bluebycode / marshmallows Goto Github PK

• Tras el despliegue, aplicar Let's encrypt.

• Generación de token (temporal) (1 minuto)
• Envío del token en el registro de usuario => Validación.

Comunicaciones bidreccionales (Websockets).

• Broker. Añadir la capacidad de generar la entidad (R)esponder del canal (seguro).
• Agent. Añadir el lado (I)nitiator, con salida echo o ptty.

Deberíamos generar un puerto automático y posibilidad de probar desde el navegador.

• Builds a binary based on a golang application developed with previous issue
• Publish manually or upload into github under /distributions section.

Bundler Audit reported an outdated library.

Name: rails-html-sanitizer
Version: 1.3.0
Advisory: CVE-2015-7580
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/uh--W4TDwmI
Title: Possible XSS vulnerability in rails-html-sanitizer
Solution: upgrade to ~> 1.0.3

• Llamadas al servicio de autenticación desde el componente de React. Deberá ajustarse a los requisitos dados por el servicio de autenticación:

login(userDomain, callbackDone)
totpValidation(userDomain, totp, callbackDone)
toggleU2f
u2fenabled

• @guillermijas Necesito feedback y especificación del flow de autenticación previo.

Users don't know if there was an error in the auth process

• Esqueleto del servicio (Ruby) para permitir los endpoints de autenticación por parte del frontend.
• Dockerización bajo un contenedor

• Creación del componente Terminal basado en xterm.js

• Builds an endpoint as 192.168.43.100:8081/open/{deviceId} receiving:
  {T::token, D::agentPublicKey, I::deviceid}
• Use authentication api 192.168.43.104:3000/auth/validate {T::token}
• Token should be invalidated (auth api side)
• We ought to store {D::agentPublicKey, I::deviceid} in order to make comparison when channel connection has been stablished.
• Use Noise to protect the connection

Servicio CRUD: Registro e identificación de usuario-dominio.

Adaptar la prueba de concepto bajo poc/nodos

Endpoints to generate (auth/device/generate) a token and invalidate (auth/device/validation) when check them.

Server public/private keys are hardcoded in the code, found in the function generateServerKeys, file https://github.com/vrandkode/marshmallows/blob/master/common/noise.go:

pub, _ := base64.StdEncoding.DecodeString("J6TRfRXR5skWt6w5cFyaBxX8LPeIVxboZTLXTMhk4HM=")
priv, _ := base64.StdEncoding.DecodeString("vFilCT/FcyeShgbpTUrpru9n5yzZey8yfhsAx6DeL80=")

This default values should be in a configuration file or env variable instead. These values should be rotated now that are exposed.

https://github.com/vrandkode/marshmallows/blob/master/common/noise.go#L62

Client public/private keys are hardcoded in the code, found in the function generateClientKeys, file https://github.com/vrandkode/marshmallows/blob/master/common/noise.go:

pub, _ := base64.StdEncoding.DecodeString("L9Xm5qy17ZZ6rBMd1Dsn5iZOyS7vUVhYK+zby1nJPEE=")
priv, _ := base64.StdEncoding.DecodeString("TPmwb3vTEgrA3oq6PoGEzH5hT91IDXGC9qEMc8ksRiw=")

This default values should be in a configuration file or env variable instead. These values should be rotated now that are exposed.

https://github.com/vrandkode/marshmallows/blob/master/common/noise.go#L49

• Agente. Subscripción y registro, con keep-alive. Comunicación bidireccional con Websockets.
• Broker. Registro de agentes, endpoint para designar los agentes disponibles.

• Id (6 hexadecimal string based) {deviceId}
• Binary ask for token generated previously.
• Public/Private keys are generated (DH.generateKey 32 bytes) {D, d}
• When register send POST thru Http channel with payload {token, D, id}
  • Use the endpoint [Post] http://192.168.43.100:8082/open (ask @vrandkode )
• Enable Noise (ask @vrandkode )