mirror of
https://github.com/vincentmli/bpfire.git
synced 2026-04-09 18:45:54 +02:00
e1e10515ec
Add two-factor authentication (2FA) to OpenVPN host connections with one-time passwords. The 2FA can be enabled or disabled per host connection and requires the client to download it's configuration again after 2FA has beend enabled for it. Additionally the client needs to configure an TOTP application, like "Google Authenticator" which then provides the second factor. To faciliate this every connection with enabled 2FA gets an "show qrcode" button after the "show file" button in the host connection list to show the 2FA secret and an 2FA configuration QRCode. When 2FA is enabled, the client needs to provide the second factor plus the private key password (if set) to successfully authorize. This only supports time based one-time passwords, TOTP with 30s window and 6 digits, for now but we may update this in the future. Signed-off-by: Timo Eissler <timo.eissler@ipfire.org>
97 lines
2.8 KiB
Plaintext
97 lines
2.8 KiB
Plaintext
<VirtualHost *:444>
|
|
|
|
RewriteEngine on
|
|
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS)
|
|
RewriteRule .* - [F]
|
|
|
|
DocumentRoot /srv/web/ipfire/html
|
|
ServerAdmin root@localhost
|
|
ErrorLog /var/log/httpd/error_log
|
|
TransferLog /var/log/httpd/access_log
|
|
|
|
SSLEngine on
|
|
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
|
|
SSLCipherSuite AESGCM+EECDH:CHACHA20+EECDH:@STRENGTH:+aRSA
|
|
SSLHonorCipherOrder on
|
|
SSLCompression off
|
|
SSLSessionTickets off
|
|
SSLCertificateFile /etc/httpd/server.crt
|
|
SSLCertificateKeyFile /etc/httpd/server.key
|
|
SSLCertificateFile /etc/httpd/server-ecdsa.crt
|
|
SSLCertificateKeyFile /etc/httpd/server-ecdsa.key
|
|
|
|
Header always set X-Content-Type-Options nosniff
|
|
Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:"
|
|
Header always set Referrer-Policy strict-origin
|
|
Header always set X-Frame-Options sameorigin
|
|
|
|
<Directory /srv/web/ipfire/html>
|
|
Options ExecCGI
|
|
AllowOverride None
|
|
Require all granted
|
|
</Directory>
|
|
<DirectoryMatch "/srv/web/ipfire/html/(graphs|sgraph)">
|
|
AuthName "IPFire - Restricted"
|
|
AuthType Basic
|
|
AuthUserFile /var/ipfire/auth/users
|
|
<RequireAll>
|
|
Require user admin
|
|
Require ssl
|
|
</RequireAll>
|
|
</DirectoryMatch>
|
|
ScriptAlias /cgi-bin/ /srv/web/ipfire/cgi-bin/
|
|
<Directory /srv/web/ipfire/cgi-bin>
|
|
AllowOverride None
|
|
Options ExecCGI
|
|
AuthName "IPFire - Restricted"
|
|
AuthType Basic
|
|
AuthUserFile /var/ipfire/auth/users
|
|
<RequireAll>
|
|
Require user admin
|
|
Require ssl
|
|
</RequireAll>
|
|
<Files chpasswd.cgi>
|
|
Require all granted
|
|
</Files>
|
|
<Files webaccess.cgi>
|
|
Require all granted
|
|
</Files>
|
|
</Directory>
|
|
<Files ~ "\.(cgi|shtml?)$">
|
|
SSLOptions +StdEnvVars
|
|
</Files>
|
|
<Directory /srv/web/ipfire/cgi-bin>
|
|
SSLOptions +StdEnvVars
|
|
</Directory>
|
|
SetEnv HOME /home/nobody
|
|
CustomLog /var/log/httpd/ssl_request_log \
|
|
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
|
|
|
|
Alias /updatecache/ /var/updatecache/
|
|
<Directory /var/updatecache>
|
|
Options ExecCGI
|
|
AllowOverride None
|
|
Require all granted
|
|
</Directory>
|
|
|
|
Alias /repository/ /var/urlrepo/
|
|
<Directory /var/urlrepo>
|
|
Options ExecCGI
|
|
AllowOverride None
|
|
Require all granted
|
|
</Directory>
|
|
|
|
Alias /proxy-reports/ /var/log/sarg/
|
|
<Directory /var/log/sarg>
|
|
AllowOverride None
|
|
Options None
|
|
AuthName "IPFire - Restricted"
|
|
AuthType Basic
|
|
AuthUserFile /var/ipfire/auth/users
|
|
<RequireAll>
|
|
Require user admin
|
|
Require ssl
|
|
</RequireAll>
|
|
</Directory>
|
|
</VirtualHost>
|