@@ -111,13 +112,18 @@ function do_login() {
// This API call always succeeds. It returns a JSON object indicating
// whether the request was authenticated or not.
if (response.status != 'ok') {
- if (response.status === 'missing_token' && !$('#loginForm').hasClass('is-twofactor')) {
+ if (response.status === 'missing-totp-token' || (response.status === 'invalid' && response.reason == 'invalid-totp-token')) {
$('#loginForm').addClass('is-twofactor');
- setTimeout(() => {
- $('#loginOtpInput').focus();
- });
+ if (response.reason === "invalid-totp-token") {
+ show_modal_error("Login Failed", "Incorrect two factor authentication token.");
+ } else {
+ setTimeout(() => {
+ $('#loginOtpInput').focus();
+ });
+ }
} else {
$('#loginForm').removeClass('is-twofactor');
+
// Show why the login failed.
show_modal_error("Login Failed", response.reason)
diff --git a/management/templates/two-factor-auth.html b/management/templates/mfa.html
similarity index 60%
rename from management/templates/two-factor-auth.html
rename to management/templates/mfa.html
index 8108c21..32b7f6c 100644
--- a/management/templates/two-factor-auth.html
+++ b/management/templates/mfa.html
@@ -33,38 +33,65 @@
When two-factor authentication is enabled, you will be prompted to enter a six digit code from an
+authenticator app (usually on your phone) when you log into this control panel.
+
+Enabling two-factor authentication does not protect access to your email
+
+
+Enabling two-factor authentication on this page only limits access to this control panel. Remember that most websites allow you to
+reset your password by checking your email, so anyone with access to your email can typically take over
+your other accounts. Additionally, if your email address or any alias that forwards to your email
+address is a typical domain control validation address (e.g admin@, administrator@, postmaster@, hostmaster@,
+webmaster@, abuse@), extra care should be taken to protect the account. Always use a strong password,
+and ensure every administrator account for this control panel does the same.
+
+
Loading...
@@ -80,6 +107,7 @@
totpSetupForm: document.getElementById('totp-setup'),
totpSetupToken: document.getElementById('totp-setup-token'),
totpSetupSecret: document.getElementById('totp-setup-secret'),
+ totpSetupLabel: document.getElementById('totp-setup-label'),
totpQr: document.getElementById('totp-setup-qr'),
totpSetupSubmit: document.querySelector('#totp-setup-submit'),
wrapper: document.querySelector('.twofactor')
@@ -101,30 +129,29 @@
}
}
- function render_totp_setup(res) {
- function render_qr_code(encoded) {
- var img = document.createElement('img');
- img.src = encoded;
+ function render_totp_setup(provisioned_totp) {
+ var img = document.createElement('img');
+ img.src = "data:image/png;base64," + provisioned_totp.qr_code_base64;
- var code = document.createElement('div');
- code.innerHTML = `Secret: ${res.totp_secret}`;
+ var code = document.createElement('div');
+ code.innerHTML = `Secret: ${provisioned_totp.secret}`;
- el.totpQr.appendChild(img);
- el.totpQr.appendChild(code);
- }
+ el.totpQr.appendChild(img);
+ el.totpQr.appendChild(code);
el.totpSetupToken.addEventListener('input', update_setup_disabled);
el.totpSetupForm.addEventListener('submit', do_enable_totp);
- el.totpSetupSecret.setAttribute('value', res.totp_secret);
- render_qr_code(res.totp_qr);
+ el.totpSetupSecret.setAttribute('value', provisioned_totp.secret);
el.wrapper.classList.add('disabled');
}
- function render_disable() {
+ function render_disable(mfa) {
el.disableForm.addEventListener('submit', do_disable);
el.wrapper.classList.add('enabled');
+ if (mfa.label)
+ $("#mfa-device-label").text(" on device '" + mfa.label + "'");
}
function hide_error() {
@@ -154,7 +181,7 @@
el.totpQr.innerHTML = '';
}
- function show_two_factor_auth() {
+ function show_mfa() {
reset_view();
api(
@@ -163,8 +190,17 @@
{},
function(res) {
el.wrapper.classList.add('loaded');
- var isTotpEnabled = res.type === 'totp'
- return isTotpEnabled ? render_disable(res) : render_totp_setup(res);
+
+ var has_mfa = false;
+ res.enabled_mfa.forEach(function(mfa) {
+ if (mfa.type == "totp") {
+ render_disable(mfa);
+ has_mfa = true;
+ }
+ });
+
+ if (!has_mfa)
+ render_totp_setup(res.new_mfa.totp);
}
);
}
@@ -174,9 +210,9 @@
hide_error();
api(
- '/mfa/totp/disable',
+ '/mfa/disable',
'POST',
- {},
+ { type: 'totp' },
function() {
do_logout();
}
@@ -194,7 +230,8 @@
'POST',
{
token: $(el.totpSetupToken).val(),
- secret: $(el.totpSetupSecret).val()
+ secret: $(el.totpSetupSecret).val(),
+ label: $(el.totpSetupLabel).val()
},
function(res) {
do_logout();
diff --git a/setup/mail-users.sh b/setup/mail-users.sh
index 9fcdf79..b2625a3 100755
--- a/setup/mail-users.sh
+++ b/setup/mail-users.sh
@@ -22,7 +22,7 @@ if [ ! -f $db_path ]; then
echo Creating new user database: $db_path;
echo "CREATE TABLE users (id INTEGER PRIMARY KEY AUTOINCREMENT, email TEXT NOT NULL UNIQUE, password TEXT NOT NULL, extra, privileges TEXT NOT NULL DEFAULT '');" | sqlite3 $db_path;
echo "CREATE TABLE aliases (id INTEGER PRIMARY KEY AUTOINCREMENT, source TEXT NOT NULL UNIQUE, destination TEXT NOT NULL, permitted_senders TEXT);" | sqlite3 $db_path;
- echo "CREATE TABLE IF NOT EXISTS mfa (id INTEGER PRIMARY KEY AUTOINCREMENT, user_id INTEGER NOT NULL UNIQUE, type TEXT NOT NULL, secret TEXT NOT NULL, mru_token TEXT, FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE);" | sqlite3 $db_path;
+ echo "CREATE TABLE mfa (id INTEGER PRIMARY KEY AUTOINCREMENT, user_id INTEGER NOT NULL UNIQUE, type TEXT NOT NULL, secret TEXT NOT NULL, mru_token TEXT, label TEXT, FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE);" | sqlite3 $db_path;
fi
# ### User Authentication
diff --git a/setup/migrate.py b/setup/migrate.py
index 5b6e398..e4a253d 100755
--- a/setup/migrate.py
+++ b/setup/migrate.py
@@ -184,7 +184,7 @@ def migration_12(env):
def migration_13(env):
# Add the "mfa" table for configuring MFA for login to the control panel.
db = os.path.join(env["STORAGE_ROOT"], 'mail/users.sqlite')
- shell("check_call", ["sqlite3", db, "CREATE TABLE IF NOT EXISTS mfa (id INTEGER PRIMARY KEY AUTOINCREMENT, user_id INTEGER NOT NULL UNIQUE, type TEXT NOT NULL, secret TEXT NOT NULL, mru_token TEXT, FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE);"])
+ shell("check_call", ["sqlite3", db, "CREATE TABLE mfa (id INTEGER PRIMARY KEY AUTOINCREMENT, user_id INTEGER NOT NULL UNIQUE, type TEXT NOT NULL, secret TEXT NOT NULL, mru_token TEXT, label TEXT, FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE);"])
###########################################################