Skip to content

Lemur/feature/work authentication fix lemur #74

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
clndwhr wants to merge 5 commits into
base: development
Choose a base branch
from
Open

Lemur/feature/work authentication fix lemur #74

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
a9edcc5
fix issues with DEBUG_LOG
clndwhr May 9, 2025
f4ccbfc
fetch Platform type to determine if we're fetching credentials from /…
clndwhr May 9, 2025
b01be5a
Merge branch 'dr-dolomite:main' into feature/work-authentication-fix-…
clndwhr Jul 2, 2025
a8c41ae
Finished DEBUG_LOG paramaterizing, added clarification on logging
clndwhr Jul 4, 2025
cc54b2e
Merge branch 'dr-dolomite:main' into feature/work-authentication-fix-…
clndwhr Jul 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 26 additions & 6 deletions scripts/cgi-bin/quecmanager/auth.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,10 +9,23 @@ read -r POST_DATA

# Debug log for generated hash
DEBUG_LOG="/tmp/auth.log"
touch $DEBUG_LOG
# Clear log before each attempt to keep file space usage small
echo "" > "$DEBUG_LOG"
Comment on lines 10 to +14

Copilot AI Apr 6, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Writing debug output to a predictable path in /tmp is a security risk (symlink/hardlink attacks) and the log includes credential material (shadow/.htpasswd hashes and generated hashes). Please remove this logging or gate it behind an explicit debug flag, and if logs are truly needed write to a root-only location with restrictive perms (e.g., umask 077 / chmod 600) and avoid logging password hashes entirely.

Copilot uses AI. Check for mistakes.

# get the platform type
PLATFORM=$(cat /sys/devices/soc0/machine)
echo "PLATFORM: $PLATFORM" >> "$DEBUG_LOG"
Comment on lines +16 to +18

Copilot AI Apr 6, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR description indicates this should not be merged ("DO NOT MREGE") and reads like personal notes, but the diff changes authentication behavior in production code. Please clarify the intended scope/status (WIP vs ready) in the PR description before merging.

Copilot uses AI. Check for mistakes.
# Extract the password from POST data (URL encoded)
USER="root"
if echo $PLATFORM | grep -q "LEMUR"; then
USER="admin"
ACCESS_FILE="/opt/etc/.htpasswd"
elif echo $PLATFORM | grep -q "PINN"; then
USER="root"
ACCESS_FILE="/etc/shadow"
Comment on lines +20 to +25

Copilot AI Apr 6, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The platform detection block can leave USER/ACCESS_FILE unset when PLATFORM doesn't match either pattern, leading to grep errors and a confusing "User not found" response. Add an else branch that returns an explicit failure (or a safe default) and quote "$PLATFORM" to avoid word-splitting/globbing in the grep pipeline.

Suggested change
if echo $PLATFORM | grep -q "LEMUR"; then
USER="admin"
ACCESS_FILE="/opt/etc/.htpasswd"
elif echo $PLATFORM | grep -q "PINN"; then
USER="root"
ACCESS_FILE="/etc/shadow"
if echo "$PLATFORM" | grep -q "LEMUR"; then
USER="admin"
ACCESS_FILE="/opt/etc/.htpasswd"
elif echo "$PLATFORM" | grep -q "PINN"; then
USER="root"
ACCESS_FILE="/etc/shadow"
else
echo "Unsupported platform: $PLATFORM" >> "$DEBUG_LOG"
echo '{"state":"failed", "message":"Unsupported platform"}'
exit 1

Copilot uses AI. Check for mistakes.
fi
INPUT_PASSWORD=$(echo "$POST_DATA" | grep -o 'password=[^&]*' | cut -d= -f2-)
echo "User: $USER" >> "$DEBUG_LOG"

# URL-decode the password while preserving most special characters
# First decode percent-encoded sequences
Expand All @@ -23,6 +36,7 @@ urldecode() {

# Decode the password
INPUT_PASSWORD=$(urldecode "$INPUT_PASSWORD")
echo "ACCESS_FILE: $ACCESS_FILE" >> $DEBUG_LOG

# Basic validation to reject & and $ characters
if echo "$INPUT_PASSWORD" | grep -q '[&$]'; then
Expand All @@ -32,9 +46,10 @@ fi

# Sanitize the password for shell usage
INPUT_PASSWORD=$(printf '%s' "$INPUT_PASSWORD" | sed 's/[\"]/\\&/g')

# Extract the hashed password from /etc/shadow for the specified user
USER_SHADOW_ENTRY=$(grep "^$USER:" /etc/shadow)
USER_SHADOW_ENTRY=$(grep "^$USER:" "$ACCESS_FILE")

echo "USER: $USER - Shadow User: $USER_SHADOW_ENTRY" >> $DEBUG_LOG
Comment on lines +50 to +52

Copilot AI Apr 6, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This logs the full shadow/.htpasswd entry, which exposes password hashes in plaintext logs. Even if debugging is required, avoid logging USER_SHADOW_ENTRY (and generated hashes) to prevent offline cracking and accidental disclosure.

Copilot uses AI. Check for mistakes.

if [ -z "$USER_SHADOW_ENTRY" ]; then
echo '{"state":"failed", "message":"User not found"}'
Expand All @@ -47,16 +62,21 @@ USER_HASH=$(echo "$USER_SHADOW_ENTRY" | cut -d: -f2)
# Extract the salt (MD5 uses the $1$ prefix followed by the salt)
SALT=$(echo "$USER_HASH" | cut -d'$' -f3)

HASH_TYPE=$(echo "$USER_HASH" | cut -d'$' -f2)

Comment on lines 62 to +66

Copilot AI Apr 6, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Salt parsing is not correct for all valid shadow hash formats. For example, "$6$rounds=...$salt$hash" will make field 3 be "rounds=..." rather than the actual salt, causing authentication to fail. Parse the hash components more robustly (handle optional rounds= and ensure a $-delimited format before extracting).

Copilot uses AI. Check for mistakes.
echo "SALT: $SALT" >> $DEBUG_LOG
echo "HASH_TYPE: $HASH_TYPE" >> $DEBUG_LOG

# Generate a hash from the input password using the same salt
# Use printf to avoid issues with special characters in echo
GENERATED_HASH=$(printf '%s' "$INPUT_PASSWORD" | openssl passwd -1 -salt "$SALT" -stdin)
GENERATED_HASH=$(printf '%s' "$INPUT_PASSWORD" | openssl passwd -$HASH_TYPE -salt "$SALT" -stdin)
Comment on lines +65 to +72

Copilot AI Apr 6, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

HASH_TYPE is derived from the stored hash and is spliced into the openssl command without validation. If HASH_TYPE is empty/unknown (locked accounts, non-$id$ hashes, or algorithms openssl passwd doesn't support), this will error or behave unexpectedly. Validate HASH_TYPE against an allowlist (e.g., 1/5/6/apr1) and return a clear authentication failure when unsupported.

Copilot uses AI. Check for mistakes.

# Log generated hash for debugging
printf "Generated hash: %s\n" "$GENERATED_HASH" >> "$DEBUG_LOG"
echo "Generated hash: %s\n" "$GENERATED_HASH" >> "$DEBUG_LOG"

Copilot AI Apr 6, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This uses echo with a printf-style format string ("%s\n"), so the log output will be incorrect (and may include a literal "\n"). If logging remains, use printf for formatted output.

Suggested change
echo "Generated hash: %s\n" "$GENERATED_HASH" >> "$DEBUG_LOG"
printf 'Generated hash: %s\n' "$GENERATED_HASH" >> "$DEBUG_LOG"

Copilot uses AI. Check for mistakes.

# Compare the generated hash with the one in the shadow file
if [ "$GENERATED_HASH" = "$USER_HASH" ]; then
echo '{"state":"success"}'
else
echo '{"state":"failed", "message":"Authentication failed"}'
fi
fi
Loading