search

dani-garcia / vaultwarden

Unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs
GNU Affero General Public License v3.0
39.42k stars 1.92k forks source link

[META] Feature Requests #246

Open dani-garcia opened 6 years ago

dani-garcia commented 6 years ago

To avoid cluttering the issue tracker with feature requests, please comment any requests here and we'll keep a list.

When available, I've linked a related issue or comment to add context to the request.

Authentication

Database support

Admin page

Security

Docker images

Other

If anyone wants to help implementing these features, we are available here or on the matrix channel to help guide you as much as we can.

quthla commented 5 years ago

What is needed for #241? Seems somebody already posted the needed changes in the corresponding issue so that could maybe be integrated?

dani-garcia commented 5 years ago

Yes, someone would have to check those changes, see what can be integrated into the project directly (possibly a config option for the mount point) and create the documentation on how to configure the vault, proxy, etc.

mprasil commented 5 years ago

@dpffxhad added it to the list

Peneheals commented 5 years ago

It would be great to see an (admin) feature which can help sysops to test mailing functionality. Maybe somewhere a button which can send a test e-mail to the actual user's address and which gives back a fail/success message after the action.

mprasil commented 5 years ago

Good idea @Peneheals, @njfox what do you think?

p-rintz commented 5 years ago

Would it be possible to introduce 2FA auth to the /admin panel as well?

njfox commented 5 years ago

Good idea @Peneheals, @njfox what do you think?

I also think that's a good idea, and it shouldn't be too difficult to implement. I can look at adding the necessary API endpoints once I find some time, or knowing @dani-garcia he'll probably get to it first

dani-garcia commented 5 years ago

About 2fa: To do this, we'll need to implement it separately from the already existing 2fa code. I'm not sure if for this case it's worth it to implement multiple 2fa systems, so I would think just totp and maybe email would be good enough.

That said, this would require some changes to the admin page to input the 2fa code: we can't just ask for it at the start because it changes every 30 seconds .

Edit: About the email, as a workaround, you can invite yourself to test if it works for now, but it would be great to add

chinenual commented 5 years ago

I am having trouble getting an Apache reverse-proxy to work in my organization. For various reasons, I can't create a new subdomain for bitwarden - i need to run it as https://my.proxy.domain/bitwarden forwarding to localhost running http on a non-standard port. However I cannot find a way to get Apache's mod_proxy to proxy from /bitwarden context to root context. For other applications I'm able to create proxies to as long as the target application uses a non-root context.

I.e. I want to do this:

https://my.proxy/bitwarden <-> http:/localhost:1234

I can get other apps to work if the internal app uses non-root context -- e.g.

https://my.proxy/acontext <-> http:/localhost:1234/anothercontext

Can bitwarden_rs be configured to listen to /bitwarden_rs or /bitwarden instead of / ? If not, can someone help in constructing apache mod_proxy / mod_rewrite rules to proxy the bitwarden_rs root context from a non-root proxy context?

mprasil commented 5 years ago

@chinenual see #71. The TL/DR is that while bitwarden_rs doesn't mind serving from a sub path, client apps don't support that. There was some effort modifying the Vault code to allow this, but I haven't seen anyone reporting that they got it working.

chinenual commented 5 years ago

Thanks @mprasil - I'll keep my eye on upstream client support and check back here if/when it's supportable.

quthla commented 5 years ago

@mprasil I think only the web vault needs some patching (which has already been done?)

https://github.com/dani-garcia/bitwarden_rs/issues/241#issuecomment-436373392

I changed the path in the android app and it'll correctly call api at that path.

"POST /bw/api/accounts/prelogin HTTP/1.1"

mprasil commented 5 years ago

Good to know @quthla, are you sure all functionality is present in the mobile client apps - like attachments. (also this probably still rules out using the official desktop app?)

pdarcos commented 5 years ago

Awesome project guys! +1 for Postgresql and/or MariaDB support.

pdarcos commented 5 years ago

Also +1 for groups support. I know you can use organiztions as a workaround but it is an unwieldy solution. Native support for groups would be fantastic.

tcjew commented 5 years ago

support for rqlite! Bassicly a sqlite database with synchronization support across multiple servers. As i am looking for a redundant solution

pdarcos commented 5 years ago

Push notifications would be cool too. I know you'd have to compile your own mobile clients for them to work but that's not such a big deal and having all your devices synced is very useful IMO.

I also like the focus on security. The option to force 2FA for all logins would make it super secure. It can be problematic letting users water down the security and effectively negating 2FA. Most people - surprisingly even informed ones - tend to choose convenience over security.

ta-vroom commented 5 years ago

Support for custom icons? I was able to add missing icons for locally hosted sites and I'm pretty sure you could override domain icons, but what about separate icons for multiple accounts?

For customizing icons, in /data/icon_cache you can change the icons. Icons for missing domains have a .miss extension. Copy a png file to that directory without the .miss extension and it should render normally in the vault.

dani-garcia commented 5 years ago

To support custom icons per cipher instead of as it is (per domain) we would probably need the clients to support them. As a possible workaround, you could create a fake invalid URL for the first URL field, like -mycustomicon1.com and use the other URL fields for the actual URL. With that you could move your custom icon to /data/icon_cache/-mycustomicon1.com.png and it should work.

Note that if you are going to keep custom icons, you should set ICON_CACHE_TTL to 0 to disable the server from renewing them in 30 days.

mprasil commented 5 years ago

To expand on what @dani-garcia said above, the icons API isn't authenticated. The client just asks icon for a domain and that's all information we'll get. This is why we don't know which user is requesting the icons.

ThiefMaster commented 5 years ago

It would be nice to have the "new device logged in" emails like in the original service:

Your Bitwarden account was just logged into from a new device.

Date: Thursday, March 21, 2019 at 3:28 PM UTC IP Address: 1.2.3.4 Device Type: Windows

You can deauthorize all devices that have access to your account from the web vault under Settings > My Account > Deauthorize Sessions.

ThiefMaster commented 5 years ago

Push notifications would be cool too. I know you'd have to compile your own mobile clients for them to work but that's not such a big deal and having all your devices synced is very useful IMO.

Why can't they use the push.bitwarden.com push proxy instead of requiring people to compile their own apps? If you consider it unethical, just add a statement that people should buy premium before enabling it.

mprasil commented 5 years ago

@ThiefMaster is there some information about how this endpoint can be used? I've got the impression that there are some credentials needed.

ThiefMaster commented 5 years ago

It looks like all you need is a key from https://bitwarden.com/host/

https://github.com/bitwarden/server/blob/255855887b2463478ec93133bee301c61a18b517/src/Core/Services/Implementations/RelayPushRegistrationService.cs#L23

Kovah commented 5 years ago

Hello there. First of all many thanks for this implementation of Bitwarden! đź’Ż Everything is working fine but I would like to ask for two smaller things:

Both would be quite helpful to get (non-english speaking) family members to use Bitwarden. (If it's possible already I would like to know how, couldn't find any options for this.)

mprasil commented 5 years ago

ability to change the application name (currently Bitwarden_rs) to my own name

Not sure if I follow you there @Kovah. Where would you like to change this? The only place I can think of are the emails - you can provide your own translated templates there.

ability to set the default language for new users

I don't think this saved or provided by the server anywhere. The setting is saved client side and as far as I know the default follows your system settings.

dani-garcia commented 5 years ago

The users return a hardcoded Culture value of en-US at the moment, but I'm not sure if that affects the clients.

Kovah commented 5 years ago

you can provide your own translated templates there.

Where would I do that? Also, it's on the login pages. Would be nice to have the own name there.

About the language thing: this would be only needed for the login page / registration form. Just tested this by changing my system language and it's set automatically. So nothing to do here. :)

mprasil commented 5 years ago

Ah so you're talking about Bitwarden, not bitwarden_rs? I think you might need to recompile the vault code with your changes patched in to do that. We just use more-less direct code from upstream for that part. If you decide to do that, you can point to your version of vault via WEB_VAULT_FOLDER.

As for the templates, you can see the built-in ones here. You can modify them and mount them somewhere inside the container and then point TEMPLATES_FOLDER there.

ViViDboarder commented 5 years ago

LDAP syncing has been added to the wiki: https://github.com/dani-garcia/bitwarden_rs/wiki/Syncing-users-from-LDAP

mprasil commented 5 years ago

Can we mark the LDAP thing done or is there something else that needs to be done?

ImNtReal commented 5 years ago

Does the LDAP Synching feature simply lookup users in a LDAP directory, and send them invitation e-mails? What I was hoping for was using LDAP as an authentication backend, so that users have the same credentials to login to bitwarden_rs as they do everything else on my network that uses LDAP for authentication.

dani-garcia commented 5 years ago

@mprasil I think we can at mark it as done, but indicate that the official ldap connector app is not supported, maybe we can add that as a separate feature.

@ImNtReal Yes, that's exactly the same thing the upstream connector app does, it just adds and removes users, but the users need to exist beforehand. I'm not sure how LDAP works internally but I imagine the passwords are hashed, so we don't have a way to get their current password to create them an account.

mprasil commented 5 years ago

@dani-garcia I've updated the issue and added a sub-task to support the official thing. Although right now @ViViDboarder's solution is probably covering most of the functionality..

RomanHargrave commented 5 years ago

I'm not sure how LDAP works internally but I imagine the passwords are hashed, so we don't have a way to get their current password to create them an account.

Correct, and in most directory configurations I do not believe you will be able to retrieve the hashes.

One way to deal with the want to authenticate users via directory works much like Bitwarden works today, requiring a user-held secret to decrypt the vault -

Unfortunately, implementing this would break compatibility with Bitwarden.

kennylevinsen commented 5 years ago

Unfortunately, implementing this would break compatibility with Bitwarden.

We could contribute equivalent functionality upstream, in order to keep us in sync. It would also aid upstream in obtaining proper directory support.

bremensaki commented 5 years ago

Is there a way to override the default organisation name from "bitwarden_rs" in the invitation emails that I'm missing, or is this something that'd be covered under the "better email templates" list item?

mprasil commented 5 years ago

@bremensaki You can provide your own template for emails, would that work for you?

KreativeKrise commented 5 years ago

It would be nice to implement the possibility to use docker secrets, e.g. for the ADMIN_TOKEN environment variable. Here you will find a nice article how you could implement it: https://medium.com/@adrian.gheorghe.dev/using-docker-secrets-in-your-environment-variables-7a0609659aab

mprasil commented 5 years ago

@KreativeKrise, makes me wonder if we can just create symlink from /.env that is read at startup to /run/secrets/bitwarden_rs_secrets. We'd add something like this into the Dockerfile:

RUN ln -s /run/secrets/bitwarden_rs_secrets /.env

If there's no secret the service starts as usual, if you mount your own .env file, it will override the symlink, so that is still going to work as expected. Now to create the docker secrets, you'd do something like:

docker secret create bitwarden_rs_secrets - <<EOF
ADMIN_TOKEN=somelongrandomtoken
SMTP_PASSWORD=smtpserverpass
EOF

basically adding all passwords into one docker secret. That way there's no need for startup wrapper script, that we might want to then drop somehow if we want to go for distroless based image.

ViViDboarder commented 5 years ago

@KreativeKrise can't you already store your configuration in a file and mount that using Docker Secrets?

Also you can do what that blog suggests already without an upstream patch. This is one of the cool things about how Docker layers work.

The CMD in the Dockerfile is set to just run the bitwarden executable. So you could build your own Dockerfile that looks something like this:

Disclaimer: I haven't tested this, there may be small errors, but the gist is the same

FROM bitwardenrs/server:latest
COPY entrypoint.sh /
ENTRYPOINT /entrypoint.sh

Where entrypoint.sh is something like:

#! /bin/bash
source /run/secrets/bitwarden_rs_secrets
exec $@

And your secrets file is something like:

export ADMIN_TOKEN=myadmintoken
Pschittt commented 5 years ago

Here a few features requests :

mprasil commented 5 years ago

@Pschittt

1) this is already present unless I misunderstand you here: image 2) There was some discusion about it in #504 - the outcome essentially is to export your passwords with something like bitwarden-cli. I can't really imagine a scenario where you have sqlite backup, but don't have bitwarden_rs. I mean something had to create that sqlite DB right? As absolute worst case paranoid scenario, you can always backup bitwarden_rs docker image (docker save) as an fallback? It's quite small.

Pschittt commented 5 years ago

@mprasil

  1. Indeed ! I didn't see it. You can forget the feature request ;)
  2. The idea was to be able to retrieve it without running a bitwarden_rs platform.
mprasil commented 5 years ago

@Pschittt as for 2) see #504, there isn't much we can do server side as most of the data is client-side encrypted. There are some ideas how to achieve this, but it would most likely be external project rather than being part of bitwarden_rs.

stripe4 commented 5 years ago

An option not to show organization credentials in "My Vault". Currently it's difficult to separate my private credentials from organization ones. Ability to add picture logos to organizations.

mprasil commented 5 years ago

@stripe4 I think both of these will need to be implemented on the client side, so you need to make the request upstream. (In their forums)

onggie commented 5 years ago

Hi, are we likely to see the support of the official director connector any time soon?

dani-garcia commented 5 years ago

It would depend on a third party helping with a PR, as I don't have neither the knowlege nor a server to work with LDAP.

H3npi commented 5 years ago

it would be awesome to implement a simple Healthcheck to the Dockerfile.