Shift-F11" for Full Screen toggle
 * "Ctrl-Alt-R" for cursor release

Signed-off-by: Lindsay Mathieson <lindsay.mathieson@gmail.com>
5 years agobump version to 3.0-10
Dietmar Maurer [Tue, 10 Dec 2013 09:45:25 +0000 (10:45 +0100)]
bump version to 3.0-10

5 years agoimplement helper to generate SPICE remote-viewer configuration
Dietmar Maurer [Tue, 10 Dec 2013 09:38:42 +0000 (10:38 +0100)]
implement helper to generate SPICE remote-viewer configuration

Moved read_x509_subject_spice() from PVE::QemuServer.
Depend on libnet-ssleay-perl.

5 years agoallow dots in access paths
Dietmar Maurer [Tue, 26 Nov 2013 06:50:20 +0000 (07:50 +0100)]
allow dots in access paths

Because storage IDs may contain dots.

5 years agoreturn correct 401 status code for unauthorized calls
Dietmar Maurer [Mon, 18 Nov 2013 10:23:50 +0000 (11:23 +0100)]
return correct 401 status code for unauthorized calls

New HTTP::Server will delay the call by 3 seconds.

5 years agobump version to 3.0-9
Dietmar Maurer [Mon, 18 Nov 2013 08:07:01 +0000 (09:07 +0100)]
bump version to 3.0-9

5 years agoprevent user enumeration attacks
Dietmar Maurer [Mon, 18 Nov 2013 08:05:04 +0000 (09:05 +0100)]
prevent user enumeration attacks

5 years agobump version to 3.0-8
Dietmar Maurer [Mon, 28 Oct 2013 07:12:29 +0000 (08:12 +0100)]
bump version to 3.0-8

5 years agospice: use lowercase hostname in ticktet signature
Dietmar Maurer [Mon, 28 Oct 2013 07:10:48 +0000 (08:10 +0100)]
spice: use lowercase hostname in ticktet signature

5 years agouse warnings instead of global -w flag
Dietmar Maurer [Tue, 1 Oct 2013 11:03:43 +0000 (13:03 +0200)]
use warnings instead of global -w flag

5 years agobump version to 3.0-7
Dietmar Maurer [Tue, 1 Oct 2013 10:36:02 +0000 (12:36 +0200)]
bump version to 3.0-7

5 years agoremove path related code from check_volume_access()
Dietmar Maurer [Tue, 1 Oct 2013 10:09:51 +0000 (12:09 +0200)]
remove path related code from check_volume_access()

5 years agocheck_volume_access : use parse_volname instead path
Alexandre Derumier [Wed, 25 Sep 2013 08:27:43 +0000 (10:27 +0200)]
check_volume_access : use parse_volname instead path

to avoid extra calls for some storageplugins (zfs,nexenta).

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
6 years agoadd reference to git version
Dietmar Maurer [Mon, 2 Sep 2013 08:32:39 +0000 (10:32 +0200)]
add reference to git version

6 years agobump version to 3.0-6
Dietmar Maurer [Fri, 19 Jul 2013 10:39:26 +0000 (12:39 +0200)]
bump version to 3.0-6

6 years agoproduce shorter spiceproxy tickets
Dietmar Maurer [Fri, 19 Jul 2013 10:35:23 +0000 (12:35 +0200)]
produce shorter spiceproxy tickets

By using a simple Digest with private secret /etc/pve/pve-www.key. This is
less secure than pub key auth, but good enough for the proxy.

6 years agobump version to 3.0-5
Dietmar Maurer [Wed, 26 Jun 2013 11:08:58 +0000 (13:08 +0200)]
bump version to 3.0-5

6 years agonew ticket code for spice
Dietmar Maurer [Wed, 26 Jun 2013 11:07:00 +0000 (13:07 +0200)]
new ticket code for spice

6 years agoassemble_spice_ticket: do not use base32 encoding
Dietmar Maurer [Tue, 25 Jun 2013 10:03:48 +0000 (12:03 +0200)]
assemble_spice_ticket: do not use base32 encoding

6 years agoassemble_spice_ticket
Alexandre Derumier [Tue, 25 Jun 2013 07:12:52 +0000 (09:12 +0200)]
assemble_spice_ticket

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
6 years agobump version to 3.0-4
Dietmar Maurer [Tue, 14 May 2013 09:57:13 +0000 (11:57 +0200)]
bump version to 3.0-4

6 years agomoved add_vm_to_pool/remove_vm_from_pool from qemu-server
Dietmar Maurer [Tue, 14 May 2013 09:55:26 +0000 (11:55 +0200)]
moved add_vm_to_pool/remove_vm_from_pool from qemu-server

Because we can also use this for openvz containers

6 years agorename VM.Copy to VM.Clone
Dietmar Maurer [Thu, 2 May 2013 09:44:52 +0000 (11:44 +0200)]
rename VM.Copy to VM.Clone

6 years agobump version to 3.0-3
Dietmar Maurer [Mon, 29 Apr 2013 09:42:25 +0000 (11:42 +0200)]
bump version to 3.0-3

6 years agoadd VM.Copy priviledge
Dietmar Maurer [Mon, 29 Apr 2013 09:40:32 +0000 (11:40 +0200)]
add VM.Copy priviledge

And a new role called PVETemplateUser

6 years agoremove CGI.pm related code
Dietmar Maurer [Mon, 15 Apr 2013 10:34:41 +0000 (12:34 +0200)]
remove CGI.pm related code

New pveproxy does not need that.

6 years agobump version to 3.0-1 for wheezy release
Dietmar Maurer [Fri, 15 Mar 2013 07:07:17 +0000 (08:07 +0100)]
bump version to 3.0-1 for wheezy release

6 years agofix access permissions for backup files
Dietmar Maurer [Thu, 28 Feb 2013 09:01:04 +0000 (10:01 +0100)]
fix access permissions for backup files

bump version to 1.0-26

6 years agobump RELEASE to 2.2
Dietmar Maurer [Mon, 24 Sep 2012 10:00:15 +0000 (12:00 +0200)]
bump RELEASE to 2.2

7 years agoadd VM.Snapshot permission
Dietmar Maurer [Mon, 10 Sep 2012 07:24:19 +0000 (09:24 +0200)]
add VM.Snapshot permission

7 years agountaint path
Dietmar Maurer [Wed, 6 Jun 2012 11:06:51 +0000 (13:06 +0200)]
untaint path

7 years agocorrectly compute GUI capabilities (consider pools)
Dietmar Maurer [Wed, 30 May 2012 06:47:43 +0000 (08:47 +0200)]
correctly compute GUI capabilities (consider pools)

7 years agonew plugin architecture for Auth modules
Dietmar Maurer [Wed, 16 May 2012 05:22:25 +0000 (07:22 +0200)]
new plugin architecture for Auth modules

7 years agodo not allow user names including slash
Dietmar Maurer [Tue, 24 Apr 2012 08:10:35 +0000 (10:10 +0200)]
do not allow user names including slash

7 years agoadd ability to fork cli workers in background
Dietmar Maurer [Tue, 24 Apr 2012 08:10:12 +0000 (10:10 +0200)]
add ability to fork cli workers in background

7 years agoreturn set of privileges on login - can be used to adopt GUI
Dietmar Maurer [Tue, 17 Apr 2012 08:26:48 +0000 (10:26 +0200)]
return set of privileges on login - can be used to adopt GUI

7 years agofix bug #151: corretly parse username inside ticket
Dietmar Maurer [Wed, 11 Apr 2012 08:21:15 +0000 (10:21 +0200)]
fix bug #151: corretly parse username inside ticket

7 years agoallow users to change his own password
Dietmar Maurer [Wed, 11 Apr 2012 07:40:42 +0000 (09:40 +0200)]
allow users to change his own password