Jonathan KirkwoodandClaude Opus 4.8
69f12b0519
Address the security-auditor findings the user selected (items 2, 3, 4): Default admin credentials (P2): remove the fixed `Ten31` default. First boot now generates a strong random admin password (secrets.token_urlsafe), records it 0600 at /data/.admin-password, and surfaces it once via a new "Show Initial Admin Password" StartOS action (CLI `show-admin-password`). The stored password is cleared when the admin is reset (CLI reset-password) or self-changes it (change-password endpoint). Login hardening (P2): add a per-IP in-memory sliding-window rate limiter (10 failures / 5 min -> 429 + Retry-After) in ratelimit.py; run a dummy argon2 verify when the user is unknown so timing can't enumerate usernames; keep a single generic 401 for unknown-user and wrong-password. Hardening (P3): server process now runs unprivileged -- Dockerfile adds uid 10001 appuser; start.sh (still root) chowns the mounted /data then drops via `setpriv` before exec'ing uvicorn. Spreadsheet imports are size-capped via storage.read_capped (413 past MAX_UPLOAD_SIZE) in the schedule, capital preview, and batch paths. batch_import no longer returns raw exception text (generic per-file messages). Verified in the packed amd64 container: PID1 uvicorn runs as uid 10001, /data owned 10001 with 0600 secrets; generated admin password retrievable via CLI and logs in (200); 11th bad login -> 429; admin reset clears the stored password. Tests: test_auth_hardening.py (4). Full suite 21 passed; frontend tsc + StartOS bundle clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
68 lines
2.6 KiB
Bash
68 lines
2.6 KiB
Bash
#!/bin/sh
|
|
set -e
|
|
|
|
# Generate session secret if not set or default
|
|
if [ "$TEN31_SESSION_SECRET" = "change-me" ]; then
|
|
if [ -f /data/.session-secret ]; then
|
|
export TEN31_SESSION_SECRET=$(cat /data/.session-secret)
|
|
else
|
|
export TEN31_SESSION_SECRET=$(python3 -c "import secrets; print(secrets.token_hex(32))")
|
|
echo "$TEN31_SESSION_SECRET" > /data/.session-secret
|
|
chmod 600 /data/.session-secret
|
|
fi
|
|
fi
|
|
|
|
# Create first approver on first boot if no users exist
|
|
if [ ! -f /data/.initialized ]; then
|
|
echo "First boot: running migrations and creating the admin account..."
|
|
|
|
ADMIN_NAME="${TEN31_ADMIN_NAME:-Jonathan}"
|
|
ADMIN_USERNAME="${TEN31_ADMIN_USERNAME:-admin}"
|
|
ADMIN_EMAIL="${TEN31_ADMIN_EMAIL:-jonathan@ten31.xyz}"
|
|
|
|
# No weak default: use an operator-supplied password if given, else generate a strong random
|
|
# one and record it (0600) so it can be retrieved once via the "Show Initial Admin Password"
|
|
# action. There is no fixed default credential to guess.
|
|
ADMIN_PW_FILE="$(dirname "$TEN31_DB_PATH")/.admin-password"
|
|
if [ -n "$TEN31_ADMIN_PASSWORD" ]; then
|
|
ADMIN_PASSWORD="$TEN31_ADMIN_PASSWORD"
|
|
GENERATED=""
|
|
else
|
|
ADMIN_PASSWORD="$(python3 -c "import secrets; print(secrets.token_urlsafe(18))")"
|
|
GENERATED="yes"
|
|
fi
|
|
|
|
if python3 -m ten31portal.cli create-user \
|
|
--name "$ADMIN_NAME" \
|
|
--username "$ADMIN_USERNAME" \
|
|
--email "$ADMIN_EMAIL" \
|
|
--role approver \
|
|
--password "$ADMIN_PASSWORD" \
|
|
--service-admin; then
|
|
if [ -n "$GENERATED" ]; then
|
|
printf '%s' "$ADMIN_PASSWORD" > "$ADMIN_PW_FILE"
|
|
chmod 600 "$ADMIN_PW_FILE"
|
|
echo "Admin '$ADMIN_USERNAME' created with a generated password."
|
|
echo " Retrieve it once via the 'Show Initial Admin Password' service action, then change it."
|
|
else
|
|
echo "Admin '$ADMIN_USERNAME' created with the operator-supplied password."
|
|
fi
|
|
fi
|
|
|
|
touch /data/.initialized
|
|
fi
|
|
|
|
# Log level is overridable at runtime for debugging; defaults to info.
|
|
LOG_LEVEL="${TEN31_LOG_LEVEL:-info}"
|
|
|
|
# Hand off to the server as an unprivileged user. The platform mounts /data owned by root, so
|
|
# (while still root) we take ownership of the data volume first, then drop privileges with
|
|
# setpriv — the long-running server process is never root, limiting what a compromise can reach.
|
|
if [ "$(id -u)" = "0" ]; then
|
|
chown -R 10001:10001 /data
|
|
exec setpriv --reuid=10001 --regid=10001 --clear-groups \
|
|
uvicorn ten31portal.main:app --host 0.0.0.0 --port 8000 --log-level "$LOG_LEVEL"
|
|
else
|
|
exec uvicorn ten31portal.main:app --host 0.0.0.0 --port 8000 --log-level "$LOG_LEVEL"
|
|
fi
|