rcmd/keeporg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Keep server data in an encrypted database, and harden every part

Browse Source 
Storage. The server keeps its data in SQLite (a file in the data
directory, the default) or PostgreSQL (database, KEEPORG_DATABASE_URL or
-database). Every row, the KDBX versions included, is sealed with
AES-256-GCM under a key derived from the master key and named by an HMAC.
The master key is required to start and a different one is refused. A data
directory from 0.10 or earlier is imported on first start. Several servers
may share one PostgreSQL database. Go goes to 1.26 for the pure-Go
drivers (modernc.org/sqlite, jackc/pgx).

Hardening, after an audit of the server, both clients and the deployment:
- Single sign-on approves a device only after an explicit Approve in the
  browser that started it, bound by a cookie and PKCE; identities are never
  linked by username, by verified email only when allowed, never to admins.
- Sign-in attempts are limited per address and per account, passwords are
  checked outside the store lock with uniform timing, one-time codes work
  once, and starting two-factor needs the password.
- Merge vaults bound KDF parameters, payload size and XML shape, check
  pushes before storing them, and run at most two merges at once. A version
  is written in the same transaction as its metadata.
- Tokens in URLs only on the event stream, which ends on revocation; CSP,
  frame-ancestors, no-store and HSTS; sign-in CSRF; 404 for databases
  without access; new trusted_proxies.
- Clients open only the server's approval page, keep case-variant and
  retired file names apart, never overwrite a save made during a pull,
  require https except locally, send the stream token in a header, bound
  their reads and escape notifications and terminal output.
- The .deb creates the master key, systemd is sandboxed further, nginx sets
  modern TLS and HSTS, and CI deploys from main only.

Server 0.12.0, desktop 0.6.0, Android 0.4.0 (versionCode 4).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Reactorcoremeltdown
2026-11-02 15:38:32 +01:00
co-authored by Claude Opus 5.5
parent f8f634fbf7
commit 4ffc434b1b
77 changed files with 4192 additions and 776 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/server/webaccount.go
+55 -21
View File
@@ -32,6 +32,9 @@ type webAccount struct {
TOTPKey string
TOTPLink template.URL
Sessions []webSessionRow
// SSOLink starts linking single sign-on to this account, when the
// server has a provider and the account is not linked yet.
SSOLink string
}
type webMembership struct {
@@ -61,6 +64,9 @@ func (s *Server) accountView(sess *webSession) webAccount {
Since: u.CreatedAt.UTC().Format("2006-01-02"),
HasPassword: u.PassHash != "", TOTPOn: u.TOTPConfirmed,
}
if s.oidc != nil && u.OIDCSubject == "" && !u.Disabled {
v.SSOLink = "/oidc/login?link=1&csrf=" + url.QueryEscape(sess.csrf)
}
if u.OIDCIssuer != "" {
v.SSO = u.OIDCIssuer
if iss, err := url.Parse(u.OIDCIssuer); err == nil && iss.Host != "" {
@@ -134,6 +140,14 @@ func (s *Server) handleWebAccount(w http.ResponseWriter, r *http.Request, sess *
// handleWebAccountAction applies one control of the settings page.
func (s *Server) handleWebAccountAction(w http.ResponseWriter, r *http.Request, sess *webSession) {
var notice string
// Changes that need the password and code are proven outside the
// store's lock, then applied inside it.
switch r.FormValue("action") {
case "password", "totp-begin", "totp-disable":
err := s.accountReconfirmed(r, sess, &notice)
s.finishAccountAction(w, r, sess, err, notice)
return
}
err := s.st.Update(func(st *store.State) error {
switch r.FormValue("action") {
case "revoke":
@@ -144,21 +158,6 @@ func (s *Server) handleWebAccountAction(w http.ResponseWriter, r *http.Request,
case "revoke-others":
n := revokeOtherSessions(st, sess.user.ID, sess.token)
notice = fmt.Sprintf("Signed out %d other %s.", n, plural(n, "session", "sessions"))
case "password":
next := r.FormValue("new_password")
if next != r.FormValue("new_password2") {
return errors.New("the two new passwords do not match")
}
if err := changePassword(st, sess.user.Username, r.FormValue("current_password"),
r.FormValue("totp"), next, sess.token); err != nil {
return err
}
notice = "Password changed. Your other sessions were signed out."
case "totp-begin":
if _, err := beginTOTP(st, sess.user.ID, r.FormValue("password"), r.FormValue("totp")); err != nil {
return err
}
notice = "Add the key below to your authenticator app, then enter the code it shows."
case "totp-confirm":
if err := confirmTOTP(st, sess.user.ID, r.FormValue("code")); err != nil {
return err
@@ -167,16 +166,45 @@ func (s *Server) handleWebAccountAction(w http.ResponseWriter, r *http.Request,
case "totp-cancel":
cancelTOTP(st, sess.user.ID)
notice = "Setup cancelled. Nothing changed."
case "totp-disable":
if err := disableTOTP(st, sess.user.ID, r.FormValue("password"), r.FormValue("totp")); err != nil {
return err
}
notice = "Two-factor authentication is off."
default:
return errBadAction
}
return nil
})
s.finishAccountAction(w, r, sess, err, notice)
}
// accountReconfirmed applies the settings changes that need the password,
// and the one-time code when one is on.
func (s *Server) accountReconfirmed(r *http.Request, sess *webSession, notice *string) error {
switch r.FormValue("action") {
case "password":
next := r.FormValue("new_password")
if next != r.FormValue("new_password2") {
return errors.New("the two new passwords do not match")
}
if err := s.changePassword(r, sess.user, r.FormValue("current_password"),
r.FormValue("totp"), next, sess.token); err != nil {
return err
}
*notice = "Password changed. Your other sessions were signed out."
case "totp-begin":
if err := s.reconfirm(r, sess.user, r.FormValue("password"), r.FormValue("totp"),
func(st *store.State, u *store.User) error { _, err := beginTOTP(st, u.ID); return err }); err != nil {
return err
}
*notice = "Add the key below to your authenticator app, then enter the code it shows."
case "totp-disable":
if err := s.reconfirm(r, sess.user, r.FormValue("password"), r.FormValue("totp"),
func(st *store.State, u *store.User) error { return disableTOTP(st, u.ID) }); err != nil {
return err
}
*notice = "Two-factor authentication is off."
}
return nil
}
func (s *Server) finishAccountAction(w http.ResponseWriter, r *http.Request, sess *webSession, err error, notice string) {
if err != nil {
s.renderAccount(w, sess, accountError(err), "")
return
@@ -191,13 +219,16 @@ func (s *Server) handleWebAccountAction(w http.ResponseWriter, r *http.Request,
}
func accountError(err error) string {
var throttled *errThrottled
switch {
case errors.As(err, &throttled):
return throttled.Error()
case errors.Is(err, errReauth), errors.Is(err, errTOTPRequired):
return "Confirm with your password and your current one-time code."
case errors.Is(err, errTOTPInvalid):
return "That one-time code was rejected. Check the clock on the device that shows it."
case errors.Is(err, errBadCredentials):
return "The password is wrong."
return "The password or the one-time code is wrong."
case errors.Is(err, errNoSuchSession):
return "That session is already signed out."
}
@@ -232,6 +263,7 @@ var accountTmpl = template.Must(template.Must(pages.Clone()).Parse(`
{{if .HasPassword}}<span class="tag">password</span>{{end}}
{{if .TOTPOn}}<span class="tag">one-time code</span>{{end}}
{{if .SSO}}<span class="tag">single sign-on</span> <small>via {{.SSO}}</small>{{end}}
{{if .SSOLink}}<br><a href="{{.SSOLink}}">Link single sign-on to this account</a>{{end}}
</td></tr>
<tr><th>Role</th><td>{{if .ServerAdmin}}server administrator{{else}}member{{end}}</td></tr>
<tr><th>Groups</th><td>{{range $i, $g := .Groups}}{{if $i}}, {{end}}{{$g.Name}} <small>({{$g.Role}})</small>{{else}}none{{end}}</td></tr>
@@ -310,6 +342,8 @@ each sign-in also needs a code from an app on your phone.</p>
<form method="post" action="/web/account">
<input type="hidden" name="csrf" value="{{$.CSRF}}">
<input type="hidden" name="action" value="totp-begin">
<label for="tb_password">Your password</label>
<input id="tb_password" name="password" type="password" autocomplete="current-password" required>
<button type="submit">Set up two-factor authentication</button>
</form>
{{end}}