3 Commits

Include renames

Author	SHA1	Message	Date
mrambossekandClaude Fable 5	89a5ff9139	adminauth: a break-glass local admin alongside OIDC ... If the IdP is misconfigured, unreachable, or the admin group is a typo, the operator is locked out of their own server with no way back short of editing JSON on disk. A fallback that only matters when everything else is broken is exactly the thing you cannot add later - by then you cannot get in to add it. Stored as PBKDF2-HMAC-SHA256 from the standard library (Go 1.24+ has it, so no dependency), 600k iterations, per-credential salt. A password rather than a bearer token on purpose: a break-glass credential is the one most likely to end up in a backup or a config-management repo, and a hash survives that where a token does not. There is no email reset flow and should not be - --set-admin-password on the host is the reset, and whoever can run it already has the machine. The password is read from stdin, never a flag, so it stays out of shell history and the process list; piping still works for automation. Details the tests pin, each for a reason: - the username is compared in constant time too, or a fast rejection is a timing oracle for which usernames exist; - the *stored* iteration count is used, so raising the constant later does not lock out existing passwords; - the throttle grows with consecutive failures but stays bounded and forgives after a quiet minute - a break-glass credential an attacker can lock out is a denial of service against the one person who needs it; - sessions are MAC-checked before anything in them is read, and rotating the secret invalidates every one at once, which is how they are revoked. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-01 17:12:54 +02:00
mrambossekandClaude Opus 5	43e1ba778a	server: multi-address listeners, env-file config, self-update timer + checksums ... - Comma-separated ECHOLOT_{CONTROL,UDP,TCP}_LISTEN; one listener/socket per address. Explicit binds matter on multi-IP hosts (a wildcard would also claim the SSH-only management address) and per-address UDP sockets are the substrate stun-5780 needs. - systemd unit reads /etc/echolot-server.env (seeded once, never overwritten); --install-systemd with --self-update-api also installs a daily randomized update timer that try-restarts the service. - selfupdate: SHA256SUMS verification is now mandatory before the atomic replace (integrity, not authenticity — signing still TODO). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-31 19:40:36 +02:00
mrambossekandClaude Opus 5	8a80026d49	server: Go skeleton — control plane, UDP data plane, Docker + systemd modes ... Pure stdlib. Implements the spec's core: enrollment (single-use tokens), profile (SPKI pin, only real capabilities advertised), sessions with the §2.4 HKDF-SHA256 key schedule; UDP data plane with the 32-byte ELT1 header, 4-byte HMAC gate, 1024-wide anti-replay window, ECHO_RESP with observation block, TIMESYNC, and the §3.4 anti-amplification cap. Wire format has tests (roundtrip + silent-drop cases); enroll→profile→session smoke-tested live. Modes: container (autodetect /.dockerenv|/run/.containerenv|cgroup, or --docker/ECHOLOT_DOCKER=1; config via ECHOLOT_* env; distroless image; network_mode host required — Docker NAT would falsify observed sources) and native (--install-systemd/--uninstall-systemd with a hardened unit, opt-in --self-update from Gitea releases; refused in containers). CI: tests on any server/ push; server-v* tags build+push the image to the Gitea registry and attach linux amd64/arm64 binaries + SHA256SUMS to a release — the artifact self-update consumes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-30 13:09:08 +02:00