Changeset 413

Timestamp:

09/03/09 04:25:41 (15 years ago)

Author:

nanardon

Message:

In SQL base, allow to have a peer of public/private RSA key, then when user set it password it is stored in it clear form but encrypt using public key
The la-encrypt-passwd tools allow to

• generate or regenerate a new key
• read password
• read password to propagate it into another base

Notice the private key is protected by a passwphrase prompt when setting it

Location:

LATMOS-Accounts

Files:

• Makefile.PL (modified) (1 diff)
• bin/la-crypt-passwd (added)
• bin/la-warn-expire (modified) (1 diff)
• lib/LATMOS/Accounts/Bases/Sql.pm (modified) (1 diff)
• lib/LATMOS/Accounts/Bases/Sql/objects.pm (modified) (2 diffs)
• lib/LATMOS/Accounts/Maintenance.pm (modified) (2 diffs)

LATMOS-Accounts/Makefile.PL

@@ -10 +10 @@
         'Unicode::Map8' => undef,
         'DBD::Pg' => undef,
+        'Crypt::RSA' => undef,
+        'MIME::Base64' => undef,
+        'Term::ReadKey' => undef,
     }, # e.g., Module::Name => 1.1
     ($] >= 5.005 ?     ## Add these new keywords supported since 5.005

LATMOS-Accounts/bin/la-warn-expire

@@ -19 +19 @@
 GetOptions(
     'c|config=s' => \my $config,
-    'b|base=s'   => \my $base,
+#    'b|base=s'   => \my $base,
     'm|mail'     => \my $mail,
     'help'       => sub { pod2usage(0) },

LATMOS-Accounts/lib/LATMOS/Accounts/Bases/Sql.pm

@@ -128 +128 @@
 } 
 
+sub get_global_value {
+    my ($self, $varname) = @_;
+
+    my $sth = $self->db->prepare_cached(q{
+        select val from settings where varname = ?
+        });
+    $sth->execute($varname);
+    my $res = $sth->fetchrow_hashref;
+    $sth->finish;
+    $res->{val}
+}
+
+sub set_global_value {
+    my ($self, $varname, $value) = @_;
+    my $sth = $self->db->prepare(q{
+        update settings set val = ? where varname = ?
+        });
+    $sth->execute($value, $varname) == 0 and do {
+        my $sth2 = $self->db->prepare(q{
+            insert into settings (val, varname) values (?,?)
+            });
+        $sth2->execute($value, $varname);
+    };
+}
+
 1;
 

LATMOS-Accounts/lib/LATMOS/Accounts/Bases/Sql/objects.pm

@@ -7 +7 @@
 use base qw(LATMOS::Accounts::Bases::Objects);
 use LATMOS::Accounts::Log;
+use Crypt::RSA;
+use Crypt::RSA::Key::Public::SSH;
 
 our $VERSION = (q$Rev$ =~ /^Rev: (\d+) /)[0];
@@ -417 +419 @@
 }
 
+sub set_password {
+    my ($self, $clear_pass) = @_;
+    if (my $field = $self->base->get_field_name($self->type, 'userPassword')) {
+        my @salt_char = (('a' .. 'z'), ('A' .. 'Z'), (0 .. 9), '/', '.');
+        my $salt = join('', map { $salt_char[rand(scalar(@salt_char))] } (1 .. 8));
+        my $res = $self->set_fields($field, crypt($clear_pass, '$1$' . $salt));
+
+        if (my $serialize = $self->base->get_global_value('rsa_public_key')) {
+            my $public = Crypt::RSA::Key::Public::SSH->new;
+            $public->deserialize(String => [ $serialize ]);
+            my $rsa = new Crypt::RSA ES => 'PKCS1v15';
+            my $rsa_password = $rsa->encrypt (
+                Message    => $clear_pass,
+                Key        => $public,
+                Armour     => 1,
+            ) || die $self->poll->rsa->errstr();
+            $self->set_c_fields('encryptedPassword', $rsa_password);
+        }
+    } else {
+        $self->log(LA_WARN,
+            "Cannot set password: userPassword attributes is unsupported");
+    }
+}
 
 sub search {

LATMOS-Accounts/lib/LATMOS/Accounts/Maintenance.pm

@@ -5 +5 @@
 use base qw(LATMOS::Accounts);
 use FindBin qw($Bin);
+use Crypt::RSA;
+use Crypt::RSA::Key::Public::SSH;
+use Crypt::RSA::Key::Private::SSH;
+use MIME::Base64;
 
 sub _base {
@@ -83 +87 @@
 }
 
+sub generate_rsa_key {
+    my ($self, $password) = @_;
+    
+    my $rsa = new Crypt::RSA ES => 'PKCS1v15';
+    my ($public, $private) = $rsa->keygen (
+        Identity  => 'LATMOS-Accounts',
+        Size      => 768,
+        Password  => $password,
+        Verbosity => 0,
+        KF=>'SSH',
+    ) or die
+    $self->rsa->errstr(); # TODO avoid die
+    return ($public, $private);
+}
+
+sub store_rsa_key {
+    my ($self, $public, $private) = @_;
+    my $base = $self->_base;
+    $base->set_global_value('rsa_private_key',
+        encode_base64($private->serialize));
+    $base->set_global_value('rsa_public_key',
+        $public->serialize);
+    return;
+}
+
+sub private_key {
+    my ($self, $password) = @_;
+    my $base = $self->_base;
+    my $serialize = $base->get_global_value('rsa_private_key') or return;
+    my $privkey = Crypt::RSA::Key::Private::SSH->new;
+    $privkey->deserialize(String => [ decode_base64($serialize) ],
+        Passphrase => $password);
+    $privkey
+}
+
+sub get_rsa_password {
+    my ($self) = @_;
+    my $base = $self->_base;
+    my $sth = $base->db->prepare(q{
+        select "name", value from "user" join user_attributes_base
+        on "user".ikey = user_attributes_base.okey
+        where user_attributes_base.attr = 'encryptedPassword'
+    });
+    $sth->execute;
+    my %users;
+    while (my $res = $sth->fetchrow_hashref) {
+        $users{$res->{name}} = $res->{value};
+    }
+    %users
+}
+
 1;