From 5eab39720040df4b7e78bbe1bcd076b9067bb90c Mon Sep 17 00:00:00 2001
From: Daniel Winzen
Date: Mon, 7 Jan 2019 22:24:21 +0100
Subject: [PATCH] Randomise DB (user)names to reduce attack surface + allow
multiple DBs per user
---
var/www/common.php | 38 ++++++++++++++++++++++++++++++++++++++
var/www/html/home.php | 20 ++++++++++++++------
var/www/html/register.php | 12 +++---------
3 files changed, 55 insertions(+), 15 deletions(-)
diff --git a/var/www/common.php b/var/www/common.php
index 9f1ae36..7ff451a 100644
--- a/var/www/common.php
+++ b/var/www/common.php
@@ -101,6 +101,7 @@ server {
}
}
';
+const MAX_NUM_USER_DBS = 5; //maximum number of databases a user may have
function get_onion_v2($pkey) : string {
$keyData = openssl_pkey_get_details($pkey);
@@ -468,3 +469,40 @@ php_admin_value[session.save_path] = /tmp
exec("service php$version-fpm@$key restart");
}
}
+
+function add_mysql_user(PDO $db, string $password) : string {
+ $mysql_user = '';
+ $stmt = $db->prepare('SELECT null FROM users WHERE mysql_user = ?;');
+ do {
+ $mysql_user = substr(preg_replace('/[^a-z0-9]/i', '', base64_encode(random_bytes(32))), 0, 32);
+ $stmt->execute([$mysql_user]);
+ } while($stmt->fetch());
+ $create_user = $db->prepare("CREATE USER ?@'%' IDENTIFIED BY ?;");
+ $create_user->execute([$mysql_user, $password]);
+ return $mysql_user;
+}
+
+function add_user_db(PDO $db, int $user_id) : ?string {
+ $mysql_db = '';
+ $stmt = $db->prepare('SELECT COUNT(*) FROM mysql_databases WHERE user_id = ?;');
+ $stmt->execute([$user_id]);
+ $count = $stmt->fetch(PDO::FETCH_NUM);
+ if($count[0]>=MAX_NUM_USER_DBS) {
+ return null;
+ }
+ $stmt = $db->prepare('SELECT null FROM mysql_databases WHERE mysql_database = ?;');
+ do {
+ $mysql_db = substr(preg_replace('/[^a-z0-9]/i', '', base64_encode(random_bytes(32))), 0, 32);
+ $stmt->execute([$mysql_db]);
+ } while($stmt->fetch());
+ $stmt = $db->prepare('INSERT INTO mysql_databases (user_id, mysql_database) VALUES (?, ?);');
+ $stmt->execute([$user_id, $mysql_db]);
+ $db->exec("CREATE DATABASE IF NOT EXISTS `" . $mysql_db . "`;");
+ $stmt = $db->prepare('SELECT mysql_user FROM users WHERE id = ?;');
+ $stmt->execute([$user_id]);
+ $user = $stmt->fetch(PDO::FETCH_ASSOC);
+ $stmt=$db->prepare("GRANT ALL PRIVILEGES ON `" . $mysql_db . "`.* TO ?@'%';");
+ $stmt->execute([$user['mysql_user']]);
+ $db->exec('FLUSH PRIVILEGES;');
+ return $mysql_db;
+}
diff --git a/var/www/html/home.php b/var/www/html/home.php
index dcb38c1..c5cc3c3 100644
--- a/var/www/html/home.php
+++ b/var/www/html/home.php
@@ -7,11 +7,14 @@ try{
}
session_start();
$user=check_login();
+if(isset($_REQUEST['action']) && $_REQUEST['action']==='add_db'){
+ add_user_db($db, $user['id']);
+}
if(isset($_REQUEST['action']) && isset($_REQUEST['onion']) && $_REQUEST['action']==='edit'){
- $stmt=$db->prepare('SELECT onions.version FROM onions INNER JOIN users ON (users.id=onions.user_id) WHERE onions.onion=? AND users.id=? AND onions.enabled IN (0, 1);');
+ $stmt=$db->prepare('SELECT onions.version FROM onions INNER JOIN users ON (users.id=onions.user_id) WHERE onions.onion = ? AND users.id = ? AND onions.enabled IN (0, 1);');
$stmt->execute([$_REQUEST['onion'], $user['id']]);
if($onion=$stmt->fetch(PDO::FETCH_NUM)){
- $stmt=$db->prepare('UPDATE onions SET enabled = ?, enable_smtp = ?, num_intros = ?, max_streams = ? WHERE onion=?;');
+ $stmt=$db->prepare('UPDATE onions SET enabled = ?, enable_smtp = ?, num_intros = ?, max_streams = ? WHERE onion = ?;');
$enabled = isset($_REQUEST['enabled']) ? 1 : 0;
$enable_smtp = isset($_REQUEST['enable_smtp']) ? 1 : 0;
$num_intros = intval($_REQUEST['num_intros']);
@@ -29,7 +32,7 @@ if(isset($_REQUEST['action']) && isset($_REQUEST['onion']) && $_REQUEST['action'
$max_streams = 65535;
}
$stmt->execute([$enabled, $enable_smtp, $num_intros, $max_streams, $_REQUEST['onion']]);
- $stmt=$db->prepare('UPDATE service_instances SET reload = 1 WHERE id=?');
+ $stmt=$db->prepare('UPDATE service_instances SET reload = 1 WHERE id = ?');
$stmt->execute([substr($_REQUEST['onion'], 0, 1)]);
}
}
@@ -46,7 +49,7 @@ echo "Enter system account password to check your $user[system_account]@" . A
echo '
Domains
';
echo '';
echo 'Onion | Private key | Enabled | SMTP enabled | Nr. of intros | Max streams per rend circuit | Save |
';
-$stmt=$db->prepare('SELECT onion, private_key, enabled, enable_smtp, num_intros, max_streams FROM onions WHERE user_id=?;');
+$stmt=$db->prepare('SELECT onion, private_key, enabled, enable_smtp, num_intros, max_streams FROM onions WHERE user_id = ?;');
$stmt->execute([$user['id']]);
while($onion=$stmt->fetch(PDO::FETCH_ASSOC)){
echo "';
}
echo '
';
echo 'MySQL Database
';
echo '';
echo 'Database | Host | User |
';
-$stmt=$db->prepare('SELECT mysql_database FROM mysql_databases WHERE user_id=?;');
+$stmt=$db->prepare('SELECT mysql_database FROM mysql_databases WHERE user_id = ?;');
$stmt->execute([$user['id']]);
+$count_dbs = 0;
while($mysql=$stmt->fetch(PDO::FETCH_ASSOC)){
+ ++$count_dbs;
echo "$mysql[mysql_database] | localhost | $user[mysql_user] |
";
}
echo '
';
+if($count_dbs
';
+}
echo 'Change MySQL password
';
echo 'You can use PHPMyAdmin and Adminer for web based database administration.
';
echo 'System Account
';
diff --git a/var/www/html/register.php b/var/www/html/register.php
index 76f29e5..e6050b3 100644
--- a/var/www/html/register.php
+++ b/var/www/html/register.php
@@ -105,19 +105,13 @@ if($_SERVER['REQUEST_METHOD']==='POST'){
echo 'To prevent abuse a site can only be registered every 60 seconds, but one has already been registered within the last 60 seconds. Please try again.
';
$ok=false;
}elseif($ok){
+ $mysql_user = add_mysql_user($db, $_POST['pass']);
$stmt=$db->prepare('INSERT INTO users (username, system_account, password, dateadded, public, php, autoindex, mysql_user) VALUES (?, ?, ?, ?, ?, ?, ?, ?);');
- $stmt->execute([$_POST['username'], substr("$onion.onion", 0, 32), $hash, time(), $public_list, $php, $autoindex, substr("$onion.onion", 0, 32)]);
+ $stmt->execute([$_POST['username'], substr("$onion.onion", 0, 32), $hash, time(), $public_list, $php, $autoindex, $mysql_user]);
$user_id = $db->lastInsertId();
- $stmt=$db->prepare('INSERT INTO mysql_databases (user_id, mysql_database) VALUES (?, ?);');
- $stmt->execute([$user_id, substr($onion, 0, 32)]);
$stmt=$db->prepare('INSERT INTO onions (user_id, onion, private_key, version) VALUES (?, ?, ?, ?);');
$stmt->execute([$user_id, $onion, $priv_key, $onion_version]);
- $create_user=$db->prepare("CREATE USER ?@'%' IDENTIFIED BY ?;");
- $create_user->execute([substr("$onion.onion", 0, 32), $_POST['pass']]);
- $db->exec("CREATE DATABASE IF NOT EXISTS `" . substr($onion, 0, 32) . "`;");
- $stmt=$db->prepare("GRANT ALL PRIVILEGES ON `" . substr($onion, 0, 32) . "`.* TO ?@'%';");
- $stmt->execute([substr("$onion.onion", 0, 32)]);
- $db->exec('FLUSH PRIVILEGES;');
+ add_user_db($db, $user_id);
$stmt=$db->prepare('INSERT INTO new_account (user_id, password) VALUES (?, ?);');
$stmt->execute([$user_id, get_system_hash($_POST['pass'])]);
if(EMAIL_TO!==''){