From 457018b127b90a5ebcd2265ac837b7243019bf00 Mon Sep 17 00:00:00 2001 From: Vasco Date: Sat, 25 Apr 2026 17:28:37 +0100 Subject: [PATCH] www --- TODO.md | 5 +- VM_OPENSSL_APACHE.sh | 10 ++- conf/ssl.conf | 36 +++++++- www/index.html | 155 ++++++++++++++++++++++++++++++++ www/login.html | 204 +++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 403 insertions(+), 7 deletions(-) create mode 100644 www/index.html create mode 100644 www/login.html diff --git a/TODO.md b/TODO.md index af201b3..33713b9 100644 --- a/TODO.md +++ b/TODO.md @@ -2,6 +2,7 @@ ## Goals - [X] Configure a tunnel in the "road warrior" -- [ ] Enable two factor authentication with OpenSSL and Apache services -- [ ] Manage PKI: certification authorities, X.509 certificates, revocation and OCSP. +- [X] Enable two factor authentication with OpenSSL and Apache services +- [X] Manage PKI: certification authorities, X.509 certificates, revocation and OCSP. + diff --git a/VM_OPENSSL_APACHE.sh b/VM_OPENSSL_APACHE.sh index 2b60fba..6da4c76 100644 --- a/VM_OPENSSL_APACHE.sh +++ b/VM_OPENSSL_APACHE.sh @@ -40,7 +40,15 @@ mkdir -p /etc/systemd/system/httpd.service.d echo -e "[Service]\nProtectHome=false" > /etc/systemd/system/httpd.service.d/override.conf systemctl daemon-reload -# serviço !!! +# sim, é preciso fazer isto para carregar serviços +echo "LoadModule session_module modules/mod_session.so" > /etc/httpd/conf.modules.d/01-session.conf +echo "LoadModule session_cookie_module modules/mod_session_cookie.so" >> /etc/httpd/conf.modules.d/01-session.conf +echo "LoadModule auth_form_module modules/mod_auth_form.so" > /etc/httpd/conf.modules.d/01-auth_form.conf + +# mega paginas webs +cp -r www/* /var/www/html/ +chown -R apache:apache /var/www/html/ + systemctl enable --now httpd # acho ????? diff --git a/conf/ssl.conf b/conf/ssl.conf index e91ad41..060f7be 100644 --- a/conf/ssl.conf +++ b/conf/ssl.conf @@ -18,12 +18,40 @@ Listen 443 https SSLOCSPOverrideResponder on SSLOCSPUseRequestNonce off - # PAM + TOTP Authentication + # Session management for Form Auth + Session On + SessionCookieName session path=/;HttpOnly;Secure + + # Protected Area - AuthType Basic - AuthName "Enter UNIX Password + Google Authenticator Code" - AuthBasicProvider PAM + AuthType Form + AuthName "Coimbra VPN" + AuthFormProvider PAM AuthPAMService httpd-totp + AuthFormLoginRequiredLocation "/login.html" Require valid-user + + # Public Login Page + + AuthType None + Require all granted + + + # Login Handler + + SetHandler form-login-handler + AuthType Form + AuthName "Coimbra VPN" + AuthFormProvider PAM + AuthPAMService httpd-totp + AuthFormLoginSuccessLocation "/index.html" + AuthFormLoginRequiredLocation "/login.html?error=1" + + + # Logout Handler + + SetHandler form-logout-handler + AuthFormLogoutLocation "/login.html?loggedout=1" + diff --git a/www/index.html b/www/index.html new file mode 100644 index 0000000..d12eddb --- /dev/null +++ b/www/index.html @@ -0,0 +1,155 @@ + + + + + + Internal Secure Portal - Coimbra VPN + + + +
+
+
+ +
+ +
+ + Securely Authenticated (2FA) +
+ +

Protected Portal Access

+

Welcome to the Coimbra VPN Internal Network. Your identity has been verified via Client Certificate and Two-Factor Authentication (TOTP).

+ + Logout Session +
+
+ + diff --git a/www/login.html b/www/login.html new file mode 100644 index 0000000..e490111 --- /dev/null +++ b/www/login.html @@ -0,0 +1,204 @@ + + + + + + Identity Verification - Coimbra VPN + + + +
+
+ +

Two-Factor Auth

+

Enter your UNIX credentials and TOTP code

+
+ +
Invalid credentials or TOTP code.
+ +
+
+ + +
+ +
+ + +
+ +
+ + +
+ + + + +
+
+ + + +