summaryrefslogtreecommitdiff
path: root/interface-definitions
diff options
context:
space:
mode:
authorgoodNETnick <pknet@ya.ru>2022-09-22 02:03:04 -0400
committergoodNETnick <pknet@ya.ru>2022-10-11 19:56:45 -0400
commit765f84386b6e94984ff79db2eab36d51f759159b (patch)
treece2ce9dca40ddda4ca4639b89308f317e67e59d1 /interface-definitions
parent31138f43f4a5714077adbbd22ff774b2d4ce37f8 (diff)
downloadvyos-1x-765f84386b6e94984ff79db2eab36d51f759159b.tar.gz
vyos-1x-765f84386b6e94984ff79db2eab36d51f759159b.zip
system login: T874: add 2FA support for local and ssh authentication
Diffstat (limited to 'interface-definitions')
-rw-r--r--interface-definitions/system-login.xml.in76
1 files changed, 76 insertions, 0 deletions
diff --git a/interface-definitions/system-login.xml.in b/interface-definitions/system-login.xml.in
index 24eeee355..79c7c4791 100644
--- a/interface-definitions/system-login.xml.in
+++ b/interface-definitions/system-login.xml.in
@@ -8,6 +8,62 @@
<priority>400</priority>
</properties>
<children>
+ <node name="authentication">
+ <properties>
+ <help>Global authentication settings</help>
+ </properties>
+ <children>
+ <node name="otp">
+ <properties>
+ <help>2FA OTP authentication parameters</help>
+ </properties>
+ <children>
+ <leafNode name="rate-limit">
+ <properties>
+ <help>Number of attempts. Limit logins to N per every M seconds</help>
+ <valueHelp>
+ <format>u32:1-10</format>
+ <description>Number of attempts. Limit logins to N per every M seconds</description>
+ </valueHelp>
+ <constraint>
+ <validator name="numeric" argument="--range 1-10"/>
+ </constraint>
+ <constraintErrorMessage>Number of login attempts must me between 1 and 10</constraintErrorMessage>
+ </properties>
+ <defaultValue>3</defaultValue>
+ </leafNode>
+ <leafNode name="rate-time">
+ <properties>
+ <help>Time interval. Limit logins to N per every M seconds</help>
+ <valueHelp>
+ <format>u32:15-600</format>
+ <description>Time interval. Limit logins to N per every M seconds</description>
+ </valueHelp>
+ <constraint>
+ <validator name="numeric" argument="--range 15-600"/>
+ </constraint>
+ <constraintErrorMessage>Rate limit time interval must be between 15 and 600 seconds</constraintErrorMessage>
+ </properties>
+ <defaultValue>30</defaultValue>
+ </leafNode>
+ <leafNode name="window-size">
+ <properties>
+ <help>Set window of concurrently valid codes</help>
+ <valueHelp>
+ <format>u32:1-21</format>
+ <description>Set window of concurrently valid codes</description>
+ </valueHelp>
+ <constraint>
+ <validator name="numeric" argument="--range 1-21"/>
+ </constraint>
+ <constraintErrorMessage>Window of concurrently valid codes must be between 1 and 21</constraintErrorMessage>
+ </properties>
+ <defaultValue>3</defaultValue>
+ </leafNode>
+ </children>
+ </node>
+ </children>
+ </node>
<tagNode name="user">
<properties>
<help>Local user account information</help>
@@ -36,6 +92,26 @@
</properties>
<defaultValue>!</defaultValue>
</leafNode>
+ <node name="otp">
+ <properties>
+ <help>2FA OTP authentication parameters</help>
+ </properties>
+ <children>
+ <leafNode name="key">
+ <properties>
+ <help>Token Key Secret key for the token algorithm (see RFC 4226)</help>
+ <valueHelp>
+ <format>txt</format>
+ <description>OTP key (base32 encoded secret)</description>
+ </valueHelp>
+ <constraint>
+ <regex>[a-zA-Z2-7]{20,10000}</regex>
+ </constraint>
+ <constraintErrorMessage>Key must only include base32 characters and be at least 26 characters long</constraintErrorMessage>
+ </properties>
+ </leafNode>
+ </children>
+ </node>
<leafNode name="plaintext-password">
<properties>
<help>Plaintext password used for encryption</help>