@@ -3269,6 +3270,26 @@
saveAs(new Blob([ Uint8Array.from(atob(message.file), function (c) { return c.charCodeAt(0) }) ], { type: 'application/octet-stream' }), 'setup.bin');
break;
}
+ case 'previousLogins':{
+ if ((xxdialogMode == 2) && (xxdialogTag == 'previousLogins')) {
+ var x = '', c = 'BBB', xx = '';
+ if (message.events.length == 0) {
+ x += 'No previous login.';
+ } else {
+ x += '
';
+ for (var i in message.events) {
+ var m = message.events[i].m;
+ if (m == 107) { m = "Valid login"; c = 'BBD1BB'; xx = ''; }
+ else if (m == 108) { m = "Invalid password"; c ='E1BBBB'; xx = 'x'; }
+ else if (m == 110) { m = "Invalid 2FA"; c = 'DD9DC3'; xx = 'x'; }
+ x += ' | ' + printDateTime(new Date(message.events[i].t)) + ', ' + EscapeHtml(m) + ' ' + EscapeHtml(message.events[i].a.join(', ')) + ' |
';
+ }
+ x += '
';
+ }
+ setDialogMode(2, "Previous Logins", 1, null, x);
+ }
+ break;
+ }
default:
//console.log('Unknown message.action', message.action);
break;
@@ -9607,6 +9628,12 @@
// MY ACCOUNT
//
+ function account_viewPreviousLogins() {
+ if (xxdialogMode) return;
+ setDialogMode(2, "Previous Logins", 1, null, "Loading...", 'previousLogins');
+ meshserver.send({ action: 'previousLogins' });
+ }
+
function account_managePhone() {
if (xxdialogMode || ((features & 0x02000000) == 0)) return;
var x;
@@ -11575,7 +11602,11 @@
103: "Batch upload of {0} file(s) to folder {1}",
104: "Automated download of agent core dump file: \"{0}\"",
105: "Upload: \"{0}\", Size: {1}",
- 106: "Download: \"{0}\", Size: {1}"
+ 106: "Download: \"{0}\", Size: {1}",
+ 107: "Account login from {0}, {1}, {2}",
+ 108: "User login attempt with incorrect 2nd factor from {0}, {1}, {2}",
+ 109: "User login attempt on locked account from {0}, {1}, {2}",
+ 110: "Invalid user login attempt from {0}, {1}, {2}"
};
// Highlights the device being hovered
diff --git a/webserver.js b/webserver.js
index aa5008f2..796ab6dc 100644
--- a/webserver.js
+++ b/webserver.js
@@ -52,6 +52,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
obj.meshIderHandler = require('./amt/amt-ider.js');
obj.meshUserHandler = require('./meshuser.js');
obj.interceptor = require('./interceptor');
+ obj.uaparser = require('./ua-parser');
const constants = (obj.crypto.constants ? obj.crypto.constants : require('constants')); // require('constants') is deprecated in Node 11.10, use require('crypto').constants instead.
// Setup WebAuthn / FIDO2
@@ -960,7 +961,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
req.session.messageid = 108; // Invalid token, try again.
if (obj.parent.authlog) { obj.parent.authLog('https', 'Failed 2FA for ' + xusername + ' from ' + cleanRemoteAddr(req.clientIp) + ' port ' + req.port); }
parent.debug('web', 'handleLoginRequest: invalid 2FA token');
- obj.parent.DispatchEvent(['*', 'server-users', user._id], obj, { action: 'authfail', username: user.name, userid: user._id, domain: domain.id, msg: 'User login attempt with incorrect 2nd factor from ' + req.clientIp });
+ const ua = getUserAgentInfo(req);
+ obj.parent.DispatchEvent(['*', 'server-users', user._id], obj, { action: 'authfail', username: user.name, userid: user._id, domain: domain.id, msg: 'User login attempt with incorrect 2nd factor from ' + req.clientIp, msgid: 108, msgArgs: [req.clientIp, ua.browserStr, ua.osStr] });
obj.setbadLogin(req);
} else {
parent.debug('web', 'handleLoginRequest: 2FA token required');
@@ -1034,12 +1036,14 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
if (err == 'locked') {
parent.debug('web', 'handleLoginRequest: login failed, locked account');
req.session.messageid = 110; // Account locked.
- obj.parent.DispatchEvent(['*', 'server-users', xuserid], obj, { action: 'authfail', userid: xuserid, username: xusername, domain: domain.id, msg: 'User login attempt on locked account from ' + req.clientIp });
+ const ua = getUserAgentInfo(req);
+ obj.parent.DispatchEvent(['*', 'server-users', xuserid], obj, { action: 'authfail', userid: xuserid, username: xusername, domain: domain.id, msg: 'User login attempt on locked account from ' + req.clientIp, msgid: 109, msgArgs: [req.clientIp, ua.browserStr, ua.osStr] });
obj.setbadLogin(req);
} else {
parent.debug('web', 'handleLoginRequest: login failed, bad username and password');
req.session.messageid = 112; // Login failed, check username and password.
- obj.parent.DispatchEvent(['*', 'server-users', xuserid], obj, { action: 'authfail', userid: xuserid, username: xusername, domain: domain.id, msg: 'Invalid user login attempt from ' + req.clientIp });
+ const ua = getUserAgentInfo(req);
+ obj.parent.DispatchEvent(['*', 'server-users', xuserid], obj, { action: 'authfail', userid: xuserid, username: xusername, domain: domain.id, msg: 'Invalid user login attempt from ' + req.clientIp, msgid: 110, msgArgs: [req.clientIp, ua.browserStr, ua.osStr] });
obj.setbadLogin(req);
}
}
@@ -1078,9 +1082,11 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
obj.db.SetUser(user);
// Notify account login
- var targets = ['*', 'server-users'];
+ const targets = ['*', 'server-users'];
if (user.groups) { for (var i in user.groups) { targets.push('server-users:' + i); } }
- obj.parent.DispatchEvent(targets, obj, { etype: 'user', userid: user._id, username: user.name, account: obj.CloneSafeUser(user), action: 'login', msgid: 1, msg: 'Account login', domain: domain.id });
+ const ua = getUserAgentInfo(req);
+ const loginEvent = { etype: 'user', userid: user._id, username: user.name, account: obj.CloneSafeUser(user), action: 'login', msgid: 107, msgArgs: [req.clientIp, ua.browserStr, ua.osStr], msg: 'Account login', domain: domain.id, ip: req.clientIp, userAgent: req.headers['user-agent'] };
+ obj.parent.DispatchEvent(targets, obj, loginEvent);
// Regenerate session when signing in to prevent fixation
//req.session.regenerate(function () {
@@ -1448,7 +1454,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
req.session.messageid = 4; // SMS sent.
} else {
req.session.messageid = 108; // Invalid token, try again.
- obj.parent.DispatchEvent(['*', 'server-users', user._id], obj, { action: 'authfail', username: user.name, userid: user._id, domain: domain.id, msg: 'User login attempt with incorrect 2nd factor from ' + req.clientIp });
+ const ua = getUserAgentInfo(req);
+ obj.parent.DispatchEvent(['*', 'server-users', user._id], obj, { action: 'authfail', username: user.name, userid: user._id, domain: domain.id, msg: 'User login attempt with incorrect 2nd factor from ' + req.clientIp, msgid: 108, msgArgs: [req.clientIp, ua.browserStr, ua.osStr] });
obj.setbadLogin(req);
}
}
@@ -6789,6 +6796,17 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
return (req.headers['user-agent'].toLowerCase().indexOf('mobile') >= 0);
}
+ // Return decoded user agent information
+ function getUserAgentInfo(req) {
+ var browser = 'Unknown', os = 'Unknown';
+ try {
+ const ua = obj.uaparser(req.headers['user-agent']);
+ if (ua.browser && ua.browser.name) { ua.browserStr = ua.browser.name; if (ua.browser.version) { ua.browserStr += '/' + ua.browser.version } }
+ if (ua.os && ua.os.name) { ua.osStr = ua.os.name; if (ua.os.version) { ua.osStr += '/' + ua.os.version } }
+ return ua;
+ } catch (ex) { return { browserStr: browser, osStr: os } }
+ }
+
// Return the query string portion of the URL, the ? and anything after.
function getQueryPortion(req) { var s = req.url.indexOf('?'); if (s == -1) { if (req.body && req.body.urlargs) { return req.body.urlargs; } return ''; } return req.url.substring(s); }
![](\\\"images/android-40.png\\\"){kind=small}