1 package FS::Password_Mixin;
3 use FS::Record qw(qsearch);
5 use FS::password_history;
6 use Authen::Passphrase;
7 use Authen::Passphrase::BlowfishCrypt;
8 # https://rt.cpan.org/Ticket/Display.html?id=72743
9 use Data::Password qw(:all);
13 FS::UID->install_callback( sub {
14 $conf = FS::Conf->new;
16 #eval "use Authen::Passphrase::BlowfishCrypt;";
21 our $me = '[' . __PACKAGE__ . ']';
23 our $BLOWFISH_COST = 10;
27 FS::Password_Mixin - Object methods for accounts that have passwords governed
28 by the password policy.
34 =item is_password_allowed PASSWORD
36 Checks the password against the system password policy. Returns an error
37 message on failure, an empty string on success.
39 This MUST NOT be called from check(). It should be called by the office UI,
40 self-service ClientAPI, or other I<user-interactive> code that processes a
41 password change, and only if the user has taken some action with the intent
42 of setting the password.
46 sub is_password_allowed {
50 my $cust_main = $self->cust_main;
52 # workaround for non-inserted services
53 if ( !$cust_main and $self->get('pkgnum') ) {
54 my $cust_pkg = FS::cust_pkg->by_key($self->get('pkgnum'));
55 $cust_main = $cust_pkg->cust_main if $cust_pkg;
57 warn "is_password_allowed: no customer could be identified" if !$cust_main;
58 return '' if $cust_main && $conf->config_bool('password-insecure', $cust_main->agentnum);
60 # basic checks using Data::Password;
61 # options for Data::Password
62 $DICTIONARY = 4; # minimum length of disallowed words
63 $MINLEN = $conf->config('passwordmin') || 6;
64 $MAXLEN = $conf->config('passwordmax') || 8;
65 $GROUPS = 4; # must have all 4 'character groups': numbers, symbols, uppercase, lowercase
66 # other options use the defaults listed below:
67 # $FOLLOWING = 3; # disallows more than 3 chars in a row, by alphabet or keyboard (ie abcd or asdf)
68 # $SKIPCHAR = undef; # set to true to skip checking for bad characters
69 # # lists of disallowed words
70 # @DICTIONARIES = qw( /usr/share/dict/web2 /usr/share/dict/words /usr/share/dict/linux.words );
72 my $error = IsBadPassword($password);
73 $error = 'must contain at least one each of numbers, symbols, and lowercase and uppercase letters'
74 if $error eq 'contains less than 4 character groups'; # avoid confusion
75 $error = 'Invalid password - ' . $error if $error;
76 return $error if $error;
78 #check against service fields
79 $error = $self->password_svc_check($password);
80 return $error if $error;
82 return '' unless $self->get($self->primary_key); # for validating new passwords pre-insert
84 #check against customer fields
87 # words from cust_main
88 foreach my $field ( qw( last first daytime night fax mobile ) ) {
89 push @words, split(/\W/,$cust_main->get($field));
91 # words from cust_location
92 foreach my $loc ($cust_main->cust_location) {
93 foreach my $field ( qw(address1 address2 city county state zip) ) {
94 push @words, split(/\W/,$loc->get($field));
97 # do the actual checking
98 foreach my $word (@words) {
99 next unless length($word) > 2;
100 if ($password =~ /$word/i) {
101 return qq(Password contains account information '$word');
106 if ( $conf->config('password-no_reuse') =~ /^(\d+)$/ ) {
110 # "the last N" passwords includes the current password and the N-1
111 # passwords before that.
112 warn "$me checking password reuse limit of $no_reuse\n" if $DEBUG;
113 my @latest = qsearch({
114 'table' => 'password_history',
115 'hashref' => { $self->password_history_key => $self->get($self->primary_key) },
116 'order_by' => " ORDER BY created DESC LIMIT $no_reuse",
119 # don't check the first one; reusing the current password is allowed.
122 foreach my $history (@latest) {
123 warn "$me previous password created ".$history->created."\n" if $DEBUG;
124 if ( $history->password_equals($password) ) {
126 if ( $no_reuse == 1 ) {
127 $message = "This password is the same as your previous password.";
129 $message = "This password was one of the last $no_reuse passwords on this account.";
135 } # end of no_reuse checking
140 =item password_svc_check
142 Override to run additional service-specific password checks.
146 sub password_svc_check {
147 my ($self, $password) = @_;
151 =item password_history_key
153 Returns the name of the field in L<FS::password_history> that's the foreign
158 sub password_history_key {
160 $self->table . '__' . $self->primary_key;
163 =item insert_password_history
165 Creates a L<FS::password_history> record linked to this object, with its
170 sub insert_password_history {
172 my $encoding = $self->_password_encoding;
173 my $password = $self->_password;
176 if ( $encoding eq 'bcrypt' ) {
177 # our format, used for contact and access_user passwords
178 my ($cost, $salt, $hash) = split(',', $password);
179 $auth = Authen::Passphrase::BlowfishCrypt->new(
181 salt_base64 => $salt,
182 hash_base64 => $hash,
185 } elsif ( $encoding eq 'crypt' ) {
187 # it's smart enough to figure this out
188 $auth = Authen::Passphrase->from_crypt($password);
190 } elsif ( $encoding eq 'ldap' ) {
192 $password =~ s/^{PLAIN}/{CLEARTEXT}/i; # normalize
193 $auth = Authen::Passphrase->from_rfc2307($password);
194 if ( $auth->isa('Authen::Passphrase::Clear') ) {
195 # then we've been given the password in cleartext
196 $auth = $self->_blowfishcrypt( $auth->passphrase );
200 warn "unrecognized password encoding '$encoding'; treating as plain text"
201 unless $encoding eq 'plain';
203 $auth = $self->_blowfishcrypt( $password );
207 my $password_history = FS::password_history->new({
208 _password => $auth->as_rfc2307,
210 $self->password_history_key => $self->get($self->primary_key),
213 my $error = $password_history->insert;
214 return "recording password history: $error" if $error;
219 =item delete_password_history;
221 Removes all password history records attached to this object, in preparation
222 to delete the object.
226 sub delete_password_history {
228 my @records = qsearch('password_history', {
229 $self->password_history_key => $self->get($self->primary_key)
233 $error ||= $_->delete;
235 return $error . ' (clearing password history)' if $error;
239 =item _blowfishcrypt PASSWORD
241 For internal use: takes PASSWORD and returns a new
242 L<Authen::Passphrase::BlowfishCrypt> object representing it.
248 my $passphrase = shift;
249 return Authen::Passphrase::BlowfishCrypt->new(
250 cost => $BLOWFISH_COST,
252 passphrase => $passphrase,
264 Returns the list of characters allowed in random passwords (from the
265 C<password-generated-characters> config).
272 my $pw_set = $conf->config('password-generated-characters');
273 $pw_set =~ s/\s//g; # don't ever allow whitespace
274 if ( $pw_set =~ /[[:lower:]]/
275 && $pw_set =~ /[[:upper:]]/
276 && $pw_set =~ /[[:digit:]]/
277 && $pw_set =~ /[[:punct:]]/ ) {
278 @pw_set = split('', $pw_set);
280 warn "password-generated-characters set is insufficient; using default.";
281 @pw_set = split('', 'abcdefghijkmnpqrstuvwxyzABCDEFGHIJKLMNPQRSTUVWXYZ23456789()#.,');
291 L<FS::password_history>