PHP Classes

File: scripts/multiotp-service.sh

Recommend this page to a friend!
  Classes of André Liechti  >  multiOTP PHP class  >  scripts/multiotp-service.sh  >  Download  
File: scripts/multiotp-service.sh
Role: Auxiliary data
Content type: text/plain
Description: Auxiliary data
Class: multiOTP PHP class
Authenticate and manage OTP strong user tokens
Author: By
Last change: New release 5.8.8.4
ENH: Better docker support (also for Synology)
ENH: Add Raspberry Pi Bullseye 11.0 support
New release 5.8.7.0
FIX: Token "Without2FA" where not working all time with LDAP users
ENH: Embedded Windows nginx edition updated to version 1.21.6
ENH: Embedded Windows PHP edition updated to version 7.4.29
ENH: New MariaDB/MySQL indexes handling during schema creation and schema updates
ENH: Enhanced internal tests
ENH: Telnyx SMS provider support
ENH: PHP 7.4 deprecated code cleaned
ENH: Email token is now supported for Credential Provider
ENH: In CLI check, if username doesn't exist, it try automatically a shorter domain name step by step
ENH: Enhanced multiOTP Credential Provider support
ENH: VM version 011 support
(Debian Bullseye 11.0, PHP 7.4, FreeRADIUS 3.0.21, Nginx 1.18.0)
ENH: Removed multicast support on the network card
5.8.2.9 Added compatibility with new multiOTP Credential Provider
New release 5.8.2.3
FIX: Dockerfile updated (php-bcmath added)
URL typo
New release 5.8.2.1
ENH: eDirectory LDAP server support (set the LDAP server type value to 4)
ENH: Raspberry content also in source file
New release 5.8.1.9
FIX: Cookie privacy (httponly and secure) backported to previous virtual appliances
ENH: Weak SSL ciphers disabled
ENH: Better Docker support
ENH: Better log handling
New release 5.8.1.1
FIX: In some cases, the HOTP/TOTP was not well computed
New release 5.8.1.0
FIX: Too many ReadConfigData loop during initialization
FIX: Better unicode handling, multibyte fonctions also for mb_substr()
FIX: A device file was searched with the name of the FreeRADIUS Client-Shortname
ENH: Enhanced Web GUI accounts list (green=AD/LDAP synced, orange = delayed, red=locked)
ENH: -sync-delete-retention-days= option is set by default to 30 days
ENH: VM version 010 support (Debian Buster 10.5, PHP 7.3, FreeRADIUS 3.0.17)
ENH: MySQL optimization
ENH: Enhanced windows command line scripts (automatic administrator level)
ENH: New -sync-delete-retention-days= option in order to purge inexistent AD/LDAP users (SetSyncDeleteRetentionDays and GetSyncDeleteRetentionDays method)
ENH: Raspberry Pi 4B support
ENH: New unified distribution
ENH: Debian Buster 10.5 support
ENH: Enhanced PHP 7.3 support
ENH: Better mysqli support for alternate connection port
New release 5.6.1.5
FIX: Separated configuration/statistics storage handling
FIX: IsTemporaryBadServer function (thanks to brownowski on GitHub)
ENH: Better PHP 7.3 support
ENH: Base32 encoder/decoder new implementation
ENH: During WriteConfigData, loop on the current values, and check with the old values
ENH: Enhanced internal tests
ENH: Give an info if time based token is probably out of sync (in a window 10 time bigger)
(for example for hardware tokens not used for a long time)
ENH: Modifications for Debian 10.x (buster) binary images support (64 bits)
ENH: Enhanced error messages, more log information
ENH: In debug mode, display an error if logfile cannot be written
ENH: Global Access-Challenge support
ENH: New QRcode library used (without external files dependency)
ENH: New Raspberry images support for Raspberry Pi 1B/1B+/2B/3B/3B+
Date: 4 months ago
Size: 8,527 bytes
 

Contents

Class file image Download
#!/bin/bash
########################################
#
# @file   multiotp-service.sh
# @brief  Bash helper for multiOTP service
#
# multiOTP package - Strong two-factor authentication open source package
# https://www.multiotp.net/
#
# The multiOTP package is the lightest package available that provides so many
# strong authentication functionalities and goodies, and best of all, for anyone
# that is interested about security issues, it's a fully open source solution!
#
# This package is the result of a *LOT* of work. If you are happy using this
# package, [Donation] are always welcome to support this project.
# Please check https://www.multiotp.net/ and you will find the magic button ;-)
#
# @author    Andre Liechti, SysCo systemes de communication sa, <info@multiotp.net>
# @version   5.8.8.4
# @date      2022-05-08
# @since     2013-11-29
# @copyright (c) 2013-2021 by SysCo systemes de communication sa
# @copyright GNU Lesser General Public License
#
##########################################################################################


# Hardware detection

is_running_in_container() {
  awk -F: '$3 ~ /^\/$/{ c=1 } END { exit c }' /proc/self/cgroup
}

FAMILY=""
UNAME=$(uname -a)
MODEL=$(cat /proc/cpuinfo | grep "Model" | awk -F': ' '{print $2}')
if [[ "${MODEL}" == *"Raspberry Pi 4 Model B"* ]]; then
    # Raspberry Pi 4
    FAMILY="RPI"
    TYPE="RP4"
elif [[ "${UNAME}" == *armv8* ]]; then
    HARDWARE=$(cat /proc/cpuinfo | grep "Hardware" | awk -F': ' '{print $2}')
    if [[ "${HARDWARE}" == *BCM27* ]]; then
        # Raspberry Pi 3 B
        FAMILY="RPI"
        TYPE="RP3"
    elif [[ "${HARDWARE}" == *BCM28* ]]; then
        # Raspberry Pi 3 B+
        FAMILY="RPI"
        TYPE="RP3B+"
    else
        # Nothing else yet !
        FAMILY="RPI"
        TYPE="RP3"
    fi
elif [[ "${UNAME}" == *armv7l* ]]; then
    HARDWARE=$(cat /proc/cpuinfo | grep "Hardware" | awk -F': ' '{print $2}')
    if [[ "${HARDWARE}" == *BCM27* ]]; then
        LSCPU=$(/usr/bin/lscpu | grep "CPU max MHz" | awk -F': ' '{print $2}')
        if [[ "${LSCPU}" == *1500* ]]; then
            # Raspberry Pi 4
            FAMILY="RPI"
            TYPE="RP4"
        elif [[ "${LSCPU}" == *1200* ]]; then
            # Raspberry Pi 3
            FAMILY="RPI"
            TYPE="RP3"
        else
            # Raspberry Pi 2
            FAMILY="RPI"
            TYPE="RP2"
        fi
    elif [[ "${HARDWARE}" == *BCM28* ]]; then
        # Raspberry Pi 3 B+
        FAMILY="RPI"
        TYPE="RP3B+"
    else
        # Beaglebone Black or similar
        FAMILY="ARM"
        if [ -e /sys/class/leds/beaglebone:green:usr0/trigger ] ; then
            TYPE="BBB"
        else
            TYPE="ARM"
        fi
    fi
elif [[ "${UNAME}" == *armv6l* ]]; then
    # Raspberry Pi B/B+
    FAMILY="RPI"
    TYPE="RPI"
elif [[ "${UNAME}" == *docker* ]]; then
    # Docker
    FAMILY="VAP"
    TYPE="DOCKER"
elif grep -q docker /proc/1/cgroup; then 
    FAMILY="VAP"
    TYPE="DOCKER"
elif grep -q docker /proc/self/cgroup; then 
    FAMILY="VAP"
    TYPE="DOCKER"
elif [ -f /.dockerenv ]; then
    FAMILY="VAP"
    TYPE="DOCKER"
else
    # others (Virtual Appliance)
    FAMILY="VAP"
    TYPE="VA"
    DMIDECODE=$(dmidecode -s system-product-name)
    if [[ "${DMIDECODE}" == *VMware* ]]; then
        VMTOOLS=$(which vmtoolsd)
        if [[ "${VMTOOLS}" == *vmtoolsd* ]]; then
            TYPE="VM"
        else
            TYPE="VA"
        fi
    elif [[ "${DMIDECODE}" == *Virtual\ Machine* ]]; then
        TYPE="HV"
    elif [[ "${DMIDECODE}" == *VirtualBox* ]]; then
        TYPE="VB"
    fi
fi


if [ $# -ge 1 ]; then
    COMMAND="$1"
else
    COMMAND="help"
fi

if [ $# -ge 2 ]; then
    PARAM1="$2"
else
    PARAM1=""
fi

if [ $# -ge 3 ]; then
    PARAM2="$3"
else
    PARAM2=""
fi

if [ $# -ge 4 ]; then
    PARAM3="$4"
else
    PARAM3=""
fi

if [ $# -ge 5 ]; then
    PARAM4="$5"
else
    PARAM4=""
fi

if [ $# -ge 6 ]; then
    PARAM5="$6"
else
    PARAM5=""
fi


if [[ "${COMMAND}" == "reset-config" ]]; then
    # Reset the network interface
    echo auto lo > /etc/network/interfaces
    echo iface lo inet loopback >> /etc/network/interfaces
    echo >> /etc/network/interfaces
    echo auto eth0 >> /etc/network/interfaces
    echo iface eth0 inet static >> /etc/network/interfaces
    echo     address 192.168.1.44 >> /etc/network/interfaces
    echo     netmask 255.255.255.0 >> /etc/network/interfaces
    echo     network 192.168.1.0 >> /etc/network/interfaces
    echo     gateway 192.168.1.1 >> /etc/network/interfaces

    # Reset the DNS resolver
    echo domain multiotp.local > /etc/resolv.conf
    echo search multiotp.local >> /etc/resolv.conf
    echo nameserver 8.8.8.8 >> /etc/resolv.conf
    echo nameserver 8.8.4.4 >> /etc/resolv.conf
elif [[ "${COMMAND}" == "start-multiotp" ]]; then
    # Clean all PHP sessions
    if [ -e /var/lib/php5/sess_* ] ; then
        rm -f /var/lib/php5/sess_*
    fi
    if [ -e /var/lib/php/sessions/* ] ; then
        rm -f /var/lib/php/sessions/*
    fi

    # If any, clean DHCP option for NTP
    # http://support.ntp.org/bin/view/Support/ConfiguringNTP#Section_6.12
    if [ -e /var/lib/ntp/ntp.conf.dhcp ] ; then
        rm -f /var/lib/ntp/ntp.conf.dhcp
    fi

    # Create specific SSL certificate if needed
    if [ -e /etc/multiotp/certificates/multiotp.generic ] || [ ! -e /etc/multiotp/certificates/multiotp.key ] ; then
        /etc/init.d/nginx stop
        openssl genrsa -out /etc/multiotp/certificates/multiotp.key 2048
        openssl req -new -key /etc/multiotp/certificates/multiotp.key -out /etc/multiotp/certificates/multiotp.csr -subj "/C=CH/ST=GPL/L=Open Source Edition/O=multiOTP/OU=strong authentication server/CN=multiOTP"
        openssl x509 -req -days 7305 -in /etc/multiotp/certificates/multiotp.csr -signkey /etc/multiotp/certificates/multiotp.key -out /etc/multiotp/certificates/multiotp.crt
        if [ -e /etc/multiotp/certificates/multiotp.generic ] ; then
            rm -f /etc/multiotp/certificates/multiotp.generic
        fi
        if [ -e /etc/init.d/nginx ] ; then
            /etc/init.d/nginx restart
        else
            service nginx restart
        fi
    fi
    
    # Create specific SSH key if needed
    if [ -e /etc/ssh/ssh.generic ] || [ ! -e /etc/ssh/ssh_host_rsa_key ] ; then
        echo -e "\n\n\n" | ssh-keygen -f /etc/ssh/ssh_host_rsa_key -N '' -t rsa
        echo -e "\n\n\n" | ssh-keygen -f /etc/ssh/ssh_host_dsa_key -N '' -t dsa
        rm -f /etc/ssh/ssh.generic
    fi

    i2cdetect -y 1 81 81 | grep -E "51|UU" > /dev/null
    if [ $? == 0 ]; then
        # Declare the Afterthought Software RasClock device (and other PCF212x compatible RTC clock) on a Rev. 2 board
        echo pcf2127a 0x51 > /sys/class/i2c-adapter/i2c-1/new_device
        # Set the system time from the hardware clock
        ( sleep 2; hwclock -s ) &
    else
        # Declare the CJE Micro’s RTC clock device (and other DSxxxx compatible RTC clock) on a Rev. 2 Board
        i2cdetect -y 1 104 104 | grep -E "68|UU" > /dev/null    
        if [ $? == 0 ]; then
            echo ds1307 0x68 > /sys/class/i2c-adapter/i2c-1/new_device
            # Set the system time from the hardware clock
            ( sleep 2; hwclock -s ) &
        else
            i2cdetect -y 0 81 81 | grep -E "51|UU" > /dev/null
            if [ $? == 0 ]; then
            # Declare the Afterthought Software RasClock device (and other PCF212x compatible RTC clock) on a Rev. 1 board
                echo pcf2127a 0x51 > /sys/class/i2c-adapter/i2c-0/new_device
                # Set the system time from the hardware clock
                ( sleep 2; hwclock -s ) &
            else
                i2cdetect -y 0 104 104 | grep -E "68|UU" > /dev/null    
                if [ $? == 0 ]; then
                    # Declare the CJE Micro’s RTC clock device (and other DSxxxx compatible RTC clock) on a Rev. 1 Board
                    echo ds1307 0x68 > /sys/class/i2c-adapter/i2c-0/new_device
                    # Set the system time from the hardware clock
                    ( sleep 2; hwclock -s ) &
                fi
            fi
        fi
    fi
    
    # Write the last start time in a file
    date -R > /root/starttime.txt
    exit 0

elif [[ "${COMMAND}" == "stop-multiotp" ]]; then
    # Set the hardware clock from the current system time if hardware device
    if [[ "${FAMILY}" != "VAP" ]]; then
        hwclock -w
    fi

    # Write the last stop time in a file
    date -R > /root/stoptime.txt
    exit 0
fi
For more information send a message to info at phpclasses dot org.