git-echo/linux_patch_manager
Private
Public Access
1
0
Fork 0
Code Releases 8 Wiki Activity

fix(security): encrypt app secrets at rest with AES-256-GCM (#6)
All checks were successful
CI Pipeline / Rust Format Check (push) Successful in 8s
CI Pipeline / Clippy Lints (push) Successful in 50s
CI Pipeline / Rust Unit Tests (push) Successful in 1m8s
CI Pipeline / Security Audit (push) Successful in 5s
CI Pipeline / Frontend Lint & Type Check (push) Successful in 15s
CI Pipeline / Build .deb & Release (push) Has been skipped

Browse Source 
Encrypt three sensitive secrets that were stored in plaintext: OIDC client_secret, SMTP smtp_password, TOTP totp_secret. AES-256-GCM via pm-core::crypto helper. New per-install key at /etc/patch-manager/keys/secret-encryption.key, separate from health-check.key for blast-radius isolation. MASKED placeholder behavior in API responses is preserved.

23 files changed, +1248 / -28. Closes #6.
This commit is contained in:
Draco-Lunaris-Echo
2026-06-03 15:08:25 -05:00
committed by GitHub
parent e0a9037be3
commit b9fb3427e0
23 changed files with 1248 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
crates/pm-auth/src/session.rs Executable file → Normal file
View File

@ -40,6 +40,8 @@ pub enum SessionError {
Password(#[from] PasswordError),
#[error("Database error: {0}")]
Database(#[from] sqlx::Error),
#[error("Internal error: {0}")]
Internal(String),
}
/// Successful login response returned to the client.
@ -77,7 +79,10 @@ struct DbUser {
role: UserRole,
auth_provider: AuthProvider,
password_hash: Option<String>,
totp_secret: Option<String>,
/// AES-256-GCM encrypted TOTP secret (issue #6 fix). None = TOTP not configured.
totp_secret_encrypted: Option<Vec<u8>>,
/// AES-256-GCM nonce for TOTP secret. Must be paired with `totp_secret_encrypted`.
totp_secret_nonce: Option<Vec<u8>>,
mfa_enabled: bool,
is_active: bool,
force_password_reset: bool,
@ -194,9 +199,25 @@ pub async fn login(
// 4. MFA check
if user.mfa_enabled {
let code = req.totp_code.as_deref().ok_or(SessionError::MfaRequired)?;
let secret = user.totp_secret.as_deref().unwrap_or("");
// Decrypt the TOTP secret (issue #6 fix — stored as encrypted+nonce BYTEA)
let secret = match (&user.totp_secret_encrypted, &user.totp_secret_nonce) {
(Some(enc), Some(nonce)) => {
let key = pm_core::crypto::load_or_create_key(std::path::Path::new(
pm_core::crypto::SECRET_ENCRYPTION_KEY_PATH,
))
.map_err(|e| {
tracing::error!(error = %e, "Failed to load secret-encryption key");
SessionError::Internal("Encryption key error".to_string())
})?;
pm_core::crypto::decrypt(enc, nonce, &key).map_err(|e| {
tracing::error!(error = %e, "Failed to decrypt TOTP secret");
SessionError::Internal("TOTP decryption error".to_string())
})?
},
_ => String::new(),
};
let mfa_ok = mfa_totp::verify_code(&user.username, secret, code).unwrap_or(false);
let mfa_ok = mfa_totp::verify_code(&user.username, &secret, code).unwrap_or(false);
if !mfa_ok {
tracing::warn!(username = %req.username, "Login failed: invalid MFA code");