From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id AE75E918ED for ; Thu, 15 Feb 2024 16:20:18 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 3CF2316729 for ; Thu, 15 Feb 2024 16:20:18 +0100 (CET) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for ; Thu, 15 Feb 2024 16:20:16 +0100 (CET) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id D143748418 for ; Thu, 15 Feb 2024 16:20:15 +0100 (CET) From: Stefan Sterz To: pbs-devel@lists.proxmox.com Date: Thu, 15 Feb 2024 16:20:00 +0100 Message-Id: <20240215152001.269490-12-s.sterz@proxmox.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20240215152001.269490-1-s.sterz@proxmox.com> References: <20240215152001.269490-1-s.sterz@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL -0.082 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record T_SCC_BODY_TEXT_LINE -0.01 - Subject: [pbs-devel] [PATCH proxmox-backup 11/12] auth/manager: add manager command to upgrade hashes X-BeenThere: pbs-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Backup Server development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Feb 2024 15:20:18 -0000 this uses proxmox-sys' `upgrade_hash` function to upgrade all stored hashes that don't already use the latest hash. this allows admins to upgrade their user's password hashes even if the user's don't log in. however, as this requires a newer version of proxmox-sys' `verify_crypt_pw` function to work, make this a command that admin's can optional perform instead of automatically upgrading all hashes. admins can reset their users password to avoid issues when downgrading pbs or similar to work around potential issues here, but doing this automatically may cause problems. Signed-off-by: Stefan Sterz --- note that once an admin has upgraded a hash, downgrading proxmox-backup-server will break logging in for all users with upgraded passwords. an admin would then need to manually reset the password via `proxmox-backup-manager user update --password `. src/auth_helpers.rs | 38 +++++++++++++++++++++++++- src/bin/proxmox_backup_manager/user.rs | 34 ++++++++++++++++++++++- 2 files changed, 70 insertions(+), 2 deletions(-) diff --git a/src/auth_helpers.rs b/src/auth_helpers.rs index 1a483d84..375ce190 100644 --- a/src/auth_helpers.rs +++ b/src/auth_helpers.rs @@ -1,7 +1,8 @@ +use std::collections::HashMap; use std::path::PathBuf; use std::sync::OnceLock; -use anyhow::Error; +use anyhow::{format_err, Error}; use lazy_static::lazy_static; use openssl::pkey::{PKey, Private, Public}; use openssl::rsa::Rsa; @@ -16,6 +17,41 @@ use serde_json::json; pub use crate::auth::setup_auth_context; pub use proxmox_auth_api::api::assemble_csrf_prevention_token; +pub fn upgrade_password_hashes() -> Result<(), Error> { + let data = + proxmox_sys::fs::file_get_json(crate::auth::SHADOW_CONFIG_FILENAME, Some(json!({})))?; + let mut new = HashMap::new(); + + for (username, password) in data + .as_object() + .ok_or_else(|| format_err!("shadow file has an unexpected format!"))? + { + let upgraded_password = proxmox_sys::crypt::upgrade_hash( + password + .as_str() + .ok_or_else(|| format_err!("user without password found!"))?, + )?; + + new.insert(username.as_str(), upgraded_password); + } + + let mode = nix::sys::stat::Mode::from_bits_truncate(0o0600); + let options = proxmox_sys::fs::CreateOptions::new() + .perm(mode) + .owner(nix::unistd::ROOT) + .group(nix::unistd::Gid::from_raw(0)); + + let new_data = serde_json::to_vec_pretty(&new)?; + proxmox_sys::fs::replace_file( + crate::auth::SHADOW_CONFIG_FILENAME, + &new_data, + options, + true, + )?; + + Ok(()) +} + pub fn generate_csrf_key() -> Result<(), Error> { let path = PathBuf::from(configdir!("/csrf.key")); diff --git a/src/bin/proxmox_backup_manager/user.rs b/src/bin/proxmox_backup_manager/user.rs index 743c5d16..2daf2db7 100644 --- a/src/bin/proxmox_backup_manager/user.rs +++ b/src/bin/proxmox_backup_manager/user.rs @@ -1,7 +1,9 @@ -use anyhow::Error; +use anyhow::{bail, Error}; use serde_json::Value; use std::collections::HashMap; +use std::io::IsTerminal; +use std::io::Write; use proxmox_router::{cli::*, ApiHandler, RpcEnvironment}; use proxmox_schema::api; @@ -65,6 +67,32 @@ fn list_users(param: Value, rpcenv: &mut dyn RpcEnvironment) -> Result Result<(), Error> { + // If we're on a TTY, query the user + if std::io::stdin().is_terminal() { + println!("You are about to update all password hashes that are managed by Proxmox Backup Server!"); + print!("Are you sure you want to continue? (y/N): "); + let _ = std::io::stdout().flush(); + use std::io::{BufRead, BufReader}; + let mut line = String::new(); + match BufReader::new(std::io::stdin()).read_line(&mut line) { + Ok(_) => match line.trim() { + "y" | "Y" => (), // continue + _ => bail!("Aborting."), + }, + Err(err) => bail!("Failed to read line - {err}."), + } + } + + proxmox_backup::auth_helpers::upgrade_password_hashes()?; + + Ok(()) +} + #[api( input: { properties: { @@ -194,6 +222,10 @@ fn list_user_tfa(param: Value, rpcenv: &mut dyn RpcEnvironment) -> Result CommandLineInterface { let cmd_def = CliCommandMap::new() .insert("list", CliCommand::new(&API_METHOD_LIST_USERS)) + .insert( + "update-hashes", + CliCommand::new(&API_METHOD_UPDATE_PASSWORD_HASHES), + ) .insert( "create", // fixme: howto handle password parameter? -- 2.39.2