forked from ungleich-public/ungleich-user
Sajeyks
3e630b53d8
ldap3 does not verify TLS certificates by default, and the app never configured it to. ldaps:// and StartTLS were encrypted but accepted any certificate, so anyone able to intercept LDAP traffic could pose as the server and collect the admin password and every password used to log in. All LDAP servers now use VerifiedTls, which leaves verification to Python's ssl module: certificate chain and hostname, IP literals included (ldap3's own matcher cannot handle IPv6 literals). It also sends SNI and requires TLS 1.2 or newer. LDAP_CA_FILE adds a CA bundle for a private CA. LDAP_TLS_VERIFY=False turns verification off, with a logged warning. A failed StartTLS now always raises instead of continuing in plaintext. New tests against the dev LDAP cover ldaps, StartTLS and ldaps over an IPv6 literal with the CA (and check the socket is encrypted), plain LDAP over IPv6, rejection of an untrusted certificate (ldaps and StartTLS), rejection of a hostname mismatch, and the opt-out.
71 lines
3.4 KiB
Text
71 lines
3.4 KiB
Text
# Configuration for the ungleich account webapp.
|
|
#
|
|
# Every setting is an environment variable. In development, copy this file
|
|
# (or dev/env.dev) to .env in the repository root. In Kubernetes, values
|
|
# marked [secret] go in a Secret and the rest in a ConfigMap.
|
|
#
|
|
# Required unless a default is shown.
|
|
|
|
# --- Django -----------------------------------------------------------------
|
|
SECRET_KEY="" # [secret] long random string
|
|
ALLOWED_HOSTS="account.ungleich.ch" # comma separated
|
|
DEBUG=False
|
|
LOG_LEVEL=INFO # root log level; output goes to stdout
|
|
#DJANGO_LOG_LEVEL=INFO
|
|
#LDAP3_LOG=False # ldap3 protocol logging (very verbose)
|
|
|
|
# --- HTTPS / proxy ------------------------------------------------------------
|
|
#TRUST_X_FORWARDED_PROTO=False # True behind a TLS-terminating ingress
|
|
#CSRF_TRUSTED_ORIGINS="" # comma separated, e.g. https://account.ungleich.ch
|
|
#SESSION_COOKIE_SECURE= # default: True unless DEBUG
|
|
#CSRF_COOKIE_SECURE= # default: True unless DEBUG
|
|
#SECURE_SSL_REDIRECT=False # usually done by the ingress
|
|
#SECURE_HSTS_SECONDS=0 # read Django's HSTS docs before raising
|
|
|
|
# --- Database -----------------------------------------------------------------
|
|
# Sessions, reset tokens and pending registrations. Set DATABASE_HOST to use
|
|
# PostgreSQL (required for more than one replica); otherwise SQLite is used.
|
|
#DATABASE_HOST=""
|
|
#DATABASE_PORT=5432
|
|
#DATABASE_NAME=ungleich_user
|
|
#DATABASE_USER=ungleich_user
|
|
#DATABASE_PASSWORD="" # [secret]
|
|
#DATABASE_SSLMODE=prefer
|
|
#DATABASE_CONN_MAX_AGE=60
|
|
#SQLITE_PATH=./db.sqlite3 # only without DATABASE_HOST
|
|
|
|
# --- LDAP -------------------------------------------------------------------
|
|
# Space separated; the first reachable server is used (failover).
|
|
LDAPSERVER="ldap://ldap1.ungleich.ch ldap://ldap2.ungleich.ch"
|
|
#LDAP_USE_TLS=False # StartTLS on every connection
|
|
#LDAP_TLS_VERIFY=True # verify server certificates (ldaps:// and StartTLS)
|
|
#LDAP_CA_FILE="" # CA bundle for a private CA; default: system store
|
|
LDAP_ADMIN_DN="" # DN with write access to customers
|
|
LDAP_ADMIN_PASSWORD="" # [secret]
|
|
|
|
# Users log in from any of these (space separated) search bases.
|
|
LDAPSEARCH="ou=customers,dc=ungleich,dc=ch ou=users,dc=ungleich,dc=ch"
|
|
# Usernames and uidNumbers must be unique below this base.
|
|
ENTIRE_SEARCH_BASE="dc=ungleich,dc=ch"
|
|
# New registrations are created here.
|
|
LDAP_CUSTOMER_DN="ou=customers,dc=ungleich,dc=ch"
|
|
LDAP_CUSTOMER_GROUP_ID= # gidNumber for new customers
|
|
LDAP_DEFAULT_START_UID= # new uidNumbers are always above this
|
|
|
|
# --- Email ------------------------------------------------------------------
|
|
EMAIL_FROM_ADDRESS=""
|
|
#EMAIL_HOST=localhost
|
|
#EMAIL_PORT=25
|
|
#EMAIL_USE_TLS=True
|
|
#EMAIL_HOST_USER=""
|
|
#EMAIL_HOST_PASSWORD="" # [secret]
|
|
#EMAIL_TIMEOUT=10
|
|
|
|
# --- OTP server -------------------------------------------------------------
|
|
OTPSERVER="" # base URL of the OTP API
|
|
ADMIN_NAME=""
|
|
ADMIN_REALM=""
|
|
ADMIN_SEED="" # [secret] base32 TOTP seed of ADMIN_NAME
|
|
USER_REALM="" # realm for seeds of new users
|
|
ALLOWED_REALMS="" # comma separated realms users may request
|
|
#OTP_TIMEOUT=10 # seconds per request to the OTP server
|