PHP Classes

File: scripts/multiotp-service.sh

Recommend this page to a friend!
  Classes of André Liechti  >  multiOTP PHP class  >  scripts/multiotp-service.sh  >  Download  
File: scripts/multiotp-service.sh
Role: Auxiliary data
Content type: text/plain
Description: Auxiliary data
Class: multiOTP PHP class
Authenticate and manage OTP strong user tokens
Author: By
Last change: New release 5.8.8.4
ENH: Better docker support (also for Synology)
ENH: Add Raspberry Pi Bullseye 11.0 support
New release 5.8.7.0
FIX: Token "Without2FA" where not working all time with LDAP users
ENH: Embedded Windows nginx edition updated to version 1.21.6
ENH: Embedded Windows PHP edition updated to version 7.4.29
ENH: New MariaDB/MySQL indexes handling during schema creation and schema updates
ENH: Enhanced internal tests
ENH: Telnyx SMS provider support
ENH: PHP 7.4 deprecated code cleaned
ENH: Email token is now supported for Credential Provider
ENH: In CLI check, if username doesn't exist, it try automatically a shorter domain name step by step
ENH: Enhanced multiOTP Credential Provider support
ENH: VM version 011 support
(Debian Bullseye 11.0, PHP 7.4, FreeRADIUS 3.0.21, Nginx 1.18.0)
ENH: Removed multicast support on the network card
5.8.2.9 Added compatibility with new multiOTP Credential Provider
New release 5.8.2.3
FIX: Dockerfile updated (php-bcmath added)
URL typo
New release 5.8.2.1
ENH: eDirectory LDAP server support (set the LDAP server type value to 4)
ENH: Raspberry content also in source file
New release 5.8.1.9
FIX: Cookie privacy (httponly and secure) backported to previous virtual appliances
ENH: Weak SSL ciphers disabled
ENH: Better Docker support
ENH: Better log handling
New release 5.8.1.1
FIX: In some cases, the HOTP/TOTP was not well computed
New release 5.8.1.0
FIX: Too many ReadConfigData loop during initialization
FIX: Better unicode handling, multibyte fonctions also for mb_substr()
FIX: A device file was searched with the name of the FreeRADIUS Client-Shortname
ENH: Enhanced Web GUI accounts list (green=AD/LDAP synced, orange = delayed, red=locked)
ENH: -sync-delete-retention-days= option is set by default to 30 days
ENH: VM version 010 support (Debian Buster 10.5, PHP 7.3, FreeRADIUS 3.0.17)
ENH: MySQL optimization
ENH: Enhanced windows command line scripts (automatic administrator level)
ENH: New -sync-delete-retention-days= option in order to purge inexistent AD/LDAP users (SetSyncDeleteRetentionDays and GetSyncDeleteRetentionDays method)
ENH: Raspberry Pi 4B support
ENH: New unified distribution
ENH: Debian Buster 10.5 support
ENH: Enhanced PHP 7.3 support
ENH: Better mysqli support for alternate connection port
New release 5.6.1.5
FIX: Separated configuration/statistics storage handling
FIX: IsTemporaryBadServer function (thanks to brownowski on GitHub)
ENH: Better PHP 7.3 support
ENH: Base32 encoder/decoder new implementation
ENH: During WriteConfigData, loop on the current values, and check with the old values
ENH: Enhanced internal tests
ENH: Give an info if time based token is probably out of sync (in a window 10 time bigger)
(for example for hardware tokens not used for a long time)
ENH: Modifications for Debian 10.x (buster) binary images support (64 bits)
ENH: Enhanced error messages, more log information
ENH: In debug mode, display an error if logfile cannot be written
ENH: Global Access-Challenge support
ENH: New QRcode library used (without external files dependency)
ENH: New Raspberry images support for Raspberry Pi 1B/1B+/2B/3B/3B+
Date: 6 months ago
Size: 8,527 bytes
 

Contents

Class file image Download
#!/bin/bash ######################################## # # @file multiotp-service.sh # @brief Bash helper for multiOTP service # # multiOTP package - Strong two-factor authentication open source package # https://www.multiotp.net/ # # The multiOTP package is the lightest package available that provides so many # strong authentication functionalities and goodies, and best of all, for anyone # that is interested about security issues, it's a fully open source solution! # # This package is the result of a *LOT* of work. If you are happy using this # package, [Donation] are always welcome to support this project. # Please check https://www.multiotp.net/ and you will find the magic button ;-) # # @author Andre Liechti, SysCo systemes de communication sa, <info@multiotp.net> # @version 5.8.8.4 # @date 2022-05-08 # @since 2013-11-29 # @copyright (c) 2013-2021 by SysCo systemes de communication sa # @copyright GNU Lesser General Public License # ########################################################################################## # Hardware detection is_running_in_container() { awk -F: '$3 ~ /^\/$/{ c=1 } END { exit c }' /proc/self/cgroup } FAMILY="" UNAME=$(uname -a) MODEL=$(cat /proc/cpuinfo | grep "Model" | awk -F': ' '{print $2}') if [[ "${MODEL}" == *"Raspberry Pi 4 Model B"* ]]; then # Raspberry Pi 4 FAMILY="RPI" TYPE="RP4" elif [[ "${UNAME}" == *armv8* ]]; then HARDWARE=$(cat /proc/cpuinfo | grep "Hardware" | awk -F': ' '{print $2}') if [[ "${HARDWARE}" == *BCM27* ]]; then # Raspberry Pi 3 B FAMILY="RPI" TYPE="RP3" elif [[ "${HARDWARE}" == *BCM28* ]]; then # Raspberry Pi 3 B+ FAMILY="RPI" TYPE="RP3B+" else # Nothing else yet ! FAMILY="RPI" TYPE="RP3" fi elif [[ "${UNAME}" == *armv7l* ]]; then HARDWARE=$(cat /proc/cpuinfo | grep "Hardware" | awk -F': ' '{print $2}') if [[ "${HARDWARE}" == *BCM27* ]]; then LSCPU=$(/usr/bin/lscpu | grep "CPU max MHz" | awk -F': ' '{print $2}') if [[ "${LSCPU}" == *1500* ]]; then # Raspberry Pi 4 FAMILY="RPI" TYPE="RP4" elif [[ "${LSCPU}" == *1200* ]]; then # Raspberry Pi 3 FAMILY="RPI" TYPE="RP3" else # Raspberry Pi 2 FAMILY="RPI" TYPE="RP2" fi elif [[ "${HARDWARE}" == *BCM28* ]]; then # Raspberry Pi 3 B+ FAMILY="RPI" TYPE="RP3B+" else # Beaglebone Black or similar FAMILY="ARM" if [ -e /sys/class/leds/beaglebone:green:usr0/trigger ] ; then TYPE="BBB" else TYPE="ARM" fi fi elif [[ "${UNAME}" == *armv6l* ]]; then # Raspberry Pi B/B+ FAMILY="RPI" TYPE="RPI" elif [[ "${UNAME}" == *docker* ]]; then # Docker FAMILY="VAP" TYPE="DOCKER" elif grep -q docker /proc/1/cgroup; then FAMILY="VAP" TYPE="DOCKER" elif grep -q docker /proc/self/cgroup; then FAMILY="VAP" TYPE="DOCKER" elif [ -f /.dockerenv ]; then FAMILY="VAP" TYPE="DOCKER" else # others (Virtual Appliance) FAMILY="VAP" TYPE="VA" DMIDECODE=$(dmidecode -s system-product-name) if [[ "${DMIDECODE}" == *VMware* ]]; then VMTOOLS=$(which vmtoolsd) if [[ "${VMTOOLS}" == *vmtoolsd* ]]; then TYPE="VM" else TYPE="VA" fi elif [[ "${DMIDECODE}" == *Virtual\ Machine* ]]; then TYPE="HV" elif [[ "${DMIDECODE}" == *VirtualBox* ]]; then TYPE="VB" fi fi if [ $# -ge 1 ]; then COMMAND="$1" else COMMAND="help" fi if [ $# -ge 2 ]; then PARAM1="$2" else PARAM1="" fi if [ $# -ge 3 ]; then PARAM2="$3" else PARAM2="" fi if [ $# -ge 4 ]; then PARAM3="$4" else PARAM3="" fi if [ $# -ge 5 ]; then PARAM4="$5" else PARAM4="" fi if [ $# -ge 6 ]; then PARAM5="$6" else PARAM5="" fi if [[ "${COMMAND}" == "reset-config" ]]; then # Reset the network interface echo auto lo > /etc/network/interfaces echo iface lo inet loopback >> /etc/network/interfaces echo >> /etc/network/interfaces echo auto eth0 >> /etc/network/interfaces echo iface eth0 inet static >> /etc/network/interfaces echo address 192.168.1.44 >> /etc/network/interfaces echo netmask 255.255.255.0 >> /etc/network/interfaces echo network 192.168.1.0 >> /etc/network/interfaces echo gateway 192.168.1.1 >> /etc/network/interfaces # Reset the DNS resolver echo domain multiotp.local > /etc/resolv.conf echo search multiotp.local >> /etc/resolv.conf echo nameserver 8.8.8.8 >> /etc/resolv.conf echo nameserver 8.8.4.4 >> /etc/resolv.conf elif [[ "${COMMAND}" == "start-multiotp" ]]; then # Clean all PHP sessions if [ -e /var/lib/php5/sess_* ] ; then rm -f /var/lib/php5/sess_* fi if [ -e /var/lib/php/sessions/* ] ; then rm -f /var/lib/php/sessions/* fi # If any, clean DHCP option for NTP # http://support.ntp.org/bin/view/Support/ConfiguringNTP#Section_6.12 if [ -e /var/lib/ntp/ntp.conf.dhcp ] ; then rm -f /var/lib/ntp/ntp.conf.dhcp fi # Create specific SSL certificate if needed if [ -e /etc/multiotp/certificates/multiotp.generic ] || [ ! -e /etc/multiotp/certificates/multiotp.key ] ; then /etc/init.d/nginx stop openssl genrsa -out /etc/multiotp/certificates/multiotp.key 2048 openssl req -new -key /etc/multiotp/certificates/multiotp.key -out /etc/multiotp/certificates/multiotp.csr -subj "/C=CH/ST=GPL/L=Open Source Edition/O=multiOTP/OU=strong authentication server/CN=multiOTP" openssl x509 -req -days 7305 -in /etc/multiotp/certificates/multiotp.csr -signkey /etc/multiotp/certificates/multiotp.key -out /etc/multiotp/certificates/multiotp.crt if [ -e /etc/multiotp/certificates/multiotp.generic ] ; then rm -f /etc/multiotp/certificates/multiotp.generic fi if [ -e /etc/init.d/nginx ] ; then /etc/init.d/nginx restart else service nginx restart fi fi # Create specific SSH key if needed if [ -e /etc/ssh/ssh.generic ] || [ ! -e /etc/ssh/ssh_host_rsa_key ] ; then echo -e "\n\n\n" | ssh-keygen -f /etc/ssh/ssh_host_rsa_key -N '' -t rsa echo -e "\n\n\n" | ssh-keygen -f /etc/ssh/ssh_host_dsa_key -N '' -t dsa rm -f /etc/ssh/ssh.generic fi i2cdetect -y 1 81 81 | grep -E "51|UU" > /dev/null if [ $? == 0 ]; then # Declare the Afterthought Software RasClock device (and other PCF212x compatible RTC clock) on a Rev. 2 board echo pcf2127a 0x51 > /sys/class/i2c-adapter/i2c-1/new_device # Set the system time from the hardware clock ( sleep 2; hwclock -s ) & else # Declare the CJE Micro’s RTC clock device (and other DSxxxx compatible RTC clock) on a Rev. 2 Board i2cdetect -y 1 104 104 | grep -E "68|UU" > /dev/null if [ $? == 0 ]; then echo ds1307 0x68 > /sys/class/i2c-adapter/i2c-1/new_device # Set the system time from the hardware clock ( sleep 2; hwclock -s ) & else i2cdetect -y 0 81 81 | grep -E "51|UU" > /dev/null if [ $? == 0 ]; then # Declare the Afterthought Software RasClock device (and other PCF212x compatible RTC clock) on a Rev. 1 board echo pcf2127a 0x51 > /sys/class/i2c-adapter/i2c-0/new_device # Set the system time from the hardware clock ( sleep 2; hwclock -s ) & else i2cdetect -y 0 104 104 | grep -E "68|UU" > /dev/null if [ $? == 0 ]; then # Declare the CJE Micro’s RTC clock device (and other DSxxxx compatible RTC clock) on a Rev. 1 Board echo ds1307 0x68 > /sys/class/i2c-adapter/i2c-0/new_device # Set the system time from the hardware clock ( sleep 2; hwclock -s ) & fi fi fi fi # Write the last start time in a file date -R > /root/starttime.txt exit 0 elif [[ "${COMMAND}" == "stop-multiotp" ]]; then # Set the hardware clock from the current system time if hardware device if [[ "${FAMILY}" != "VAP" ]]; then hwclock -w fi # Write the last stop time in a file date -R > /root/stoptime.txt exit 0 fi