nik/FreedomBox
1
0
Fork 0
mirror of https://github.com/freedombox/FreedomBox.git synced 2026-02-11 08:23:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

sso: Upgrade crypto

Browse Source 
- using latest version of lib-apache2-mod-authpubtkt
- upgraded keys to 4096-bit RSA
- upgraded hashing algorithm to sha512

Plinth needs dependency on libapache2-mod-auth-pubtkt >= 0.11

Signed-off-by: Joseph Nuthalpati <njoseph@thoughtworks.com>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
This commit is contained in:
Joseph Nuthalpati 2017-08-28 15:50:47 +05:30 committed by Sunil Mohan Adapa
parent 0a6e45f1cc
commit f9166f8e98
No known key found for this signature in database
GPG Key ID: 43EA1CFF0AA7C5F2
2 changed files with 3 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
actions/auth-pubtkt
View File

@ -66,8 +66,7 @@ def subcommand_create_key_pair(_):
for key_file in [public_key_file, private_key_file]
]):
pkey = crypto.PKey()
# XXX: Use RSA when available in mod-auth-pubtkt.
pkey.generate_key(crypto.TYPE_DSA, 1024)
pkey.generate_key(crypto.TYPE_RSA, 4096)
with open(private_key_file, 'w') as priv_key_file:
priv_key = crypto.dump_privatekey(crypto.FILETYPE_PEM,
@ -102,8 +101,7 @@ def create_ticket(pkey, uid, validuntil, ip=None, tokens=None,
def sign(pkey, data):
"""Calculates and returns ticket's signature."""
# XXX: Use SHA256 when available in mod-auth-pubtkt.
sig = crypto.sign(pkey, data, 'sha1')
sig = crypto.sign(pkey, data, 'sha512')
return base64.b64encode(sig).decode()

2
data/etc/apache2/includes/freedombox-single-sign-on.conf
View File

@ -2,7 +2,7 @@
TKTAuthPublicKey /etc/apache2/auth-pubtkt-keys/pubkey.pem
TKTAuthLoginURL /plinth/accounts/sso/login/
TKTAuthBackArgName next
TKTAuthDigest SHA1
TKTAuthDigest SHA512
TKTAuthRefreshURL /plinth/accounts/sso/refresh/
TKTAuthUnauthURL /plinth
AuthType mod_auth_pubtkt