nihilist/acme.sh
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: bypass enforce temp admin 2FA

Browse Source
This commit is contained in:
Scruel Tao 2024-02-26 06:21:03 +08:00
parent dbe0d477d6
commit 59d1e16f9c
1 changed files with 40 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
deploy/synology_dsm.sh
View File

@ -11,8 +11,7 @@
# Usage:
# 1. Set required environment variables:
# - use automatically created temp admin user to authenticate
# 1. disable "enfore 2FA-OTP for admins" via control panel
# 2. `export SYNO_UseTempAdmin=1`
# `export SYNO_UseTempAdmin=1`
# - or provide your own admin user credential to authenticate
# 1. `export SYNO_Username="adminUser"`
# 2. `export SYNO_Password="adminPassword"`
@ -70,8 +69,8 @@ synology_dsm_deploy() {
_debug2 SYNO_UseTempAdmin "$SYNO_UseTempAdmin"
# Back to use existing admin user if explicitly requested
if [ "$SYNO_UseTempAdmin" -eq 0 ]; then
_debug2 Back to use existing user rather than temp admin user.
if [ "$SYNO_UseTempAdmin" == "0" ]; then
_debug2 "Back to use existing user rather than temp admin user."
SYNO_UseTempAdmin=""
fi
_savedeployconf SYNO_UseTempAdmin "$SYNO_UseTempAdmin"
@ -176,6 +175,10 @@ synology_dsm_deploy() {
# ## END ## - DEPRECATED, for backward compatibility
# If SYNO_DeviceID or SYNO_OTPCode is set, we treat current account enabled 2FA-OTP.
# Notice that if SYNO_UseTempAdmin=1, both variables will be unset
else
if [ -n "$SYNO_DeviceID" ] || [ -n "$SYNO_OTPCode" ]; then
response='{"error":{"code":403}}'
# Assume the current account disabled 2FA-OTP, try to log in right away.
else
if [ -n "$SYNO_UseTempAdmin" ]; then
_debug "Creating temp admin user in Synology DSM..."
@ -189,19 +192,30 @@ synology_dsm_deploy() {
# shellcheck disable=SC2086
synogroup --member administrators $cur_admins $SYNO_Username >/dev/null
fi
fi
if [ -n "$SYNO_DeviceID" ] || [ -n "$SYNO_OTPCode" ]; then
response='{"error":{"code":403}}'
# Assume the current account disabled 2FA-OTP, try to log in right away.
# havig a workaround to temporary disable enforce 2FA-OTP
otp_enforce_option=$(synogetkeyvalue /etc/synoinfo.conf otp_enforce_option)
if [ -n "$otp_enforce_option" ] && [ "${otp_enforce_option:-"none"}" != "none" ]; then
synosetkeyvalue /etc/synoinfo.conf otp_enforce_option none
_info "Temporary disabled enforce 2FA-OTP to complete authentication."
_info "previous_otp_enforce_option" "$otp_enforce_option"
else
otp_enforce_option=""
fi
fi
response=$(_get "$_base_url/webapi/entry.cgi?api=SYNO.API.Auth&version=$api_version&method=login&format=sid&account=$encoded_username&passwd=$encoded_password&enable_syno_token=yes")
if [ -n "$SYNO_UseTempAdmin" ] && [ -n "$otp_enforce_option" ]; then
synosetkeyvalue /etc/synoinfo.conf otp_enforce_option "$otp_enforce_option"
_info "Restored previous enforce 2FA-OTP option."
fi
_debug3 response "$response"
fi
fi
error_code=$(echo "$response" | grep '"error"' | grep -oP '(?<="code":)\d+')
# Account has 2FA-OTP enabled, since error 403 reported.
if [ "${error_code:-0}" -eq 403 ]; then
# https://global.download.synology.com/download/Document/Software/DeveloperGuide/Firmware/DSM/All/enu/Synology_DiskStation_Administration_CLI_Guide.pdf
if [ "$error_code" == "403" ]; then
if [ -z "$SYNO_DeviceName" ]; then
printf "Enter device name or leave empty for default (CertRenewal): "
read -r SYNO_DeviceName
@ -235,18 +249,18 @@ synology_dsm_deploy() {
fi
if [ -n "$error_code" ]; then
if [ "$error_code" -eq 403 ] && [ -n "$SYNO_DeviceID" ]; then
if [ "$error_code" == "403" ] && [ -n "$SYNO_DeviceID" ]; then
_savedeployconf SYNO_DeviceID ""
_err "Failed to authenticate with SYNO_DeviceID (may expired or invalid), please try again in a new terminal window."
elif [ "$error_code" -eq 404 ]; then
elif [ "$error_code" == "404" ]; then
_err "Failed to authenticate with provided 2FA-OTP code, please try again in a new terminal window."
elif [ "$error_code" -eq 406 ]; then
elif [ "$error_code" == "406" ]; then
if [ -n "$SYNO_UseTempAdmin" ]; then
_err "SYNO_UseTempAdmin=1 is not supported if enforce auth with 2FA-OTP is enabled."
else
_err "Enforce auth with 2FA-OTP enabled, please configure the user to enable 2FA-OTP to continue."
fi
elif [ "$error_code" -eq 400 ] || [ "$error_code" -eq 401 ] || [ "$error_code" -eq 408 ] || [ "$error_code" -eq 409 ] || [ "$error_code" -eq 410 ]; then
elif [ "$error_code" == "400" ] || [ "$error_code" == "401" ] || [ "$error_code" == "408" ] || [ "$error_code" == "409" ] || [ "$error_code" == "410" ]; then
_err "Failed to authenticate with a non-existent or disabled account, or the account password is incorrect or has expired."
else
_err "Failed to authenticate with error: $error_code."
@ -313,7 +327,7 @@ synology_dsm_deploy() {
# We've verified this certificate description is a thing, so save it
_savedeployconf SYNO_Certificate "$SYNO_Certificate" "base64"
_info "Generating form POST request.."
_info "Generating form POST request..."
nl="\0015\0012"
delim="--------------------------$(_utc_date | tr -d -- '-: ')"
content="--$delim${nl}Content-Disposition: form-data; name=\"key\"; filename=\"$(basename "$_ckey")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_ckey")\0012"
@ -337,16 +351,16 @@ synology_dsm_deploy() {
if ! echo "$response" | grep '"error":' >/dev/null; then
if echo "$response" | grep '"restart_httpd":true' >/dev/null; then
_info "Restarting HTTP services succeeded..."
_info "Restart HTTP services succeeded."
else
_info "Restarting HTTP services failed."
_info "Restart HTTP services failed."
fi
_temp_admin_cleanup "$SYNO_UseTempAdmin" "$SYNO_Username"
_logout
return 0
else
_temp_admin_cleanup "$SYNO_UseTempAdmin" "$SYNO_Username"
_err "Unable to update certificate, error code $response."
_err "Unable to update certificate, got error response: $response."
_logout
return 1
fi