github
/
jumpserver
mirror of https://github.com/jumpserver/jumpserver
1
0
Fork 0
Code Issues Releases Wiki Activity

feat: 增加系统设置(安全)控制第三方认证用户是否进行MFA认证

pull/7584/head
Michael Bai 2022-02-08 17:33:18 +08:00 committed by 老广
parent 6adeafd1d2
commit 8085db7acc
6 changed files with 63 additions and 46 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
apps/authentication/signals_handlers.py
View File

@ -17,7 +17,9 @@ from .signals import post_auth_success, post_auth_failed
@receiver(user_logged_in)
def on_user_auth_login_success(sender, user, request, **kwargs):
# 开启了 MFA，且没有校验过, 可以全局校验, middleware 中可以全局管理 oidc 等第三方认证的 MFA
if user.mfa_enabled and not request.session.get('auth_mfa'):
if settings.SECURITY_MFA_AUTH_ENABLED_FOR_THIRD_PARTY \
and user.mfa_enabled \
and not request.session.get('auth_mfa'):
request.session['auth_mfa_required'] = 1
# 单点登录，超过了自动退出

1
apps/jumpserver/conf.py
View File

@ -312,6 +312,7 @@ class Config(dict):
# 安全配置
'SECURITY_MFA_AUTH': 0, # 0 不开启 1 全局开启 2 管理员开启
'SECURITY_MFA_AUTH_ENABLED_FOR_THIRD_PARTY': True,
'SECURITY_COMMAND_EXECUTION': True,
'SECURITY_SERVICE_ACCOUNT_REGISTRATION': True,
'SECURITY_VIEW_AUTH_NEED_MFA': True,

1
apps/jumpserver/settings/custom.py
View File

@ -32,6 +32,7 @@ TERMINAL_REPLAY_STORAGE = CONFIG.TERMINAL_REPLAY_STORAGE
# Security settings
SECURITY_MFA_AUTH = CONFIG.SECURITY_MFA_AUTH
SECURITY_MFA_AUTH_ENABLED_FOR_THIRD_PARTY = CONFIG.SECURITY_MFA_AUTH_ENABLED_FOR_THIRD_PARTY
SECURITY_MAX_IDLE_TIME = CONFIG.SECURITY_MAX_IDLE_TIME # Unit: minute
SECURITY_COMMAND_EXECUTION = CONFIG.SECURITY_COMMAND_EXECUTION
SECURITY_PASSWORD_EXPIRATION_TIME = CONFIG.SECURITY_PASSWORD_EXPIRATION_TIME # Unit: day

4
apps/locale/zh/LC_MESSAGES/django.mo
View File

@ -1,3 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:39ab4c9155d1dfdd83f8c8037a70af28bcf06d2a75fd129fe77edab2f761ea5f
size 97367
oid sha256:8a421482ff4103a9c3ca895b29e739c2cef0dc10a4f9914bfe7226fa3c45cac4
size 97592

94
apps/locale/zh/LC_MESSAGES/django.po
View File

@ -7,7 +7,7 @@ msgid ""
msgstr ""
"Project-Id-Version: JumpServer 0.3.3\n"
"Report-Msgid-Bugs-To: \n"
"POT-Creation-Date: 2022-02-08 11:43+0800\n"
"POT-Creation-Date: 2022-02-08 17:40+0800\n"
"PO-Revision-Date: 2021-05-20 10:54+0800\n"
"Last-Translator: ibuler <ibuler@qq.com>\n"
"Language-Team: JumpServer team<ibuler@qq.com>\n"
@ -825,11 +825,11 @@ msgstr "忽略大小写"
msgid "Command filter rule"
msgstr "命令过滤规则"
#: assets/models/cmd_filter.py:141
#: assets/models/cmd_filter.py:144
msgid "The generated regular expression is incorrect: {}"
msgstr "生成的正则表达式有误"
#: assets/models/cmd_filter.py:167 tickets/const.py:13
#: assets/models/cmd_filter.py:170 tickets/const.py:13
msgid "Command confirm"
msgstr "命令复核"
@ -3525,34 +3525,42 @@ msgid "Global MFA auth"
msgstr "全局启用 MFA 认证"
#: settings/serializers/security.py:47
msgid "Third-party login users perform MFA authentication"
msgstr "第三方登录用户进行MFA认证"
#: settings/serializers/security.py:48
msgid "The third-party login modes include OIDC, CAS, and SAML2"
msgstr "第三方登录方式包括: OIDC、CAS、SAML2"
#: settings/serializers/security.py:52
msgid "Limit the number of user login failures"
msgstr "限制用户登录失败次数"
#: settings/serializers/security.py:51
#: settings/serializers/security.py:56
msgid "Block user login interval"
msgstr "禁止用户登录时间间隔"
#: settings/serializers/security.py:56
#: settings/serializers/security.py:61
msgid "Limit the number of IP login failures"
msgstr "限制 IP 登录失败次数"
#: settings/serializers/security.py:60
#: settings/serializers/security.py:65
msgid "Block IP login interval"
msgstr "禁止 IP 登录时间间隔"
#: settings/serializers/security.py:64
#: settings/serializers/security.py:69
msgid "Login IP White List"
msgstr "IP 登录白名单"
#: settings/serializers/security.py:69
#: settings/serializers/security.py:74
msgid "Login IP Black List"
msgstr "IP 登录黑名单"
#: settings/serializers/security.py:75
#: settings/serializers/security.py:80
msgid "User password expiration"
msgstr "用户密码过期时间"
#: settings/serializers/security.py:77
#: settings/serializers/security.py:82
msgid ""
"Unit: day, If the user does not update the password during the time, the "
"user password will expire failure;The password expiration reminder mail will "
@ -3562,55 +3570,55 @@ msgstr ""
"单位：天, 如果用户在此期间没有更新密码，用户密码将过期失效； 密码过期提醒邮件"
"将在密码过期前5天内由系统（每天）自动发送给用户"
#: settings/serializers/security.py:84
#: settings/serializers/security.py:89
msgid "Number of repeated historical passwords"
msgstr "不能设置近几次密码"
#: settings/serializers/security.py:86
#: settings/serializers/security.py:91
msgid ""
"Tip: When the user resets the password, it cannot be the previous n "
"historical passwords of the user"
msgstr "提示：用户重置密码时，不能为该用户前几次使用过的密码"
#: settings/serializers/security.py:91
#: settings/serializers/security.py:96
msgid "Only single device login"
msgstr "仅一台设备登录"
#: settings/serializers/security.py:92
#: settings/serializers/security.py:97
msgid "Next device login, pre login will be logout"
msgstr "下个设备登录，上次登录会被顶掉"
#: settings/serializers/security.py:95
#: settings/serializers/security.py:100
msgid "Only exist user login"
msgstr "仅已存在用户登录"
#: settings/serializers/security.py:96
#: settings/serializers/security.py:101
msgid "If enable, CAS、OIDC auth will be failed, if user not exist yet"
msgstr "开启后，如果系统中不存在该用户，CAS、OIDC 登录将会失败"
#: settings/serializers/security.py:99
#: settings/serializers/security.py:104
msgid "Only from source login"
msgstr "仅从用户来源登录"
#: settings/serializers/security.py:100
#: settings/serializers/security.py:105
msgid "Only log in from the user source property"
msgstr "开启后，如果用户来源为本地，CAS、OIDC 登录将会失败"
#: settings/serializers/security.py:104
#: settings/serializers/security.py:109
msgid "MFA verify TTL"
msgstr "MFA 校验有效期"
#: settings/serializers/security.py:106
#: settings/serializers/security.py:111
msgid ""
"Unit: second, The verification MFA takes effect only when you view the "
"account password"
msgstr "单位: 秒, 目前仅在查看账号密码校验 MFA 时生效"
#: settings/serializers/security.py:111
#: settings/serializers/security.py:116
msgid "Enable Login dynamic code"
msgstr "启用登录附加码"
#: settings/serializers/security.py:112
#: settings/serializers/security.py:117
msgid ""
"The password and additional code are sent to a third party authentication "
"system for verification"
@ -3618,89 +3626,89 @@ msgstr ""
"密码和附加码一并发送给第三方认证系统进行校验, 如：有的第三方认证系统，需要 密"
"码+6位数字 完成认证"
#: settings/serializers/security.py:117
#: settings/serializers/security.py:122
msgid "MFA in login page"
msgstr "MFA 在登录页面输入"
#: settings/serializers/security.py:118
#: settings/serializers/security.py:123
msgid "Eu security regulations(GDPR) require MFA to be on the login page"
msgstr "欧盟数据安全法规(GDPR) 要求 MFA 在登录页面，来确保系统登录安全"
#: settings/serializers/security.py:121
#: settings/serializers/security.py:126
msgid "Enable Login captcha"
msgstr "启用登录验证码"
#: settings/serializers/security.py:122
#: settings/serializers/security.py:127
msgid "Enable captcha to prevent robot authentication"
msgstr "开启验证码，防止机器人登录"
#: settings/serializers/security.py:142
#: settings/serializers/security.py:147
msgid "Enable terminal register"
msgstr "终端注册"
#: settings/serializers/security.py:144
#: settings/serializers/security.py:149
msgid ""
"Allow terminal register, after all terminal setup, you should disable this "
"for security"
msgstr "是否允许终端注册，当所有终端启动后，为了安全应该关闭"
#: settings/serializers/security.py:148
#: settings/serializers/security.py:153
msgid "Enable watermark"
msgstr "开启水印"
#: settings/serializers/security.py:149
#: settings/serializers/security.py:154
msgid "Enabled, the web session and replay contains watermark information"
msgstr "启用后，Web 会话和录像将包含水印信息"
#: settings/serializers/security.py:153
#: settings/serializers/security.py:158
msgid "Connection max idle time"
msgstr "连接最大空闲时间"
#: settings/serializers/security.py:154
#: settings/serializers/security.py:159
msgid "If idle time more than it, disconnect connection Unit: minute"
msgstr "提示：如果超过该配置没有操作，连接会被断开 （单位：分）"
#: settings/serializers/security.py:157
#: settings/serializers/security.py:162
msgid "Remember manual auth"
msgstr "保存手动输入密码"
#: settings/serializers/security.py:160
#: settings/serializers/security.py:165
msgid "Enable change auth secure mode"
msgstr "启用改密安全模式"
#: settings/serializers/security.py:163
#: settings/serializers/security.py:168
msgid "Insecure command alert"
msgstr "危险命令告警"
#: settings/serializers/security.py:166
#: settings/serializers/security.py:171
msgid "Email recipient"
msgstr "邮件收件人"
#: settings/serializers/security.py:167
#: settings/serializers/security.py:172
msgid "Multiple user using , split"
msgstr "多个用户，使用 , 分割"
#: settings/serializers/security.py:170
#: settings/serializers/security.py:175
msgid "Batch command execution"
msgstr "批量命令执行"
#: settings/serializers/security.py:171
#: settings/serializers/security.py:176
msgid "Allow user run batch command or not using ansible"
msgstr "是否允许用户使用 ansible 执行批量命令"
#: settings/serializers/security.py:174
#: settings/serializers/security.py:179
msgid "Session share"
msgstr "会话分享"
#: settings/serializers/security.py:175
#: settings/serializers/security.py:180
msgid "Enabled, Allows user active session to be shared with other users"
msgstr "开启后允许用户分享已连接的资产会话给它人，协同工作"
#: settings/serializers/security.py:178
#: settings/serializers/security.py:183
msgid "Remote Login Protection"
msgstr "异地登录保护"
#: settings/serializers/security.py:180
#: settings/serializers/security.py:185
msgid ""
"The system determines whether the login IP address belongs to a common login "
"city. If the account is logged in from a common login city, the system sends "

5
apps/settings/serializers/security.py
View File

@ -42,6 +42,11 @@ class SecurityAuthSerializer(serializers.Serializer):
),
required=False, label=_("Global MFA auth")
)
SECURITY_MFA_AUTH_ENABLED_FOR_THIRD_PARTY = serializers.BooleanField(
required=False, default=True,
label=_('Third-party login users perform MFA authentication'),
help_text=_('The third-party login modes include OIDC, CAS, and SAML2'),
)
SECURITY_LOGIN_LIMIT_COUNT = serializers.IntegerField(
min_value=3, max_value=99999,
label=_('Limit the number of user login failures')