diff --git a/app.py b/app.py index c3dd293..cdf42ee 100644 --- a/app.py +++ b/app.py @@ -2,6 +2,7 @@ import os import re import pwd import grp +import hmac import shutil import hashlib import subprocess @@ -16,28 +17,61 @@ VALID_NAME = re.compile(r'^[A-Za-z0-9_-]+$') VALID_NFS_CLIENT = re.compile(r'^[A-Za-z0-9.*:/\-]+$') ALLOWED_PATH_BASE = Path('/srv').resolve() -_AUTH_USER = os.environ.get('MICRONAS_USER', 'admin') -_AUTH_PASS = os.environ.get('MICRONAS_PASS', '') +_ENV_FILE = '/etc/micronas.env' -# Derive secret key from the password so sessions survive restarts -# but are automatically invalidated if the password changes. +# Mutable credential store — updated by setup/change without restart (single gunicorn worker). +_creds = { + 'user': os.environ.get('MICRONAS_USER', ''), + 'hash': os.environ.get('MICRONAS_PASS_HASH', ''), # PBKDF2: "salt$hex" + 'plain': os.environ.get('MICRONAS_PASS', ''), # legacy plaintext +} + +def _is_configured(): + return bool(_creds['user'] and (_creds['hash'] or _creds['plain'])) + +def _hash_password(password): + salt = os.urandom(16).hex() + h = hashlib.pbkdf2_hmac('sha256', password.encode(), salt.encode(), 260_000).hex() + return f'{salt}${h}' + +def _verify_password(password): + if _creds['hash']: + try: + salt, h = _creds['hash'].split('$', 1) + computed = hashlib.pbkdf2_hmac('sha256', password.encode(), salt.encode(), 260_000).hex() + return hmac.compare_digest(computed, h) + except Exception: + return False + if _creds['plain']: + return hmac.compare_digest(password, _creds['plain']) + return False + +def _save_credentials(user, password): + h = _hash_password(password) + Path(_ENV_FILE).write_text(f'MICRONAS_USER={user}\nMICRONAS_PASS_HASH={h}\n') + os.chmod(_ENV_FILE, 0o600) + _creds['user'] = user + _creds['hash'] = h + _creds['plain'] = '' + app.secret_key = hashlib.sha256(h.encode()).hexdigest() + +# Derive initial secret key +_secret_src = _creds['hash'] or _creds['plain'] or 'insecure-dev-key' app.secret_key = os.environ.get('MICRONAS_SECRET') or \ - hashlib.sha256((_AUTH_PASS or 'insecure-dev-key').encode()).hexdigest() + hashlib.sha256(_secret_src.encode()).hexdigest() -if not _AUTH_PASS: +if not _is_configured(): import warnings - warnings.warn( - 'MICRONAS_PASS is not set — all routes are unprotected! ' - 'Set it via the environment or /etc/micronas.env.', - stacklevel=1, - ) + warnings.warn('No credentials configured — first-time setup required at /setup', stacklevel=1) def require_auth(f): @functools.wraps(f) def decorated(*args, **kwargs): - if not _AUTH_PASS: - return f(*args, **kwargs) + if not _is_configured(): + if request.path.startswith('/api/'): + return Response('Setup required', 403) + return redirect(url_for('setup')) if not session.get('logged_in'): if request.path.startswith('/api/'): return Response('Unauthorized', 401) @@ -299,7 +333,7 @@ def _write_webdav_conf(shares): ' AuthName "MicroNAS WebDAV"\n', f' AuthUserFile {WEBDAV_PASSWD}\n', f' {require}\n', - ' Options None\n', + ' Options Indexes\n', ' AllowOverride None\n', '\n', f'# END {_WEBDAV_MARK} {s["name"]}\n\n', @@ -399,15 +433,39 @@ def delete_webdav(name): # ===== AUTH ROUTES ===== +@app.route('/setup', methods=['GET', 'POST']) +def setup(): + if _is_configured(): + return redirect(url_for('index')) + error = None + username = 'admin' + if request.method == 'POST': + username = request.form.get('username', '').strip() + password = request.form.get('password', '') + confirm = request.form.get('confirm', '') + if not username or not VALID_NAME.match(username): + error = 'Invalid username (letters, digits, _ - only).' + elif len(password) < 8: + error = 'Password must be at least 8 characters.' + elif password != confirm: + error = 'Passwords do not match.' + else: + _save_credentials(username, password) + return redirect(url_for('login')) + return render_template('setup.html', error=error, username=username) + + @app.route('/login', methods=['GET', 'POST']) def login(): + if not _is_configured(): + return redirect(url_for('setup')) if session.get('logged_in'): return redirect(url_for('index')) error = None if request.method == 'POST': username = request.form.get('username', '') password = request.form.get('password', '') - if not _AUTH_PASS or (username == _AUTH_USER and password == _AUTH_PASS): + if username == _creds['user'] and _verify_password(password): session['logged_in'] = True return redirect(url_for('index')) error = 'Invalid username or password.' @@ -846,6 +904,50 @@ def delete_user(name): return jsonify({'status': 'deleted'}) +@app.route('/api/admin/credentials', methods=['POST']) +@require_auth +def change_admin_credentials(): + data = request.json or {} + current_pw = data.get('currentPassword', '') + new_user = data.get('username', '').strip() + new_pw = data.get('password', '') + + if not _verify_password(current_pw): + return jsonify({'error': 'Current password is incorrect.'}), 403 + if new_user and not VALID_NAME.match(new_user): + return jsonify({'error': 'Invalid username.'}), 400 + if new_pw and len(new_pw) < 8: + return jsonify({'error': 'Password must be at least 8 characters.'}), 400 + + user = new_user or _creds['user'] + pw = new_pw or current_pw + _save_credentials(user, pw) + session.clear() + return jsonify({'status': 'updated'}) + + +@app.route('/api/users/', methods=['PATCH']) +@require_auth +def rename_user(name): + if not VALID_NAME.match(name): + return jsonify({'error': 'invalid username'}), 400 + new_name = (request.json or {}).get('name', '').strip() + if not new_name or not VALID_NAME.match(new_name): + return jsonify({'error': 'invalid new username'}), 400 + if new_name == name: + return jsonify({'status': 'no change'}), 200 + + r = subprocess.run(['usermod', '-l', new_name, name], capture_output=True, text=True) + if r.returncode != 0: + return jsonify({'error': r.stderr.strip() or 'usermod failed'}), 500 + + # Remove SMB and WebDAV entries — password must be reset after rename + subprocess.run(['smbpasswd', '-x', name], capture_output=True) + _remove_webdav_user(name) + return jsonify({'status': 'renamed', + 'warning': 'SMB and WebDAV password must be reset for the renamed user.'}) + + @app.route('/api/users//password', methods=['POST']) @require_auth def change_password(name): diff --git a/static/js/users.js b/static/js/users.js index 5bf3820..b16e191 100644 --- a/static/js/users.js +++ b/static/js/users.js @@ -22,6 +22,8 @@ async function loadUsers() { + + +
+
+ + +
+
+
+ + +
+
+ + +
+
+ + +
+
+
+ + +
+ + + + + + +
MicroNAS
+ Sign out
@@ -261,7 +320,7 @@
Users
- + diff --git a/templates/setup.html b/templates/setup.html new file mode 100644 index 0000000..f0ed923 --- /dev/null +++ b/templates/setup.html @@ -0,0 +1,48 @@ + + + + + MicroNAS — Setup + + + + + +
+
+
MicroNAS
+
First-time setup — create your admin account
+
+
+
+ {% if error %} +
+ {{ error }} +
+ {% endif %} +
+
+ + +
+
+ + +
+
+ + +
+ + +
+
+
+ Credentials are saved hashed to /etc/micronas.env +
+
+ +
UsernameUIDSMB AccountActions
UsernameUIDSMBActions
Loading…