dokuwiki-stretch

#Démarrage
VBoxManage startvm "DebianStretch" --type headless
alias jstart='VBoxManage startvm "DebianStretch" --type headless' # ajout au fichier ~/.bashrc

#Arrêt
VBoxManage controlvm "DebianStretch" poweroff
alias jstop='VBoxManage controlvm "DebianStretch" poweroff' # ajout au fichier ~/.bashrc

ssh usera@192.168.0.11

su

apt install sudo

echo "usera     ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers

PHP 7.0.19-1 (cli) (built: May 11 2017 14:04:47) ( NTS )
Copyright (c) 1997-2017 The PHP Group
Zend Engine v3.0.0, Copyright (c) 1998-2017 Zend Technologies
    with Zend OPcache v7.0.19-1, Copyright (c) 1999-2017, by Zend Technologies

mysql  Ver 15.1 Distrib 10.1.26-MariaDB, for debian-linux-gnu (x86_64) using readline 5.2

location /secure {
    auth_pam              "Secure Zone";
    auth_pam_service_name "nginx";
}

wget https://storage.googleapis.com/golang/go1.8.3.linux-amd64.tar.gz
sudo tar -xvf go1.8.3.linux-amd64.tar.gz
sudo mv go /usr/local
# variables à ajouter au fichier ~/.profile
export GOROOT=/usr/local/go
export GOPATH=$HOME/nginx-sso
export PATH=$GOPATH/bin:$GOROOT/bin:$PATH

go version go1.8.3 linux/amd64

GOARCH="amd64"
GOBIN=""
GOEXE=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/home/usera/nginx-sso"
GORACE=""
GOROOT="/usr/local/go"
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
CC="gcc"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build634920677=/tmp/go-build -gno-record-gcc-switches"
CXX="g++"
CGO_ENABLED="1"
PKG_CONFIG="pkg-config"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"

cd /home/usera
git clone https://github.com/heipei/nginx-sso.git
cd nginx-sso/
make
go get github.com/sirupsen/logrus
make
mv src/github.com/sirupsen/ src/github.com/Sirupsen/
make
go get github.com/heipei/nginx-sso/ssocookie
make
go get github.com/mattn/go-sqlite3
make
go build ssologin.go

server {
    listen 80;
    listen [::]:80;
    server_name test.domain.dev;
    root /var/www/ ;

    index index.php index.html index.htm;
        location ~ \.php$ {
           fastcgi_split_path_info ^(.+\.php)(/.+)$;
           # fastcgi_pass unix:/var/run/php5-fpm.sock;    # PHP5
           fastcgi_pass unix:/run/php/php7.0-fpm.sock;    # PHP7.0 
           # fastcgi_pass unix:/run/php/php7.1-fpm.sock   # PHP7.1
           fastcgi_index index.php;
           include fastcgi_params;
	   fastcgi_param SCRIPT_FILENAME $request_filename;
        }


}
	server {
		server_name secret.domain.dev;
		listen 8080;

		# It has one /auth URI which is the endpoint that protected
		# resources have to query. The /auth endpoint does not need the
		# request_body, but it obviously needs the IP, Host and
		# original URI for the request.
		location = /auth {
			internal;

			proxy_pass http://127.0.0.1:8082;

			proxy_pass_request_body     off;

			proxy_set_header Content-Length "";
			proxy_set_header X-Original-URI $request_uri;
			proxy_set_header Host $http_host;
			proxy_set_header X-Real-IP $remote_addr;

		}

		# This is an example of a protected resource. The first line
		# should be auth_request. If you want to pass the headers from
		# the authentication backend to your application (Remote-User
		# etc), you'll have to include the lines with auth_request_set
		# and proxy_set header. 
		location /secret {
			auth_request /auth;

			auth_request_set $user $upstream_http_remote_user;
			proxy_set_header Remote-User $user;
			auth_request_set $groups $upstream_http_remote_groups;
			proxy_set_header Remote-Groups $groups;
			auth_request_set $expiry $upstream_http_remote_expiry;
			proxy_set_header Remote-Expiry $expiry;

			return 200 "Open Sesame!";
			#proxy_pass http://127.0.0.1:52342;
		}

	}

	# This is the vserver for your login service
	server {
		server_name login.domain.dev;
		listen 8080 default_server;

		# The login endpoint also needs the Host and real IP of the
		# client to build the sso cookie.
		location /login {
                        auth_pam    "Secure Zone";
                        auth_pam_service_name   "nginx";
			proxy_set_header X-Original-URI $request_uri;
			proxy_set_header Host $http_host;
			proxy_set_header X-Real-IP $remote_addr;
			proxy_pass http://127.0.0.1:8081;

		}
	}

username    password    groups    
----------  ----------  ----------
yann        yann49                

-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIHQcrabk3e+RA5B9KKrRLvygQUUN4lIvs95DK3perLbhoAoGCCqGSM49
AwEHoUQDQgAEoJ4rRAM8YxhBnIpb0Q9lls7ybv0kRcolPRomEjesdcB7wgzRYDEt
sRaTP9tqfSgTm3fBiN57CxZVQ6eBEfy0AQ==
-----END EC PRIVATE KEY-----

-----BEGIN EC PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEoJ4rRAM8YxhBnIpb0Q9lls7ybv0k
RcolPRomEjesdcB7wgzRYDEtsRaTP9tqfSgTm3fBiN57CxZVQ6eBEfy0AQ==
-----END EC PUBLIC KEY-----

-----BEGIN EC PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEoJ4rRAM8YxhBnIpb0Q9lls7ybv0k
RcolPRomEjesdcB7wgzRYDEtsRaTP9tqfSgTm3fBiN57CxZVQ6eBEfy0AQ==
-----END EC PUBLIC KEY-----

-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIHQcrabk3e+RA5B9KKrRLvygQUUN4lIvs95DK3perLbhoAoGCCqGSM49
AwEHoUQDQgAEoJ4rRAM8YxhBnIpb0Q9lls7ybv0kRcolPRomEjesdcB7wgzRYDEt
sRaTP9tqfSgTm3fBiN57CxZVQ6eBEfy0AQ==
-----END EC PRIVATE KEY-----

usera@vboxdeb:~/nginx-sso$ cat etc/ssoauth.json
{
	"cookie": "sso",
	"debug": true,
	"pubkeyfile": "run/prime256v1-public.pem",
	"headers": {
		"ip": "X-Real-Ip",
		"uri": "X-Original-Uri"
	},
	"returnheaders": {
		"user": "Remote-User",
		"groups": "Remote-Groups",
		"expiry": "Remote-Expiry"
	},
	"port": 8082,
	"acl": {
		"auth.domain.dev:8080": {
			"Users": ["jg123456"],
			"Groups": ["x:"],
			"UrlPrefixes": {
				"/secret/": {
					"Users": ["jg666666"],
					"Groups": ["y:engineering:cloud"]
				}
			}
		}
	}
}

INFO[0000] ssoauth starting                             
DEBU[0000] Public key:
-----BEGIN EC PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEoJ4rRAM8YxhBnIpb0Q9lls7ybv0k
RcolPRomEjesdcB7wgzRYDEtsRaTP9tqfSgTm3fBiN57CxZVQ6eBEfy0AQ==
-----END EC PUBLIC KEY-----
 
DEBU[0000] Read ECC public key from run/prime256v1-public.pem 
INFO[0000] ssoauth server running on 127.0.0.1:8082     

usera@vboxdeb:~/nginx-sso$ cat etc/ssologin.json 
{
	"cookie": "sso",
	"debug": false,
	"secure": false,
	"expiration": 3600,
	"domain": ".domain.dev",
	"privkeyfile": "run/prime256v1-key.pem",
	"headers": {
		"ip": "X-Real-Ip",
		"uri": "X-Original-Uri"
	},
	"port": 8081
}

INFO[0000] ssologin starting                            
INFO[0000] ssologin server running on 127.0.0.1:8081    

*   Trying 192.168.0.11...
* TCP_NODELAY set
* Connected to login.domain.dev (192.168.0.11) port 8080 (#0)
* Server auth using Basic with user 'yann'
> GET /login HTTP/1.1
> Host: login.domain.dev:8080
> Authorization: Basic eWFubjp5YW5uNDk=
> User-Agent: curl/7.55.1
> Accept: */*
> 
< HTTP/1.1 200 OK
< Server: nginx/1.13.5
< Date: Sat, 16 Sep 2017 08:11:08 GMT
< Content-Type: text/plain; charset=utf-8
< Content-Length: 25
< Connection: keep-alive
< Set-Cookie: sso=%7B%22R%22%3A40793564329734296575681372593984674445032360946321672191631800730805894913803%2C%22S%22%3A94833192066600614578429001238291441797514257228853836547717561132152092937581%2C%22E%22%3A1505553068%2C%22P%22%3A%7B%22U%22%3A%22yann%22%2C%22G%22%3A%22users%22%7D%7D; Domain=domain.dev; Expires=Sat, 16 Sep 2017 09:11:08 GMT
< 
You have been logged in!
* Connection #0 to host login.domain.dev left intact

*   Trying 192.168.0.11...
* TCP_NODELAY set
* Connected to secret.domain.dev (192.168.0.11) port 8080 (#0)
> GET /secret HTTP/1.1
> Host: secret.domain.dev:8080
> User-Agent: curl/7.55.1
> Accept: */*
> 
< HTTP/1.1 200 OK
< Server: nginx/1.13.5
< Date: Sat, 16 Sep 2017 08:13:37 GMT
< Content-Type: text/plain
< Content-Length: 12
< Connection: keep-alive
< 
* Connection #0 to host secret.domain.dev left intact
Open Sesame!

Hash Results
Test String:
	yannick49
Crypt Hash Value:
	$1$imBCDMto$/hMSwKk/efClEbdPDUojN/
MD5 Hash Value:
	47f47402cfed6c8f3d058dd93fb3f7ef
SHA1 Hash Value:
	c107559c59960a2340913287fd386c7c1c2aa92b

use utilisateurs;

CREATE TABLE users (
id INT(6) UNSIGNED AUTO_INCREMENT PRIMARY KEY,
username VARCHAR(30) NOT NULL,
password VARCHAR(255) NOT NULL,
email VARCHAR(50),
reg_date TIMESTAMP
);

<!DOCTYPE html>
<html>
	<head>
	<title>Exemple - Mot de passe</title>
	</head>
	<body>
	<h2>Enregistrement</h2>
	<form action="register.php" method="POST">
		<label>Identifiant :</label>
		<input type="text" name="username" required /><br /><br />
		<label>Mot de passe :</label>
		<input type="password" name="password" required /><br /><br />
		<label>Retapez mot de passe :</label>
		<input type="password" name="password2" required /><br /><br />
		<input type="submit" />
	</form>
	<br /><hr />
	<h2>Connexion</h2>
	<form action="login.php" method="POST">
		<label>Identifiant :</label>
		<input type="text" name="username" required /><br /><br />
		<label>Mot de passe :</label>
		<input type="password" name="password" required /><br /><br />
		<input type="submit" />
	</form>
	</body>
</html>

<?php
//Connexion à la base de données
//(via PDO, utilisez la méthode de votre choix comme le type de base de données de votre choix)
$pdo = new PDO(
    'mysql:host=localhost;dbname=utilisateurs', 'utilisateurs', 'm9pB26Fd');
	
//On vérifie que l'utilisateur a bien envoyé les informations demandées 
if(isset($_POST["username"]) && isset($_POST["password"]) && isset($_POST["password2"])){
	//On vérifie que password et password2 sont identiques
	if($_POST["password"] == $_POST["password2"]){
		//On utilise alors notre fonction password_hash :
		$hash = password_hash($_POST["password"], PASSWORD_DEFAULT);
		//Puis on stock le résultat dans la base de données :
		$query = $pdo->prepare('INSERT INTO users (username, password) VALUES(:username, :password);');
		$query->bindParam(':username', $_POST["username"], PDO::PARAM_STR, 30);
		$query->bindParam(':password', $hash, PDO::PARAM_STR, 255);
		$query->execute();
		header('Location: index.php');
		exit();
	}
}
?>

<?php
//Connexion à la base de données
//(via PDO, utilisez la méthode de votre choix comme le type de base de données de votre choix)
$pdo = new PDO(
    'mysql:host=localhost;dbname=utilisateurs', 'utilisateurs', 'm9pB26Fd');
	
//Nous vérifions que l'utilisateur a bien envoyé les informations demandées 
if(isset($_POST["username"]) && isset($_POST["password"])){
	//Nous allons demander le hash pour cet utilisateur à notre base de données :
	$query = $pdo->prepare('SELECT password FROM users WHERE username = :username');
	$query->bindParam(':username', $_POST["username"], PDO::PARAM_STR, 30);
	$query->execute();
	$result = $query->fetch();
	$hash = $result[0];
	
	//Nous vérifions si le mot de passe utilisé correspond bien à ce hash à l'aide de password_verify :
	$correctPassword = password_verify($_POST["password"], $hash);
	
	if($correctPassword){
		//Si oui nous accueillons l'utilisateur identifié
		echo "Bienvenu ".$_POST["username"];
	}else{
		//Sinon nous signalons une erreur d'identifiant ou de mot de passe
                echo "le hash lu dans la base : ".$hash."\n";
		echo "login/password incorrect";
	}
}
?>

#!/usr/bin/php
<?php
//Connexion à la base de données
//(via PDO, utilisez la méthode de votre choix comme le type de base de données de votre choix)
$user="yannick";
$pass="yannick49";
$pdo = new PDO(
    'mysql:host=localhost;dbname=utilisateurs', 'utilisateurs', 'm9pB26Fd');
	
		//On utilise alors notre fonction password_hash :
		$hash = password_hash($pass, PASSWORD_DEFAULT);
		echo "hash : ".$hash."\n";
		//Puis on stock le résultat dans la base de données :
		$query = $pdo->prepare('INSERT INTO users (username, password) VALUES(:username, :password);');
		$query->bindParam(':username', $user);
		$query->bindParam(':password', $hash);
		$query->execute();
?>