mirror of
https://github.com/NuSkooler/enigma-bbs.git
synced 2025-07-31 15:06:15 +02:00
Sync up with 0.0.10-alpha
This commit is contained in:
Bryan Ashby
commit
0bfeca090d
97 changed files with 4568 additions and 786 deletions
|
|
@ -3,13 +3,13 @@
|
|||
- [Install script]({{ site.baseurl }}{% link installation/install-script.md %})
|
||||
- [Docker]({{ site.baseurl }}{% link installation/docker.md %})
|
||||
- [Manual installation]({{ site.baseurl }}{% link installation/manual.md %})
|
||||
- [OS / Hardware Specific]({{ site.baseurl }}{% link installation/os-hardware.md %})
|
||||
- [Raspberry Pi]({{ site.baseurl }}{% link installation/rpi.md %})
|
||||
- [Windows]({{ site.baseurl }}{% link installation/windows.md %})
|
||||
- [OS / Hardware Specific]({{ site.baseurl }}{% link installation/os-hardware.md %})
|
||||
- [Raspberry Pi]({{ site.baseurl }}{% link installation/rpi.md %})
|
||||
- [Windows]({{ site.baseurl }}{% link installation/windows.md %})
|
||||
- [Your Network Setup]({{ site.baseurl }}{% link installation/network.md %})
|
||||
- [Testing Your Installation]({{ site.baseurl }}{% link installation/testing.md %})
|
||||
- [Production Installation]({{ site.baseurl }}{% link installation/production.md %})
|
||||
|
||||
|
||||
- Configuration
|
||||
- [Creating Config Files]({{ site.baseurl }}{% link configuration/creating-config.md %})
|
||||
- [SysOp Setup]({{ site.baseurl }}{% link configuration/sysop-setup.md %})
|
||||
|
|
@ -24,6 +24,7 @@
|
|||
- [Colour Codes]({{ site.baseurl }}{% link configuration/colour-codes.md %})
|
||||
- [Access Condition System (ACS)]({{ site.baseurl }}{% link configuration/acs.md %})
|
||||
- [Event Scheduler]({{ site.baseurl }}{% link configuration/event-scheduler.md %})
|
||||
- [Security]({{ site.baseurl }}{% link configuration/security.md %})
|
||||
|
||||
- File Base
|
||||
- [About]({{ site.baseurl }}{% link filebase/index.md %})
|
||||
|
|
@ -34,13 +35,13 @@
|
|||
- [TIC Support]({{ site.baseurl }}{% link filebase/tic-support.md %}) (Importing from FTN networks)
|
||||
- Tips and tricks
|
||||
- [Network mounts and symlinks]({{ site.baseurl }}{% link filebase/network-mounts-and-symlinks.md %})
|
||||
|
||||
|
||||
- Message Areas
|
||||
- [Configuring a Message Area]({{ site.baseurl }}{% link messageareas/configuring-a-message-area.md %})
|
||||
- [Message networks]({{ site.baseurl }}{% link messageareas/message-networks.md %})
|
||||
- [BSO Import & Export]({{ site.baseurl }}{% link messageareas/bso-import-export.md %})
|
||||
- [Netmail]({{ site.baseurl }}{% link messageareas/netmail.md %})
|
||||
|
||||
- [Netmail]({{ site.baseurl }}{% link messageareas/netmail.md %})
|
||||
|
||||
- Art
|
||||
- [General]({{ site.baseurl }}{% link art/general.md %})
|
||||
- [Themes]({{ site.baseurl }}{% link art/themes.md %})
|
||||
|
|
@ -56,10 +57,10 @@
|
|||
- [Web]({{ site.baseurl }}{% link servers/web-server.md %})
|
||||
- [Gopher]({{ site.baseurl }}{% link servers/gopher.md %})
|
||||
- [NNTP]({{ site.baseurl }}{% link servers/nntp.md %})
|
||||
|
||||
|
||||
- Modding
|
||||
- [Local Doors]({{ site.baseurl }}{% link modding/local-doors.md %})
|
||||
- [Door Servers]({{ site.baseurl }}{% link modding/door-servers.md %})
|
||||
- [Door Servers]({{ site.baseurl }}{% link modding/door-servers.md %})
|
||||
- DoorParty
|
||||
- BBSLink
|
||||
- Combatnet
|
||||
|
|
@ -81,6 +82,8 @@
|
|||
- [Set Newscan Date]({{ site.baseurl }}{% link modding/set-newscan-date.md %})
|
||||
- [Node to Node Messaging]({{ site.baseurl }}{% link modding/node-msg.md %})
|
||||
- [Top X]({{ site.baseurl }}{% link modding/top-x.md %})
|
||||
- [2FA/OTP Config]({{ site.baseurl }}{% link modding/user-2fa-otp-config.md %})
|
||||
- [Auto Signature Editor]({{ site.baseurl }}{% link modding/autosig-edit.md %})
|
||||
|
||||
- Administration
|
||||
- [oputil]({{ site.baseurl }}{% link admin/oputil.md %})
|
||||
|
|
|
|||
|
|
@ -9,17 +9,18 @@ Let's look the main help output as per this writing:
|
|||
|
||||
```
|
||||
usage: oputil.js [--version] [--help]
|
||||
<command> [<args>]
|
||||
<command> [<arguments>]
|
||||
|
||||
global args:
|
||||
-c, --config PATH specify config path (./config/)
|
||||
-n, --no-prompt assume defaults/don't prompt for input where possible
|
||||
Global arguments:
|
||||
-c, --config PATH Specify config path (default is ./config/)
|
||||
-n, --no-prompt Assume defaults (don't prompt for input where possible)
|
||||
--verbose Verbose output, where applicable
|
||||
|
||||
commands:
|
||||
user user utilities
|
||||
config config file management
|
||||
fb file base management
|
||||
mb message base management
|
||||
Commands:
|
||||
user User management
|
||||
config Configuration management
|
||||
fb File base management
|
||||
mb Message base management
|
||||
```
|
||||
|
||||
Commands break up operations by groups:
|
||||
|
|
@ -41,19 +42,55 @@ Type `./oputil.js <command> --help` for additional help on a particular command.
|
|||
The `user` command covers various user operations.
|
||||
|
||||
```
|
||||
usage: oputil.js user <action> [<args>]
|
||||
usage: oputil.js user <action> [<arguments>]
|
||||
|
||||
actions:
|
||||
info USERNAME display information about a user
|
||||
pw USERNAME PASSWORD set a user's password
|
||||
aliases: password, passwd
|
||||
rm USERNAME permanently removes user from system
|
||||
aliases: remove, delete, del
|
||||
activate USERNAME set status to active
|
||||
deactivate USERNAME set status to inactive
|
||||
disable USERNAME set status to disabled
|
||||
lock USERNAME set status to locked
|
||||
group USERNAME [+|-]GROUP adds (+) or removes (-) user from a group
|
||||
Actions:
|
||||
info USERNAME Display information about a user
|
||||
|
||||
pw USERNAME PASSWORD Set a user's password
|
||||
(passwd|password)
|
||||
|
||||
rm USERNAME Permanently removes user from system
|
||||
(del|delete|remove)
|
||||
|
||||
rename USERNAME NEWNAME Rename a user
|
||||
(mv)
|
||||
|
||||
2fa-otp USERNAME SPEC Enable 2FA/OTP for the user
|
||||
(otp)
|
||||
|
||||
The system supports various implementations of Two Factor Authentication (2FA)
|
||||
One Time Password (OTP) authentication.
|
||||
|
||||
Valid specs:
|
||||
disable : Removes 2FA/OTP from the user
|
||||
google : Google Authenticator
|
||||
hotp : HMAC-Based One-Time Password Algorithm (RFC-4266)
|
||||
totp : Time-Based One-Time Password Algorithm (RFC-6238)
|
||||
|
||||
activate USERNAME Set a user's status to "active"
|
||||
|
||||
deactivate USERNAME Set a user's status to "inactive"
|
||||
|
||||
disable USERNAME Set a user's status to "disabled"
|
||||
|
||||
lock USERNAME Set a user's status to "locked"
|
||||
|
||||
group USERNAME [+|-]GROUP Adds (+) or removes (-) user from a group
|
||||
|
||||
info arguments:
|
||||
--security Include security information in output
|
||||
|
||||
2fa-otp arguments:
|
||||
--qr-type TYPE Specify QR code type
|
||||
|
||||
Valid QR types:
|
||||
ascii : Plain ASCII (default)
|
||||
data : HTML data URL
|
||||
img : HTML image tag
|
||||
svg : SVG image
|
||||
|
||||
--out PATH Path to write QR code to. defaults to stdout
|
||||
```
|
||||
|
||||
| Action | Description | Examples | Aliases |
|
||||
|
|
@ -61,25 +98,31 @@ actions:
|
|||
| `info` | Display user information| `./oputil.js user info joeuser` | N/A |
|
||||
| `pw` | Set password | `./oputil.js user pw joeuser s3cr37` | `passwd`, `password` |
|
||||
| `rm` | Removes user | `./oputil.js user del joeuser` | `remove`, `del`, `delete` |
|
||||
| `rename` | Renames a user | `./oputil.js user rename joeuser joe` | `mv` |
|
||||
| `2fa-otp` | Manage 2FA/OTP for a user | `./oputil.js user 2fa-otp joeuser googleAuth` | `otp`
|
||||
| `activate` | Activates user | `./oputil.js user activate joeuser` | N/A |
|
||||
| `deactivate` | Deactivates user | `./oputil.js user deactivate joeuser` | N/A |
|
||||
| `disable` | Disables user (user will not be able to login) | `./oputil.js user disable joeuser` | N/A |
|
||||
| `lock` | Locks the user account (prevents logins) | `./oputil.js user lock joeuser` | N/A |
|
||||
| `group` | Modifies users group membership | Add to group: `./oputil.js user group joeuser +derp`<br/>Remove from group: `./oputil.js user group joeuser -derp` | N/A |
|
||||
|
||||
#### Manage 2FA/OTP
|
||||
While `oputil.js` can be used to manage a user's 2FA/OTP, it is highly recommended to require users to opt-in themselves. See [Security](/docs/configuration/security.md) for details.
|
||||
|
||||
## Configuration
|
||||
The `config` command allows sysops to perform various system configuration and maintenance tasks.
|
||||
|
||||
```
|
||||
usage: oputil.js config <action> [<args>]
|
||||
usage: oputil.js config <action> [<arguments>]
|
||||
|
||||
actions:
|
||||
new generate a new/initial configuration
|
||||
cat cat current configuration to stdout
|
||||
Actions:
|
||||
new Generate a new / default configuration
|
||||
|
||||
cat args:
|
||||
--no-color disable color
|
||||
--no-comments strip any comments
|
||||
cat Write current configuration to stdout
|
||||
|
||||
cat arguments:
|
||||
--no-color Disable color
|
||||
--no-comments Strip any comments
|
||||
```
|
||||
|
||||
| Action | Description | Examples |
|
||||
|
|
@ -91,56 +134,75 @@ cat args:
|
|||
The `fb` command provides a powerful file base management interface.
|
||||
|
||||
```
|
||||
usage: oputil.js fb <action> [<args>]
|
||||
usage: oputil.js fb <action> [<arguments>]
|
||||
|
||||
actions:
|
||||
scan AREA_TAG[@STORAGE_TAG] scan specified area
|
||||
may also contain optional GLOB as last parameter,
|
||||
for example: scan some_area *.zip
|
||||
Actions:
|
||||
scan AREA_TAG[@STORAGE_TAG] Scan specified area
|
||||
|
||||
info CRITERIA display information about areas and/or files
|
||||
matching CRITERIA.
|
||||
May contain optional GLOB as last parameter.
|
||||
Example: ./oputil.js fb scan d0pew4r3z *.zip
|
||||
|
||||
mv SRC [SRC...] DST move entry(s) from SRC to DST
|
||||
SRC: FILENAME_WC|SHA|FILE_ID|AREA_TAG[@STORAGE_TAG]
|
||||
DST: AREA_TAG[@STORAGE_TAG]
|
||||
info CRITERIA Display information about areas and/or files
|
||||
|
||||
rm SRC [SRC...] remove entry(s) from the system matching SRC
|
||||
SRC: FILENAME_WC|SHA|FILE_ID|AREA_TAG[@STORAGE_TAG]
|
||||
desc CRITERIA sets a new file description for file base entry
|
||||
matching CRITERIA. Launches an external editor using
|
||||
$VISUAL, $EDITOR, or vim/notepad.
|
||||
import-areas FILEGATE.ZXX import file base areas using FileGate RAID type format
|
||||
mv SRC [SRC...] DST Move matching entry(s)
|
||||
(move)
|
||||
|
||||
scan args:
|
||||
--tags TAG1,TAG2,... specify tag(s) to assign to discovered entries
|
||||
Source may be any of the following:
|
||||
- Filename including '*' wildcards
|
||||
- SHA-1
|
||||
- File ID
|
||||
- Area tag with optional @storageTag suffix
|
||||
Destination is area tag with optional @storageTag suffix
|
||||
|
||||
--desc-file [PATH] prefer file descriptions from supplied path over other
|
||||
other sources such as FILE_ID.DIZ. Path must point to
|
||||
a valid FILES.BBS or DESCRIPT.ION file.
|
||||
--update attempt to update information for existing entries
|
||||
--quick perform quick scan
|
||||
rm SRC [SRC...] Remove entry(s) from the system
|
||||
(del|delete|remove)
|
||||
|
||||
info args:
|
||||
--show-desc display short description, if any
|
||||
Source may be any of the following:
|
||||
- Filename including '*' wildcards
|
||||
- SHA-1
|
||||
- File ID
|
||||
- Area tag with optional @storageTag suffix
|
||||
|
||||
remove args:
|
||||
--phys-file also remove underlying physical file
|
||||
desc CRITERIA Updates an file base entry's description
|
||||
|
||||
import-areas args:
|
||||
--type TYPE sets import areas type. valid options are "zxx" or "na"
|
||||
--create-dirs create backing storage directories
|
||||
Launches an external editor using $VISUAL, $EDITOR, or vim/notepad.
|
||||
|
||||
general information:
|
||||
AREA_TAG[@STORAGE_TAG] can specify an area tag and optionally, a storage specific tag
|
||||
example: retro@bbs
|
||||
import-areas FILEGATE.ZXX Import file base areas using FileGate RAID type format
|
||||
|
||||
CRITERIA file base entry criteria. in general, can be AREA_TAG, SHA,
|
||||
FILE_ID, or FILENAME_WC.
|
||||
|
||||
FILENAME_WC filename with * and ? wildcard support. may match 0:n entries
|
||||
SHA full or partial SHA-256
|
||||
FILE_ID a file identifier. see file.sqlite3
|
||||
scan arguments:
|
||||
--tags TAG1,TAG2,... Specify hashtag(s) to assign to discovered entries
|
||||
|
||||
--desc-file [PATH] Prefer file descriptions from supplied input file
|
||||
|
||||
If a file description can be found in the supplied input file, prefer that description
|
||||
over other sources such related FILE_ID.DIZ. Path must point to a valid FILES.BBS or
|
||||
DESCRIPT.ION file.
|
||||
|
||||
--update Attempt to update information for existing entries
|
||||
--full Perform a full scan (default is quick)
|
||||
|
||||
info arguments:
|
||||
--show-desc Display short description, if any
|
||||
|
||||
remove arguments:
|
||||
--phys-file Also remove underlying physical file
|
||||
|
||||
import-areas arguments:
|
||||
--type TYPE Sets import areas type
|
||||
|
||||
Valid types are are "zxx" or "na".
|
||||
|
||||
--create-dirs Also create backing storage directories
|
||||
|
||||
General Information:
|
||||
Generally an area tag can also include an optional storage tag. For example, the
|
||||
area of 'bbswarez' stored using 'bbswarez_main': bbswarez@bbswarez_main
|
||||
|
||||
When performing an initial import of a large area or storage backing, --full
|
||||
is the best option. If re-scanning an area for updates a standard / quick scan is
|
||||
generally good enough.
|
||||
|
||||
File ID's are those found in file.sqlite3.
|
||||
```
|
||||
|
||||
#### Scan File Area
|
||||
|
|
@ -149,7 +211,8 @@ The `scan` action can (re)scan a file area for new entries as well as update (`-
|
|||
##### Examples
|
||||
Performing a quick scan of a specific area's storage location ("retro_warez", "retro_warez_games) matching only *.zip extensions:
|
||||
```bash
|
||||
$ ./oputil.js fb scan --quick retro_warez@retro_warez_games *.zip`
|
||||
# note that we must quote the wildcard to prevent shell expansion
|
||||
$ ./oputil.js fb scan --quick retro_warez@retro_warez_games "*.zip"`
|
||||
```
|
||||
|
||||
Update all entries in the "artscene" area supplying the file tags "artscene", and "textmode".
|
||||
|
|
@ -218,19 +281,23 @@ The above command will process FILEGATE.ZXX creating areas and backing directori
|
|||
The `mb` command provides various Message Base related tools:
|
||||
|
||||
```
|
||||
usage: oputil.js mb <action> [<args>]
|
||||
usage: oputil.js mb <action> [<arguments>]
|
||||
|
||||
actions:
|
||||
areafix CMD1 CMD2 ... ADDR sends an AreaFix NetMail to ADDR with the supplied command(s)
|
||||
one or more commands may be supplied. commands that are multi
|
||||
part such as "%COMPRESS ZIP" should be quoted.
|
||||
import-areas PATH import areas using fidonet *.NA or AREAS.BBS file from PATH
|
||||
Actions:
|
||||
areafix CMD1 CMD2 ... ADDR Sends an AreaFix NetMail
|
||||
|
||||
import-areas args:
|
||||
--conf CONF_TAG conference tag in which to import areas
|
||||
--network NETWORK network name/key to associate FTN areas
|
||||
--uplinks UL1,UL2,... one or more comma separated uplinks
|
||||
--type TYPE area import type. valid options are "bbs" and "na"
|
||||
NetMail is sent to supplied address with the supplied command(s). Multi-part commands
|
||||
such as "%COMPRESS ZIP" should be quoted.
|
||||
|
||||
import-areas PATH Import areas using FidoNet *.NA or AREAS.BBS file
|
||||
|
||||
import-areas arguments:
|
||||
--conf CONF_TAG Conference tag in which to import areas
|
||||
--network NETWORK Network name/key to associate FTN areas
|
||||
--uplinks UL1,UL2,... One or more uplinks (comma separated)
|
||||
--type TYPE Area import type
|
||||
|
||||
Valid types are "bbs" and "na"
|
||||
```
|
||||
|
||||
| Action | Description | Examples |
|
||||
|
|
|
|||
|
|
@ -16,8 +16,8 @@ for a full listing. Many codes attempt to pay homage to Oblivion/2, iNiQUiTY, et
|
|||
| Code | Description |
|
||||
|------|--------------|
|
||||
| `BN` | Board Name |
|
||||
| `VL` | Version *label*, e.g. "ENiGMA½ v0.0.9-alpha" |
|
||||
| `VN` | Version *number*, eg.. "0.0.9-alpha" |
|
||||
| `VL` | Version *label*, e.g. "ENiGMA½ v0.0.10-alpha" |
|
||||
| `VN` | Version *number*, eg.. "0.0.10-alpha" |
|
||||
| `SN` | SysOp username |
|
||||
| `SR` | SysOp real name |
|
||||
| `SL` | SysOp location |
|
||||
|
|
|
|||
|
|
@ -37,8 +37,8 @@ The following are ACS codes available as of this writing:
|
|||
| MM<i>minutes</i> | It is currently >= _minutes_ past midnight (system time) |
|
||||
| AC<i>achievementCount</i> | User has >= _achievementCount_ achievements |
|
||||
| AP<i>achievementPoints</i> | User has >= _achievementPoints_ achievement points |
|
||||
|
||||
\* Many more ACS codes are planned for the near future.
|
||||
| AF<i>authFactor</i> | User's current *Authentication Factor* is >= _authFactor_. Authentication factor 1 refers to username + password (or PubKey) while factor 2 refers to 2FA such as One-Time-Password authentication. |
|
||||
| AR<i>authFactorReq</i> | Current user **requires** an Authentication Factor >= _authFactorReq_ |
|
||||
|
||||
## ACS Strings
|
||||
ACS strings are one or more ACS codes in addition to some basic language semantics.
|
||||
|
|
|
|||
|
|
@ -11,9 +11,15 @@ Archivers are manged via the `archives:archivers` configuration block of `config
|
|||
The following archivers are pre-configured in ENiGMA½ as of this writing. Remember that you can override settings or add new handlers!
|
||||
|
||||
#### ZZip
|
||||
* Formats: .7z, .bzip2, .zip, .gzip/.gz, and more
|
||||
* Formats: .7z, .bzip2, .gzip/.gz, and more
|
||||
* Key: `7Zip`
|
||||
* Homepage/package: [7-zip.org](http://www.7-zip.org/). Generally obtained from a `p7zip` package in UNIX-like environments. See http://p7zip.sourceforge.net/ for details.
|
||||
* Notes: Versions previous to 0.0.10-alpha defaulted to using 7zip for .zip files as well, but newer versions of the package give "volume" errors at times. See InfoZip below.
|
||||
|
||||
#### InfoZip
|
||||
* Formats: .zip
|
||||
* Key: InfoZip
|
||||
* Homepage/package: http://infozip.sourceforge.net/. Often already available in Linux. You will need `zip` and `unzip` in ENiGMA's path.
|
||||
|
||||
#### Lha
|
||||
* Formats: <a href="https://en.wikipedia.org/wiki/LHA_(file_format)">LHA</a> files such as .lzh.
|
||||
|
|
|
|||
|
|
@ -74,6 +74,23 @@ Submit actions are declared using the `action` member of a submit handler block.
|
|||
| `@method:methodName` | Executes *methodName* local to the calling module. That is, the module set by the `module` member of a menu entry. |
|
||||
| `@method:/path/to/some_module.js:methodName` | Executes *methodName* exported by the module at */path/to/some_module.js*. |
|
||||
|
||||
#### Advanced Action Handling
|
||||
In addition to simple simple actions, `action` may also be:
|
||||
* An array of objects containing ACS checks and a sub `action` if that ACS is matched. See **Action Matches** in the ACS documentation below for details.
|
||||
* An array of actions. In this case a random selection will be made. Example:
|
||||
```hjson
|
||||
submit: [
|
||||
{
|
||||
value: { command: "FOO" }
|
||||
action: [
|
||||
// one of the following actions will be matched:
|
||||
"@menu:menuStyle1"
|
||||
"@menu:menuStyle2"
|
||||
]
|
||||
}
|
||||
]
|
||||
```
|
||||
|
||||
#### Method Signature
|
||||
Methods executed using `@method`, or `@systemMethod` have the following signature:
|
||||
```
|
||||
|
|
@ -86,6 +103,7 @@ Many built in global/system methods exist. Below are a few. See [system_menu_met
|
|||
| Method | Description |
|
||||
|--------|-------------|
|
||||
| `login` | Performs a standard login. |
|
||||
| `login2FA_OTP` | Performs a 2-Factor Authentication (2FA) One-Time Password (OTP) check, if configured for the user. |
|
||||
| `logoff` | Performs a standard system logoff. |
|
||||
| `prevMenu` | Goes to the previous menu. |
|
||||
| `nextMenu` | Goes to the next menu (as set by `next`) |
|
||||
|
|
@ -179,6 +197,23 @@ opOnlyMenu: {
|
|||
}
|
||||
```
|
||||
|
||||
### Action Matches
|
||||
Action blocks (`action`) can perform ACS checks:
|
||||
```
|
||||
// ...
|
||||
{
|
||||
action: [
|
||||
{
|
||||
acs: SC1
|
||||
action: @menu:secureMenu
|
||||
}
|
||||
{
|
||||
action: @menu:nonSecureMenu
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
### Flow Control
|
||||
The `next` member of a menu may be an array of objects containing an `acs` check as well as the destination. Depending on the current user's ACS, the system will pick the appropriate target. The last element in an array without an `acs` can be used as a catch all. Example:
|
||||
```
|
||||
|
|
|
|||
64
docs/configuration/security.md
Normal file
64
docs/configuration/security.md
Normal file
|
|
@ -0,0 +1,64 @@
|
|||
---
|
||||
layout: page
|
||||
title: Security
|
||||
---
|
||||
## Security
|
||||
Unlike in the golden era of BBSing, modern Internet-connected systems are prone to hacking attempts, eavesdropping, etc. While plain-text passwords, insecure data over [Plain Old Telephone Service (POTS)](https://en.wikipedia.org/wiki/Plain_old_telephone_service), and so on was good enough then, modern systems must employ protections against attacks. ENiGMA½ comes with many security features that help keep the system and your users secure — not limited to:
|
||||
* Passwords are **never** stored in plain-text, but instead are stored using [Password-Based Key Derivation Function 2 (PBKDF2)](https://en.wikipedia.org/wiki/PBKDF2). Even the system operator can _never_ know your password!
|
||||
* Alternatives to insecure Telnet logins are built in: [SSH](https://en.wikipedia.org/wiki/Secure_Shell) and secure [WebSockets](https://en.wikipedia.org/wiki/WebSocket) for example.
|
||||
* A built in web server with [TLS](https://en.wikipedia.org/wiki/Transport_Layer_Security) support (aka HTTPS).
|
||||
* Optional [Two-Factor Authentication (2FA)](https://en.wikipedia.org/wiki/Multi-factor_authentication) via [One-Time-Password (OTP)](https://en.wikipedia.org/wiki/One-time_password) for users, supporting [Google Authenticator](http://google-authenticator.com/), [Time-Based One-Time Password Algorithm (TOTP, RFC-6238)](https://tools.ietf.org/html/rfc6238), and [HMAC-Based One-Time Password Algorithm (HOTP, RFC-4266)](https://tools.ietf.org/html/rfc4226).
|
||||
|
||||
## Two-Factor Authentication via One-Time Password
|
||||
Enabling Two-Factor Authentication via One-Time-Password (2FA/OTP) on an account adds an extra layer of security ("_something a user has_") in addition to their password ("_something a user knows_"). Providing 2FA/OTP to your users has some prerequisites:
|
||||
* [A configured email gateway](/docs/configuration/email.md) such that the system can send out emails.
|
||||
* One or more secure servers enabled such as [SSH](/docs/servers/ssh.md) or secure [WebSockets](/docs/servers/websocket.md) (that is, WebSockets over a secure connection such as TLS).
|
||||
* The [web server](/docs/servers/web-server.md) enabled and exposed over TLS (HTTPS).
|
||||
|
||||
:information_source: For WebSockets and the web server, ENiGMA½ _may_ listen on insecure channels if behind a secure web proxy.
|
||||
|
||||
### User Registration Flow
|
||||
Due to the nature of 2FA/OTP, even if enabled on your system, users must opt-in and enable this feature on their account. Users must also have a valid email address such that a registration link can be sent to them. To opt-in, users must enable the option, which will cause the system to email them a registration link. Following the link provides the following:
|
||||
|
||||
1. A secret for manual entry into a OTP device.
|
||||
2. If applicable, a scannable QR code for easy device entry (e.g. Google Authenticator)
|
||||
3. A confirmation prompt in which the user must enter a OTP code. If entered correctly, this validates everything is set up properly and 2FA/OTP will be enabled for the account. Backup codes will also be provided at this time. Future logins will now prompt the user for their OTP after they enter their standard password.
|
||||
|
||||
:warning: Serving 2FA/OTP registration links over insecure (HTTP) can expose secrets intended for the user and is **highly** discouraged!
|
||||
|
||||
:information_source: +ops can also manually enable or disable 2FA/OTP for a user using [oputil](/docs/admin/oputil.md), but this is generally discouraged.
|
||||
|
||||
#### Recovery
|
||||
In the situation that a user loses their 2FA/OTP device (such as a lost phone with Google Auth), there are some options:
|
||||
* Utilize one of their backup codes.
|
||||
* Contact the SysOp.
|
||||
|
||||
:warning: There is no way for a user to disable 2FA/OTP without first fully logging in! This is by design as a security measure.
|
||||
|
||||
### ACS Checks
|
||||
Various places throughout the system that implement [ACS](/docs/configuration/acs.md) can make 2FA specific checks:
|
||||
* `AR#`: Current users **required** authentication factor. `AR2` for example means 2FA/OTP is required for this user.
|
||||
* `AF#`: Current users **active** authentication factor. `AF2` means the user is authenticated with some sort of 2FA (such as One-Time-Password).
|
||||
|
||||
See [ACS](/docs/configuration/acs.md) for more information.
|
||||
|
||||
#### Example
|
||||
The following example illustrates using an `AR` ACS check to require applicable users to go through an additional 2FA/OTP process during login:
|
||||
|
||||
```hjson
|
||||
login: {
|
||||
art: USERLOG
|
||||
next: [
|
||||
{
|
||||
// users with AR2+ must first pass 2FA/OTP
|
||||
acs: AR2
|
||||
next: loginTwoFactorAuthOTP
|
||||
}
|
||||
{
|
||||
// everyone else skips ahead
|
||||
next: fullLoginSequenceLoginArt
|
||||
}
|
||||
]
|
||||
// ...
|
||||
}
|
||||
```
|
||||
|
|
@ -6,10 +6,10 @@ title: Install Script
|
|||
Under most Linux/UNIX like environments (Linux, BSD, OS X, ...) new users can simply execute the `install.sh` script to get everything up and running. Cut + paste the following into your terminal:
|
||||
|
||||
```
|
||||
curl -o- https://raw.githubusercontent.com/NuSkooler/enigma-bbs/master/misc/install.sh | bash
|
||||
curl -o- https://raw.githubusercontent.com/NuSkooler/enigma-bbs/0.0.10-alpha/misc/install.sh | bash
|
||||
```
|
||||
|
||||
You may review the [installation script](https://raw.githubusercontent.com/NuSkooler/enigma-bbs/master/misc/install.sh)
|
||||
You may review the [installation script](https://raw.githubusercontent.com/NuSkooler/enigma-bbs/0.0.10-alpha/misc/install.sh)
|
||||
on GitHub before running it.
|
||||
|
||||
The script will install nvm, Node.js 6 and grab the latest ENiGMA BBS from GitHub. It will also guide you through creating a basic configuration file, and recommend some packages to install.
|
||||
|
|
|
|||
|
|
@ -21,7 +21,8 @@ Each conference is represented by a entry under `messageConferences`. Each entri
|
|||
|
||||
### ACS
|
||||
An optional standard [ACS](/docs/configuration/acs.md) block can be supplied with the following rules:
|
||||
* `read`: ACS require to read (see) this conference. Defaults to `GM[users]`.
|
||||
* `read`: ACS required to read (see) this conference. Defaults to `GM[users]`.
|
||||
* `write`: ACS required to write (post) to this conference. Defaults to `GM[users]`.
|
||||
|
||||
### Example
|
||||
|
||||
|
|
@ -51,10 +52,12 @@ Message Areas are topic specific containers for messages that live within a part
|
|||
| `sort` | :-1: | Set to a number to override the default alpha-numeric sort order based on the `name` field. |
|
||||
| `default` | :-1: | Specify `true` to make this the default area (e.g. assigned to new users) |
|
||||
| `acs` | :-1: | A standard [ACS](/docs/configuration/acs.md) block. See **ACS** below. |
|
||||
| `autoSignatures` | :-1: | Set to `false` to disable auto-signatures in this area. |
|
||||
|
||||
### ACS
|
||||
An optional standard [ACS](/docs/configuration/acs.md) block can be supplied with the following rules:
|
||||
* `read`: ACS require to read (see) this conference. Defaults to `GM[users]`.
|
||||
* `read`: ACS required to read (see) this area. Defaults to `GM[users]`.
|
||||
* `write`: ACS required to write (post) to this area. Defaults to `GM[users]`.
|
||||
|
||||
### Example
|
||||
|
||||
|
|
@ -63,13 +66,14 @@ messageConferences: {
|
|||
local: {
|
||||
// ... see above ...
|
||||
areas: {
|
||||
enigma_dev: { // Area tag - required elsewhere!
|
||||
name: ENiGMA 1/2 Development
|
||||
desc: ENiGMA 1/2 discussion!
|
||||
sort: 1
|
||||
enigma_dev: { // Area tag - required elsewhere!
|
||||
name: ENiGMA 1/2 Development
|
||||
desc: ENiGMA 1/2 development and discussion!
|
||||
sort: 1
|
||||
default: true
|
||||
acs: {
|
||||
read: GM[users] // default
|
||||
write: GM[l33t] // super elite ENiGMA 1/2 users!
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
22
docs/modding/autosig-edit.md
Normal file
22
docs/modding/autosig-edit.md
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
---
|
||||
layout: page
|
||||
title: Auto Signature Editor
|
||||
---
|
||||
## The Auto Signature Editor
|
||||
The built in `autosig_edit` module allows users to edit their auto signatures (AKA "autosig").
|
||||
|
||||
### Theming
|
||||
The following MCI codes are available:
|
||||
* MCI 1 (ie: `MT1`): Editor
|
||||
* MCI 2 (ie: `BT2`): Save button
|
||||
|
||||
### Disabling Auto Signatures
|
||||
Auto Signature support can be disabled for a particular message area by setting `autoSignatures` to false in the area's configuration block.
|
||||
|
||||
Example:
|
||||
```hjson
|
||||
my_area: {
|
||||
name: My Area
|
||||
autoSignatures: false
|
||||
}
|
||||
```
|
||||
|
|
@ -48,7 +48,7 @@ mciMap: {
|
|||
}
|
||||
```
|
||||
|
||||
### Theming
|
||||
## Theming
|
||||
Generally `mciMap` entries will point to a Vertical List View Menu (`%VM1`, `%VM2`, etc.). The following `itemFormat` object is provided:
|
||||
* `value`: The value acquired from the supplied data source.
|
||||
* `userName`: User's username.
|
||||
|
|
|
|||
73
docs/modding/user-2fa-otp-config.md
Normal file
73
docs/modding/user-2fa-otp-config.md
Normal file
|
|
@ -0,0 +1,73 @@
|
|||
---
|
||||
layout: page
|
||||
title: TopX
|
||||
---
|
||||
## The 2FA/OTP Config Module
|
||||
The `user_2fa_otp_config` module provides opt-in, configuration, and viewing of Two-Factor Authentication via One-Time-Password (2FA/OTP) settings. In order to allow users access to 2FA/OTP, the system must be properly configured. See [Security](/docs/configuration/security.md) for more information.
|
||||
|
||||
:information_source: By default, the 2FA/OTP configuration menu may only be accessed by users connected securely (ACS `SC`). It is highly recommended to leave this default as accessing these settings over a plain-text connection could expose private secrets!
|
||||
|
||||
## Configuration
|
||||
|
||||
### Config Block
|
||||
Available `config` block entries:
|
||||
* `infoText`: Overrides default informational text string(s). See **Info Text** below.
|
||||
* `statusText:` Overrides default status text string(s). See **Status Text** below.
|
||||
|
||||
Example:
|
||||
```hjson
|
||||
config: {
|
||||
infoText: {
|
||||
googleAuth: Google Authenticator available on mobile phones, etc.
|
||||
}
|
||||
statusText: {
|
||||
saveError: Doh! Failed to save :(
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
#### Info Text (infoText)
|
||||
Overrides default informational text relative to current selections. Available keys:
|
||||
* `disabled`: Displayed when OTP switched to enabled.
|
||||
* `enabled`: Displayed when OTP switched to disabled.
|
||||
* `rfc6238_TOTP`: Describes TOTP.
|
||||
* `rfc4266_HOTP`: Describes HOTP.
|
||||
* `googleAuth`: Describes Google Authenticator OTP.
|
||||
|
||||
#### Status Text (statusText)
|
||||
Overrides default status text for various conditions. Available keys:
|
||||
* `otpNotEnabled`
|
||||
* `noBackupCodes`
|
||||
* `saveDisabled`
|
||||
* `saveEmailSent`
|
||||
* `saveError`
|
||||
* `qrNotAvail`
|
||||
* `emailRequired`
|
||||
|
||||
## Theming
|
||||
The following MCI codes are available:
|
||||
* MCI 1: (ie: `TM1`): Toggle 2FA/OTP enabled/disabled.
|
||||
* MCI 2: (ie: `SM2`): 2FA/OTP type selection.
|
||||
* MCI 3: (ie: `TM3`): Submit/cancel toggle.
|
||||
* MCI 10...99: Custom entries with the following format members available:
|
||||
* `{infoText}`: **Info Text** for current selection.
|
||||
|
||||
### Web and Email Templates
|
||||
A template system is also available to customize registration emails and the landing page.
|
||||
|
||||
#### Emails
|
||||
Multipart MIME emails are send built using template files pointed to by `users.twoFactorAuth.otp.registerEmailText` and `users.toFactorAuth.otp.registerEmailHtml` supporting the following variables:
|
||||
* `%BOARDNAME%`: BBS name.
|
||||
* `%USERNAME%`: Username receiving email.
|
||||
* `%TOKEN%`: Temporary registration token generally used in URL.
|
||||
* `%REGISTER_URL%`: Full registration URL.
|
||||
|
||||
#### Landing Page
|
||||
The landing page template is pointed to by `users.twoFactorAuth.otp.registerPageTemplate` and supports the following variables:
|
||||
* `%BOARDNAME%`: BBS name.
|
||||
* `%USERNAME%`: Username receiving email.
|
||||
* `%TOKEN%`: Temporary registration token generally used in URL.
|
||||
* `%OTP_TYPE%`: OTP type such as `googleAuth`.
|
||||
* `%POST_URL%`: URL to POST form to.
|
||||
* `%QR_IMG_DATA%`: QR code in URL image data format. Not always available depending on OTP type and will be set to blank in these cases.
|
||||
* `%SECRET%`: Secret for manual entry.
|
||||
Loading…
Add table
Add a link
Reference in a new issue