[pbs-devel] [RFC backup 0/6] Two factor authentication

[Wolfgang Bumiller]

This series is a first RFC for two factor authentication.

Notes:
* Backend contains support for TOTP, Webauthn, Recovery keys and U2F.
* The webauthn-rs crate introduces new dependencies we need to package:
  - `half`
  - `serde-cbor`
  For our internal rust packaging I pushed the current debcargo-conf
  changes to my `staff/w.bumiller/debcargo-conf` repo, branch `webauthn-rs`.

  some extra (already-packaged) deps will be pulled in along with them:
    $ cargo update
          Adding getrandom v0.1.14
          Adding half v1.6.0
          Adding nom v4.2.3
          Adding ppv-lite86 v0.2.6
          Adding rand v0.7.2
          Adding rand_chacha v0.2.2
          Adding rand_core v0.5.1
          Adding rand_hc v0.2.0
          Adding serde_bytes v0.11.5
          Adding serde_cbor v0.11.1
          Adding thiserror v1.0.15
          Adding thiserror-impl v1.0.15
          Adding webauthn-rs v0.2.5

* I wrote u2f before webauthn and left it in there unused because:
  * we may want to move the code out to be integrated to PVE and PBS as
    well for webauthn
  * if we do: the webauthn-rs crate doesn't seem to provide a way
    forward to using existin u2f credentials, so to not break those
    we'll need the u2f backend.

* The GUI does not use U2F (see above). (I do have code for it if for
  some reason we do want that).

* The GUI code is probably super weird. Some windows might look clunky,
  but for me they always do currently since I'm working with
  non-standard dpi monitor settings... so I can't really tell :-P

* I introduced some `async` code into the GUI because the webauthn api
  uses Promises and extjs doesn't seem to have issues with that...

* The TFA configuration is currently a single json file.

* While writing this mail I realized I still want to change the way
  webauthn credentials are being serialized, but that's not important
  for a first draft to look through ;-)

Wolfgang Bumiller (6):
  add tools::serde_filter submodule
  config: add tfa configuration
  api: tfa management and login
  depend on libjs-qrcodejs
  proxy: expose qrcodejs
  gui: tfa support

 Cargo.toml                      |    1 +
 debian/control.in               |    1 +
 src/api2/access.rs              |  171 ++++--
 src/api2/access/tfa.rs          |  567 +++++++++++++++++
 src/bin/proxmox-backup-proxy.rs |    1 +
 src/config.rs                   |    1 +
 src/config/tfa.rs               | 1017 +++++++++++++++++++++++++++++++
 src/server.rs                   |    2 +
 src/server/rest.rs              |    5 +-
 src/server/ticket.rs            |   77 +++
 src/tools.rs                    |    1 +
 src/tools/serde_filter.rs       |   97 +++
 www/LoginView.js                |  323 +++++++++-
 www/Makefile                    |    6 +
 www/OnlineHelpInfo.js           |   36 --
 www/Utils.js                    |   59 ++
 www/config/TfaView.js           |  322 ++++++++++
 www/index.hbs                   |    1 +
 www/panel/AccessControl.js      |    6 +
 www/window/AddTfaRecovery.js    |  211 +++++++
 www/window/AddTotp.js           |  283 +++++++++
 www/window/AddWebauthn.js       |  193 ++++++
 www/window/TfaEdit.js           |   92 +++
 23 files changed, 3357 insertions(+), 116 deletions(-)
 create mode 100644 src/api2/access/tfa.rs
 create mode 100644 src/config/tfa.rs
 create mode 100644 src/server/ticket.rs
 create mode 100644 src/tools/serde_filter.rs
 create mode 100644 www/config/TfaView.js
 create mode 100644 www/window/AddTfaRecovery.js
 create mode 100644 www/window/AddTotp.js
 create mode 100644 www/window/AddWebauthn.js
 create mode 100644 www/window/TfaEdit.js

-- 
2.20.1