什么是MFA
虛擬MFAMulti-FactorAuthentication多因素認(rèn)證牡属，是需要一部智能手機(jī)并安裝虛擬MFA應(yīng)用程序即可在賬戶上加上一層安全保險(xiǎn)
常見的MFA應(yīng)用程序蔓罚，
| 手機(jī)類型 | MFA應(yīng)用程序 |
|---|---|
| iPhone | Google Authenticator |
| Android | 谷歌動(dòng)態(tài)口令 近尚，身份寶宵晚，洋蔥 |
| Windows Phone | 身份驗(yàn)證器 |
| Blackberry | Google Authenticator |
MFA應(yīng)用程序的算法TOTP
TOTP（Time-Based One-Time Password基于時(shí)間的一次性密碼）剩燥，其核心內(nèi)容包括以下三點(diǎn)：
- 共同密鑰
- 共同時(shí)間
- 共同簽署方法
什么系統(tǒng)需要用到
想要安全黎棠，什么系統(tǒng)都可以用
以上基本上從網(wǎng)絡(luò)搜集的資料醋闭，接下來看看MFA加到web應(yīng)用的效果
同樣支持自動(dòng)掃描椎木，手動(dòng)添加违柏，二選一添加就可以了，添加之后香椎，輸入連續(xù)2組不同的動(dòng)態(tài)密碼漱竖，確認(rèn)后，系統(tǒng)就會(huì)開啟MFA認(rèn)證,這樣該用戶登錄系統(tǒng)就會(huì)多一次認(rèn)證
需要保證：安裝MFA應(yīng)用程序手機(jī)的時(shí)間需要與服務(wù)器一致畜伐，不然動(dòng)態(tài)密碼無法一致
image.png
image.png
image.png
image.png
代碼片段
//二維碼圖片生成
package controllers
import (
"github.com/boombuler/barcode"
"github.com/boombuler/barcode/qr"
"image"
"image/png"
"log"
"os"
)
func WritePng(filename string, img image.Image) string {
file, err := os.Create("./static/images/" + filename)
if err != nil {
log.Fatal(err)
}
err = png.Encode(file, img)
if err != nil {
log.Fatal(err)
}
file.Close()
log.Println(file.Name())
return "/static/images/" + filename
}
func GetQrCode(str string, filename string) string {
code, err := qr.Encode(str, qr.L, qr.Unicode)
if err != nil {
log.Fatal(err)
}
log.Println("Encoded data:", code.Content())
if str != code.Content() {
log.Fatal("data differs")
}
code, err = barcode.Scale(code, 200, 200)
if err != nil {
log.Fatal(err)
}
return WritePng(filename+".png", code)
}
//TOTP相關(guān)
package controllers
import (
"crypto/hmac"
"crypto/sha1"
"encoding/base32"
"fmt"
"math/rand"
"strings"
"time"
)
const (
length = 16
)
func toBytes(value int64) []byte {
var result []byte
mask := int64(0xFF)
shifts := [8]uint16{56, 48, 40, 32, 24, 16, 8, 0}
for _, shift := range shifts {
result = append(result, byte((value>>shift)&mask))
}
return result
}
func toUint32(bytes []byte) uint32 {
return (uint32(bytes[0]) << 24) + (uint32(bytes[1]) << 16) +
(uint32(bytes[2]) << 8) + uint32(bytes[3])
}
//密鑰生成
func GetSecret() string {
str := "234567abcdefghijklmnopqrstuvwxyz"
bytes := []byte(str)
result := []byte{}
r := rand.New(rand.NewSource(time.Now().UnixNano()))
for i := 0; i < length; i++ {
result = append(result, bytes[r.Intn(len(bytes))])
}
return string(result)
}
func oneTimePassword(key []byte, value []byte) uint32 {
// sign the value using HMAC-SHA1
hmacSha1 := hmac.New(sha1.New, key)
hmacSha1.Write(value)
hash := hmacSha1.Sum(nil)
// We're going to use a subset of the generated hash.
// Using the last nibble (half-byte) to choose the index to start from.
// This number is always appropriate as it's maximum decimal 15, the hash will
// have the maximum index 19 (20 bytes of SHA1) and we need 4 bytes.
offset := hash[len(hash)-1] & 0x0F
// get a 32-bit (4-byte) chunk from the hash starting at offset
hashParts := hash[offset : offset+4]
// ignore the most significant bit as per RFC 4226
hashParts[0] = hashParts[0] & 0x7F
number := toUint32(hashParts)
// size to 6 digits
// one million is the first number with 7 digits so the remainder
// of the division will always return < 7 digits
pwd := number % 1000000
return pwd
}
//動(dòng)態(tài)6位密碼
func Totp(secret string, ago int64) string {
keynospaces := strings.Replace(secret, " ", "", -1)
keynospacesupper := strings.ToUpper(keynospaces)
key, err := base32.StdEncoding.DecodeString(keynospacesupper)
if err != nil {
fmt.Println(err)
}
epochsecond := time.Now().Unix()
epochsecond -= ago //ago可以為0馍惹，也可以為30，這樣可以應(yīng)付2組密碼的情況
pwd := oneTimePassword(key, toBytes(epochsecond/30))
secondsRemaining := 30 - (epochsecond % 30)
//fmt.Sprintf("%06d (%d second(s) remaining)\n", pwd, secondsRemaining)
fmt.Println(secondsRemaining) //這個(gè)secondsRemaining沒有用到,只是打印下
return fmt.Sprintf("%06d", pwd)
}
//二維碼包含內(nèi)容
func Getotpauth(name, secret, issuer string) string {
otpauth := "otpauth://totp/" + "testwd" + ":" + name + "?secret=" + secret + "&issuer=" + issuer
return otpauth
}
//MFA開啟后烤礁，登錄后驗(yàn)證MFA頁面
func (self *UserController) MfaVerifyPage() {
self.TplName = "user/mfapwd.html"
}
//驗(yàn)證MFA動(dòng)態(tài)密碼是否正確
func (self *UserController) MfaVerify() {
email := self.GetSession("email")
code := self.Input().Get("code")
if email == nil {
self.Data["islogin"] = false
self.Ctx.Redirect(302, "/")
} else {
_, user := models.FindUserByEmail(email.(string))
if code == Totp(user.Secret, 0) {
self.SetSession("uid", user.Id)
msg := map[string]interface{}{"code": 0, "msg": "success"}
self.Data["json"] = &msg
self.ServeJSON()
} else {
msg := map[string]interface{}{"code": 1, "msg": "invalid code"}
self.Data["json"] = &msg
self.ServeJSON()
}
}
}
func (self *UserController) MFAPage() {
uid := self.GetSession("uid")
if uid == nil {
self.Data["islogin"] = false
self.Ctx.Redirect(302, "/")
} else {
user := models.FindUserDetialById(uid.(int))
//隨機(jī)密鑰
secret := GetSecret()
qrdata := Getotpauth(user.Nickname, secret, "測(cè)試村")
//把郵箱md5加密成字符串讼积，當(dāng)作二維碼文件名,這樣文件名應(yīng)該是每個(gè)用戶只有一個(gè)
//不會(huì)因?yàn)橛脩舳啻嗡⑿露刹槐匾奈募?以防造成空間浪費(fèi)
md5ctx := md5.New()
md5ctx.Write([]byte(user.Email))
filename := fmt.Sprintf("%x", md5ctx.Sum(nil))
fmt.Println(filename, "pppp")
self.Data["qrimg"] = GetQrCode(qrdata, filename)
if user.Mfa != true {
user.Secret = secret
models.UpdateUser(&user)
self.Data["secret"] = secret
} else {
//開啟MFA，密鑰對(duì)用戶不可見
self.Data["secret"] = "****************"
}
self.Data["islogin"] = true
self.Data["userinfo"] = user
self.Data["IsMFA"] = true
self.TplName = "user/mfa.html"
}
}
//開啟MFA
func (self *UserController) SetMfa() {
code1, code2 := self.Input().Get("code1"), self.Input().Get("code2")
uid := self.GetSession("uid")
if uid == nil {
self.Data["islogin"] = false
self.Ctx.Redirect(302, "/")
} else {
user := models.FindUserDetialById(uid.(int))
fmt.Println(code1, code2)
fmt.Println(Totp(user.Secret, 30), Totp(user.Secret, 0))
if code1 == Totp(user.Secret, 30) && code2 == Totp(user.Secret, 0) {
user.Mfa = true
models.UpdateUser(&user)
msg := map[string]interface{}{"code": 0, "msg": "success"}
self.Data["json"] = &msg
self.ServeJSON()
} else {
msg := map[string]interface{}{"code": 1, "msg": "無效密碼"}
self.Data["json"] = &msg
self.ServeJSON()
}
}
}
//關(guān)閉MFA脚仔，關(guān)閉也需要驗(yàn)證動(dòng)態(tài)密碼
func (self *UserController) CloseMfa() {
code1, code2 := self.Input().Get("code1"), self.Input().Get("code2")
uid := self.GetSession("uid")
if uid == nil {
self.Data["islogin"] = false
self.Ctx.Redirect(302, "/")
} else {
user := models.FindUserDetialById(uid.(int))
fmt.Println(code1, code2)
fmt.Println(Totp(user.Secret, 30), Totp(user.Secret, 0))
if code1 == Totp(user.Secret, 30) && code2 == Totp(user.Secret, 0) {
user.Mfa = false
models.UpdateUser(&user)
msg := map[string]interface{}{"code": 0, "msg": "success"}
self.Data["json"] = &msg
self.ServeJSON()
} else {
msg := map[string]interface{}{"code": 1, "msg": "無效密碼"}
self.Data["json"] = &msg
self.ServeJSON()
}
}
}
