37 password managing #40
Conversation
…stall-scripts into 37-password-managing
|
After our discussion:
|
|
All todos are done except the optional feature. I'll look into it |
create_user.sh
Outdated
|
|
||
| sudo ./install_pam.sh # setup pam before changing the password for the mirte user. | ||
|
|
||
| echo "mirte:{new_password}" | sudo chpasswd |
There was a problem hiding this comment.
Where is {new_password} set?
There was a problem hiding this comment.
nowhere, probably some find replace mistake
nginx.conf
Outdated
There was a problem hiding this comment.
There is a lot of duplicate code here. It seems nginx can also have shared [common configs](https://serverfault.com/questions/373578/how-can-i-configure-nginx-locations-to-share-common-configuration-options. I think that cleans it up a lot.)
There was a problem hiding this comment.
I searched for "nginx macros", but didn't find one, this is way better. I've implemented it and resolved one warning!
pam/image.png
Outdated
There was a problem hiding this comment.
This is is now different, right?
There was a problem hiding this comment.
jup, that image was old, the current file is okay. Shows that only for the mirte user it shows any output
Fixes #37
Components:
Pam:
This Pluggable Authentication Module is hooked into the passwd calls. Before entering a new password it will show the user a warning that it stores the password and that it should not be a safe password. After entering, it will show the password and store it in
/home/mirte/.wifi_pwdfor the wifi hotspot functionality.password_manager:This python script will watch/usr/local/src/mirte/mirte-install-scripts/config/pam/users.jsonand/usr/local/src/mirte/mirte-install-scripts/config/web/newpasswdfor changes. When there are changes, it updates:Nginx:
Login:
when a user is connecting to any webpage and is not logged in and is not from a 'secure' source (192.168.42/43/137.x), then the user gets a http basic auth popup. When login fails, a custom error page is show how to login. Nginx uses pam to check the username & password.
Code:
The VsCode web server uses a different port from the other pages, as it does not like being in a 'directory'. Nginx will still check for the password. It is possible to go to http://192.168.42.1/code/ and you'll get redirected to the correct port.