Documentation
¶
Overview ¶
Package auth issues and validates panel credentials.
Index ¶
- Variables
- func CheckPassword(hash, plain string) bool
- func CheckTOTP(secret, code string) bool
- func HashPassword(plain string) (string, error)
- func HashToken(token string) string
- func MatchRecoveryCode(digests []string, code string) int
- func NewNodeToken() (token, digest, preview string, err error)
- func NewRecoveryCodes() (plain []string, digests []string, err error)
- func NewTOTPSecret() (string, error)
- func RandomSecret(n int) string
- func TOTPCode(secret string, at time.Time) (string, error)
- func TOTPStep(at time.Time) int64
- func TOTPURI(issuer, account, secret string) string
- func TokenMatches(digest, token string) bool
- type Claims
- type Issuer
- type Throttle
Constants ¶
This section is empty.
Variables ¶
var ErrInvalidToken = errors.New("invalid token")
Functions ¶
func CheckPassword ¶
func CheckTOTP ¶ added in v0.7.0
CheckTOTP reports whether code is valid for secret right now. The comparison is constant-time: a code is a six digit secret, and an early return would leak how much of it was right.
func HashPassword ¶
HashPassword uses bcrypt, which keeps verification slow enough to make an offline attack on a leaked dump expensive.
func HashToken ¶
HashToken digests a node token. Node tokens are high-entropy random strings, so a plain SHA-256 is enough and keeps agent handshakes cheap.
func MatchRecoveryCode ¶ added in v0.7.0
MatchRecoveryCode returns the index of the digest the code belongs to, or -1. Every digest is compared so a wrong code costs the same as a right one.
func NewNodeToken ¶
NewNodeToken returns a fresh enrolment secret together with the digest stored in the database and a preview safe to show in the UI.
func NewRecoveryCodes ¶ added in v0.7.0
NewRecoveryCodes returns the codes to show the operator and the digests to store. Grouping into two blocks of four makes them transcribable without making them meaningfully shorter.
func NewTOTPSecret ¶ added in v0.7.0
NewTOTPSecret returns a base32 secret in the form authenticator apps expect. Twenty bytes matches the HMAC-SHA1 block the algorithm keys with, so nothing is truncated or stretched.
func RandomSecret ¶
RandomSecret returns a URL-safe random string of the given byte length.
func TOTPCode ¶ added in v0.7.0
TOTPCode computes the code for one moment. Exported so the tests can prove the implementation against the RFC's published vectors rather than against itself.
func TOTPStep ¶ added in v0.7.0
TOTPStep identifies the time step a code belongs to. Storing the last accepted step is what stops the same code being replayed inside its 30 second window — without it, a code shoulder-surfed or caught in a proxy log is reusable until it expires.
func TOTPURI ¶ added in v0.7.0
TOTPURI builds the otpauth:// URI that a QR code encodes. The issuer appears twice by convention — once in the label and once as a parameter — because different apps read one or the other.
func TokenMatches ¶
Types ¶
type Throttle ¶ added in v0.7.0
type Throttle struct {
// Threshold is the number of failures a key may accumulate before it locks.
Threshold int
// Window is how long failures are remembered. Failures further apart than
// this never add up, so an occasional typo never locks anyone out.
Window time.Duration
// Base is the first lockout. Each further failure while locked doubles it,
// up to Max — a person who mistyped waits seconds, a script waits longer
// with every attempt.
Base time.Duration
Max time.Duration
// contains filtered or unexported fields
}
Throttle slows down guessing at the sign-in form.
It counts failures against two keys — the username tried and the address it came from — and locks whichever crosses the threshold. Both are needed: counting only usernames lets one attacker work through a list unimpeded, and counting only addresses lets a botnet spread the same guess across thousands of hosts. Either key locking is enough to refuse the attempt.
State is in memory. That is the right trade for a single panel process: it costs no write per failed guess, and the only way to clear it is to restart the panel, which an attacker on the outside cannot do. An operator running several panel replicas behind a balancer gets per-replica counting, which is weaker but never wrong.
func NewThrottle ¶ added in v0.7.0
func NewThrottle() *Throttle
func (*Throttle) Fail ¶ added in v0.7.0
Fail records a failed attempt against every key and returns the lockout it caused, or zero if the threshold has not been reached yet.
Source Files