Documentation
¶
Index ¶
Constants ¶
const MaxUsernameLength = 32
MaxUsernameLength is the default maximum username length
const MinJWTSecretLength = 32
MinJWTSecretLength is the minimum required length for JWT secrets (32 bytes = 256 bits)
Variables ¶
This section is empty.
Functions ¶
func ValidUsername ¶
ValidUsername checks if a username is valid using strict allowlist validation - Not empty - Not too long (maxLen, default 32) - Matches strict allowlist: only letters, numbers, underscore, hyphen - Blocks shell metacharacters: ; & | ( ) $ ` < > etc.
SECURITY: This strict validation prevents command injection attacks when usernames are passed to any of the shell scripts in the codebase.
func ValidUsernameDefault ¶
ValidUsernameDefault checks username with default max length
Types ¶
type AuthRequest ¶
type AuthRequest = authproto.AuthRequest
AuthRequest is an alias to shared authproto.AuthRequest
type AuthResponse ¶
type AuthResponse = authproto.AuthResponse
AuthResponse is an alias to shared authproto.AuthResponse
type Claims ¶
type Claims struct {
Username string `json:"username"`
Groups []string `json:"groups"`
jwt.RegisteredClaims
}
Claims represents JWT claims
func (*Claims) CanModify ¶
CanModify checks if the user can modify firewall rules (ban/unban/whitelist)
func (*Claims) CanViewLogs ¶
CanViewLogs checks if the user can view log files
func (*Claims) HasAllGroups ¶
HasAllGroups checks if the user belongs to all of the specified groups
func (*Claims) HasAnyGroup ¶
HasAnyGroup checks if the user belongs to any of the specified groups
func (*Claims) IsAdmin ¶
IsAdmin checks if the user has admin privileges (root, wheel, sudo, or nftban-admin)
func (*Claims) IsOperator ¶
IsOperator checks if the user has operator privileges (can view/search but not modify)
type PAMAuth ¶
type PAMAuth struct {
// contains filtered or unexported fields
}
PAMAuth handles PAM-based authentication
func NewPAMAuth ¶
NewPAMAuth creates a new PAM authentication handler Returns error if JWT secret is too short (security requirement)
func (*PAMAuth) Authenticate ¶
Authenticate validates user credentials via Unix socket to auth service
func (*PAMAuth) GenerateToken ¶
GenerateToken creates a JWT token for authenticated user
Source Files