Secure initial Roller setup with one-time operator token

CHANGES.md

@@ -2,6 +2,8 @@
 
 ## 6.1.6
 
+Initial installation now requires a one-time, cryptographically secure setup token printed to the server log; bootstrap access closes after the first administrator is created.
+
 A maintenance release. Users of 6.1.5 and earlier are encouraged to upgrade.
 
 ### Behaviour changes worth reading before upgrading

app/src/main/java/org/apache/roller/weblogger/business/startup/DatabaseInstaller.java

@@ -48,6 +48,9 @@ public class DatabaseInstaller {
     // the name of the property which holds the dbversion value
     private static final String DBVERSION_PROP = "roller.database.version";
 
+    // Update this when adding a database or data migration step below.
+    private static final int LATEST_DATABASE_UPGRADE_VERSION = 610;
+
 
     public DatabaseInstaller(DatabaseProvider dbProvider, DatabaseScriptProvider scriptProvider) {
         db = dbProvider;
@@ -123,9 +126,12 @@ public boolean isUpgradeRequired() {
             }
 
             return false;
-        } else {
-            return databaseVersion < desiredVersion;
         }
+
+        // A product release does not always change the database. Do not send
+        // administrators through the upgrade UI for a version-only change.
+        int requiredDatabaseVersion = Math.min(desiredVersion, LATEST_DATABASE_UPGRADE_VERSION);
+        return databaseVersion < requiredDatabaseVersion;
     }
 
 

app/src/main/java/org/apache/roller/weblogger/ui/core/RollerContext.java

@@ -45,6 +45,7 @@
 import org.apache.roller.weblogger.ui.core.plugins.UIPluginManager;
 import org.apache.roller.weblogger.ui.core.plugins.UIPluginManagerImpl;
 import org.apache.roller.weblogger.ui.core.security.AutoProvision;
+import org.apache.roller.weblogger.ui.core.security.BootstrapSecurity;
 import org.apache.roller.weblogger.util.Reflection;
 import org.apache.roller.weblogger.util.cache.CacheManager;
 import org.apache.velocity.runtime.RuntimeSingleton;
@@ -157,6 +158,10 @@ public void contextInitialized(ServletContextEvent sce) {
             return;
         }
 
+        if (!WebloggerStartup.isPrepared()) {
+            BootstrapSecurity.start();
+        }
+
         final boolean ittest = "ittest".equals(WebloggerConfig.getProperty("installation.type"));
 
         // if preparation failed or is incomplete then we are done,
@@ -186,6 +191,21 @@ public void contextInitialized(ServletContextEvent sce) {
                 // trigger initialization process
                 weblogger = WebloggerFactory.getWeblogger();
                 weblogger.initialize();
+                try {
+                    org.apache.roller.weblogger.pojos.RuntimeConfigProperty marker =
+                            weblogger.getPropertiesManager().getProperty(BootstrapSecurity.COMPLETION_PROPERTY);
+                    if (marker != null && "true".equalsIgnoreCase(marker.getValue())) {
+                        BootstrapSecurity.complete();
+                    } else if (weblogger.getUserManager().getUserCount() > 0) {
+                        weblogger.getPropertiesManager().saveProperty(new org.apache.roller.weblogger.pojos.RuntimeConfigProperty(BootstrapSecurity.COMPLETION_PROPERTY, "true"));
+                        weblogger.flush();
+                        BootstrapSecurity.complete();
+                    } else {
+                        BootstrapSecurity.start();
+                    }
+                } catch (WebloggerException ignored) {
+                    BootstrapSecurity.start();
+                }
 
             } catch (BootstrapException ex) {
                 log.fatal("Roller Weblogger bootstrap failed", ex);

app/src/main/java/org/apache/roller/weblogger/ui/core/filters/BootstrapFilter.java

@@ -77,6 +77,8 @@ private boolean isInstallUrl(String uri) {
                    uri.endsWith("bootstrap.rol")
                 || uri.endsWith("create.rol") 
                 || uri.endsWith("upgrade.rol") 
+                || uri.endsWith("bootstrap-token.rol")
+                || uri.endsWith("bootstrap-token!redeem.rol")
                 || uri.endsWith(".js") 
                 || uri.endsWith(".css")));
     }

app/src/main/java/org/apache/roller/weblogger/ui/core/filters/BootstrapSecurityFilter.java

@@ -0,0 +1,29 @@
+package org.apache.roller.weblogger.ui.core.filters;
+
+import java.io.IOException;
+import javax.servlet.*;
+import javax.servlet.http.*;
+import org.apache.roller.weblogger.business.WebloggerFactory;
+import org.apache.roller.weblogger.ui.core.security.BootstrapSecurity;
+
+/** Prevents anonymous access to installer and first-user actions. */
+public class BootstrapSecurityFilter implements Filter {
+    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
+        HttpServletRequest r = (HttpServletRequest) req;
+        HttpServletResponse p = (HttpServletResponse) res;
+        String uri = r.getRequestURI();
+        boolean tokenPage = uri != null && (uri.endsWith("/bootstrap-token.rol")
+                || uri.endsWith("/bootstrap-token!redeem.rol"));
+        boolean installer = uri != null && (tokenPage || uri.contains("/roller-ui/install/")
+                || uri.endsWith("/roller-ui/register.rol")
+                || uri.endsWith("/roller-ui/register!save.rol")
+                || uri.endsWith("/roller-ui/setup.rol"));
+        if (installer && !BootstrapSecurity.isCompleted()) {
+            if (tokenPage) { chain.doFilter(req, res); return; }
+            if (!BootstrapSecurity.isValid(r)) { p.sendRedirect(r.getContextPath() + "/roller-ui/bootstrap-token.rol"); return; }
+        }
+        chain.doFilter(req, res);
+    }
+    public void init(FilterConfig c) { }
+    public void destroy() { }
+}

app/src/main/java/org/apache/roller/weblogger/ui/core/security/BasicUserAutoProvision.java

@@ -45,6 +45,7 @@ public class BasicUserAutoProvision implements AutoProvision {
 	 */
     @Override
 	public boolean execute(HttpServletRequest request) {
+		if (!BootstrapSecurity.isCompleted()) return false;
 		User ud = CustomUserRegistry.getUserDetailsFromAuthentication(request);
 
 		if (hasNecessaryFields(ud)) {

app/src/main/java/org/apache/roller/weblogger/ui/core/security/BootstrapSecurity.java

@@ -0,0 +1,124 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License. For additional information regarding
+ * copyright in this work, please see the NOTICE file in the top level
+ * directory of this distribution.
+ */
+
+package org.apache.roller.weblogger.ui.core.security;
+
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.security.SecureRandom;
+import java.util.Base64;
+import javax.servlet.http.HttpServletRequest;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+/** Process-scoped gate for the unauthenticated installation flow. */
+public final class BootstrapSecurity {
+
+    public static final String COMPLETION_PROPERTY = "bootstrap.completed";
+    private static final Log LOG = LogFactory.getLog(BootstrapSecurity.class);
+    private static final long LIFETIME_MS = 60 * 60 * 1000L;
+    private static final String SESSION = BootstrapSecurity.class.getName() + ".grant";
+    private static byte[] digest;
+    private static long expires;
+    private static volatile boolean completed;
+    private static final ThreadLocal<Boolean> INITIAL = new ThreadLocal<>();
+    private BootstrapSecurity() {
+    }
+
+    public static synchronized void start() {
+        if (completed || digest != null) {
+            return;
+        }
+        byte[] raw = new byte[32];
+        new SecureRandom().nextBytes(raw);
+        String token = Base64.getUrlEncoder().withoutPadding().encodeToString(raw);
+        digest = sha256(token);
+        expires = System.currentTimeMillis() + LIFETIME_MS;
+        LOG.warn(box(
+                "ROLLER INITIAL SETUP REQUIRED",
+                "",
+                "Open Roller in a web browser.",
+                "You will be redirected to the secure initial-setup page.",
+                "",
+                "Enter this one-time setup token (expires in 60 minutes):",
+                token));
+    }
+
+    public static boolean isCompleted() {
+        return completed;
+    }
+
+    public static void complete() {
+        completed = true;
+        digest = null;
+    }
+
+    public static void beginInitialAdmin() {
+        INITIAL.set(Boolean.TRUE);
+    }
+
+    public static void endInitialAdmin() {
+        INITIAL.remove();
+    }
+
+    public static boolean initialAdminScope() {
+        return Boolean.TRUE.equals(INITIAL.get());
+    }
+
+    public static boolean isValid(HttpServletRequest request) {
+        Object grant = request.getSession(false) == null ? null : request.getSession(false).getAttribute(SESSION);
+        return !completed && grant instanceof Long && ((Long) grant) >= System.currentTimeMillis();
+    }
+
+    public static synchronized boolean redeem(HttpServletRequest request, String token) {
+        if (completed || digest == null || token == null || System.currentTimeMillis() > expires) {
+            return false;
+        }
+        byte[] supplied = sha256(token);
+        if (!MessageDigest.isEqual(digest, supplied)) {
+            return false;
+        }
+        request.getSession(true).setAttribute(SESSION, System.currentTimeMillis() + LIFETIME_MS);
+        digest = null;
+        return true;
+    }
+
+    private static byte[] sha256(String value) {
+        try {
+            return MessageDigest.getInstance("SHA-256").digest(value.getBytes(StandardCharsets.UTF_8));
+        } catch (Exception e) {
+            throw new IllegalStateException(e);
+        }
+    }
+
+    private static String box(String... lines) {
+        int width = 0;
+        for (String line : lines) {
+            width = Math.max(width, line.length());
+        }
+
+        String border = "+" + "-".repeat(width + 2) + "+";
+        StringBuilder message = new StringBuilder("\n").append(border);
+        for (String line : lines) {
+            message.append("\n| ").append(line)
+                    .append(" ".repeat(width - line.length())).append(" |");
+        }
+        return message.append("\n").append(border).toString();
+    }
+}

app/src/main/java/org/apache/roller/weblogger/ui/struts2/core/BootstrapToken.java

@@ -0,0 +1,90 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License. For additional information regarding
+ * copyright in this work, please see the NOTICE file in the top level
+ * directory of this distribution.
+ */
+
+package org.apache.roller.weblogger.ui.struts2.core;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.apache.roller.weblogger.ui.core.security.BootstrapSecurity;
+import org.apache.roller.weblogger.ui.struts2.util.UIAction;
+import org.apache.struts2.interceptor.ServletRequestAware;
+import org.apache.struts2.interceptor.ServletResponseAware;
+
+public class BootstrapToken extends UIAction implements ServletRequestAware, ServletResponseAware {
+
+    private static final Log LOG = LogFactory.getLog(BootstrapToken.class);
+
+    private HttpServletRequest request;
+    private HttpServletResponse response;
+    private String token;
+
+    public BootstrapToken() {
+        this.pageTitle = "installer.bootstrap.pageTitle";
+    }
+
+    public String execute() {
+        setResponseHeaders();
+        LOG.info("Roller is waiting for an administrator to submit the one-time setup token; "
+                + "database setup will not continue until the token is accepted. Setup page: "
+                + request.getRequestURL());
+        return INPUT;
+    }
+
+    public String redeem() {
+        setResponseHeaders();
+        if (!"POST".equalsIgnoreCase(request.getMethod())) {
+            addActionError(getText("installer.bootstrap.postRequired"));
+            return INPUT;
+        }
+        if (BootstrapSecurity.redeem(request, token == null ? null : token.trim())) {
+            LOG.info("One-time setup token accepted; continuing database setup.");
+            return SUCCESS;
+        }
+        addActionError(getText("installer.bootstrap.invalidToken"));
+        return INPUT;
+    }
+
+    private void setResponseHeaders() {
+        response.setHeader("Cache-Control", "no-store");
+        response.setHeader("Referrer-Policy", "no-referrer");
+    }
+
+    public void setToken(String token) {
+        this.token = token;
+    }
+
+    public void setServletRequest(HttpServletRequest request) {
+        this.request = request;
+    }
+
+    public void setServletResponse(HttpServletResponse response) {
+        this.response = response;
+    }
+
+    public boolean isUserRequired() {
+        return false;
+    }
+
+    public boolean isWeblogRequired() {
+        return false;
+    }
+}

app/src/main/java/org/apache/roller/weblogger/ui/struts2/core/Install.java

@@ -32,6 +32,8 @@
 import org.apache.roller.weblogger.config.WebloggerConfig;
 import org.apache.roller.weblogger.ui.struts2.util.UIAction;
 import org.springframework.beans.FatalBeanException;
+import org.apache.struts2.ServletActionContext;
+import org.apache.roller.weblogger.ui.core.security.BootstrapSecurity;
 
 
 /**
@@ -76,7 +78,6 @@ public boolean isWeblogRequired() {
 
     @Override
     public String execute() {
-
         if (WebloggerFactory.isBootstrapped()) {
             return SUCCESS;
         }
@@ -114,6 +115,7 @@ public String execute() {
 
 
     public String create() {
+        if (!BootstrapSecurity.isValid(ServletActionContext.getRequest())) return BOOTSTRAP;
 
         if (WebloggerFactory.isBootstrapped()) {
             return SUCCESS;
@@ -134,6 +136,7 @@ public String create() {
 
 
     public String upgrade() {
+        if (!BootstrapSecurity.isValid(ServletActionContext.getRequest())) return BOOTSTRAP;
 
         if (WebloggerFactory.isBootstrapped()) {
             return SUCCESS;
@@ -154,6 +157,7 @@ public String upgrade() {
 
 
     public String bootstrap() {
+        if (!BootstrapSecurity.isValid(ServletActionContext.getRequest())) return BOOTSTRAP;
         log.info("ENTERING");
 
         if (WebloggerFactory.isBootstrapped()) {