From c2decf6ec8ca2f60acdb46b9efd69b77be273f77 Mon Sep 17 00:00:00 2001 From: Jianhui Zhao Date: Mon, 10 Feb 2020 19:25:40 +0800 Subject: [PATCH] Drop the pwauth Real Cross-Platform. Avoid exposing system usernames and passwords. Signed-off-by: Jianhui Zhao --- config.go | 2 ++ http.go | 19 +++++----------- main.go | 4 ++++ pwauth/auth_darwin.go | 10 --------- pwauth/auth_freebsd.go | 10 --------- pwauth/auth_linux.go | 35 ----------------------------- pwauth/auth_windows.go | 51 ------------------------------------------ pwauth/pwauth.go | 7 ------ rttys.conf | 6 ++--- 9 files changed, 14 insertions(+), 130 deletions(-) delete mode 100644 pwauth/auth_darwin.go delete mode 100644 pwauth/auth_freebsd.go delete mode 100644 pwauth/auth_linux.go delete mode 100644 pwauth/auth_windows.go delete mode 100644 pwauth/pwauth.go diff --git a/config.go b/config.go index d767823..56595f3 100644 --- a/config.go +++ b/config.go @@ -33,6 +33,8 @@ func parseConfig() *RttysConfig { flag.StringVar(&cfg.addrUser, "addr-user", ":5913", "address to listen user") flag.StringVar(&cfg.sslCert, "ssl-cert", "./rttys.crt", "certFile Path") flag.StringVar(&cfg.sslKey, "ssl-key", "./rttys.key", "keyFile Path") + flag.StringVar(&cfg.httpUsername, "http-username", "", "username for http auth") + flag.StringVar(&cfg.httpPassword, "http-password", "", "password for http auth") flag.StringVar(&cfg.token, "token", "", "token to use") flag.StringVar(&cfg.baseURL, "base-url", "/", "base url to serve on") conf := flag.String("conf", "./rttys.conf", "config file to load") diff --git a/http.go b/http.go index 806a338..042d9f8 100644 --- a/http.go +++ b/http.go @@ -6,7 +6,6 @@ import ( "github.com/rakyll/statik/fs" log "github.com/sirupsen/logrus" "github.com/zhaojh329/rttys/cache" - "github.com/zhaojh329/rttys/pwauth" _ "github.com/zhaojh329/rttys/statik" "io/ioutil" "net/http" @@ -47,23 +46,15 @@ func httpAuth(w http.ResponseWriter, r *http.Request) bool { } func httpLogin(cfg *RttysConfig, creds *Credentials) bool { - if err := pwauth.Auth(creds.Username, creds.Password); err == nil { - return true + if cfg.httpUsername != creds.Username { + return false } - if cfg.httpUsername != "" { - if cfg.httpUsername != creds.Username { - return false - } - - if cfg.httpPassword != "" { - return cfg.httpPassword == creds.Password - } - - return true + if cfg.httpPassword != "" { + return cfg.httpPassword == creds.Password } - return false + return true } func httpStart(br *Broker, cfg *RttysConfig) { diff --git a/main.go b/main.go index ae93840..a124840 100644 --- a/main.go +++ b/main.go @@ -21,6 +21,10 @@ func init() { func main() { cfg := parseConfig() + if cfg.httpUsername == "" { + log.Fatal("You must configure the http username by commandline or config file") + } + log.Info("Go Version: ", runtime.Version()) log.Info("Go OS/Arch: ", runtime.GOOS, "/", runtime.GOARCH) diff --git a/pwauth/auth_darwin.go b/pwauth/auth_darwin.go deleted file mode 100644 index 87d5a84..0000000 --- a/pwauth/auth_darwin.go +++ /dev/null @@ -1,10 +0,0 @@ -package pwauth - -import ( - "errors" -) - -// Need to be implemented -func auth(username, password string) error { - return errors.New("not implemented") -} diff --git a/pwauth/auth_freebsd.go b/pwauth/auth_freebsd.go deleted file mode 100644 index 87d5a84..0000000 --- a/pwauth/auth_freebsd.go +++ /dev/null @@ -1,10 +0,0 @@ -package pwauth - -import ( - "errors" -) - -// Need to be implemented -func auth(username, password string) error { - return errors.New("not implemented") -} diff --git a/pwauth/auth_linux.go b/pwauth/auth_linux.go deleted file mode 100644 index 5062a88..0000000 --- a/pwauth/auth_linux.go +++ /dev/null @@ -1,35 +0,0 @@ -package pwauth - -import ( - "errors" - "fmt" - "github.com/msteinert/pam" -) - -func auth(username, password string) error { - t, err := pam.StartFunc("rttys", username, func(s pam.Style, msg string) (string, error) { - switch s { - case pam.PromptEchoOff: - return password, nil - case pam.PromptEchoOn: - return password, nil - case pam.ErrorMsg: - fmt.Print(msg) - return "", nil - case pam.TextInfo: - fmt.Println(msg) - return "", nil - } - return "", errors.New("Unrecognized message style") - }) - if err != nil { - return err - } - - err = t.Authenticate(0) - if err != nil { - return err - } - - return nil -} diff --git a/pwauth/auth_windows.go b/pwauth/auth_windows.go deleted file mode 100644 index f65c8c9..0000000 --- a/pwauth/auth_windows.go +++ /dev/null @@ -1,51 +0,0 @@ -package pwauth - -import ( - "os/user" - "syscall" - "unsafe" -) - -const ( - LOGON32_LOGON_INTERACTIVE = 2 - LOGON32_PROVIDER_DEFAULT = 0 -) - -var errERROR_ACCOUNT_RESTRICTION error = syscall.Errno(1327) - -var ( - advapi32 = syscall.NewLazyDLL("advapi32.dll") - procLogonUserW = advapi32.NewProc("LogonUserW") -) - -func LogonUserW(username, domain, password *uint16, logonType, logonProvider uint32) (token syscall.Handle, err error) { - r1, _, e1 := procLogonUserW.Call( - uintptr(unsafe.Pointer(username)), - uintptr(unsafe.Pointer(domain)), - uintptr(unsafe.Pointer(password)), - uintptr(logonType), - uintptr(logonProvider), - uintptr(unsafe.Pointer(&token))) - if int(r1) == 0 { - return syscall.InvalidHandle, e1 - } - return token, nil -} - -func auth(username, password string) error { - if _, err := user.Lookup(username); err != nil { - return err - } - - pUsername, _ := syscall.UTF16PtrFromString(username) - pDomain, _ := syscall.UTF16PtrFromString(".") - pPassword, _ := syscall.UTF16PtrFromString(password) - - _, err := LogonUserW(pUsername, pDomain, pPassword, LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT) - - if err == errERROR_ACCOUNT_RESTRICTION { - return nil - } - - return err -} diff --git a/pwauth/pwauth.go b/pwauth/pwauth.go deleted file mode 100644 index e2f264d..0000000 --- a/pwauth/pwauth.go +++ /dev/null @@ -1,7 +0,0 @@ -package pwauth - -// Auth check the validity of the username/password pair.If the -// credentials are not valid, this function will return an error. -func Auth(username, password string) error { - return auth(username, password) -} diff --git a/rttys.conf b/rttys.conf index da873ba..d62f99e 100644 --- a/rttys.conf +++ b/rttys.conf @@ -1,9 +1,9 @@ #addr-dev: :5912 #addr-user: :5913 -# default from system -#http-username: rttys -#http-password: rttys +# Auth for http +http-username: rttys +http-password: rttys #ssl-cert: /etc/rttys/rttys.crt #ssl-key: /etc/rttys/rttys.key