enigma-bbs/configuration/security.html

<!DOCTYPE html>
<html lang="en-US">
  <head>
    <meta charset='utf-8'>
    <meta http-equiv="X-UA-Compatible" content="chrome=1">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <link rel="icon" type="image/png" sizes="16x16" href="/enigma-bbs/assets/images/favicon-16x16.png">
    <link rel="icon" type="image/png" sizes="32x32" href="/enigma-bbs/assets/images/favicon-32x32.png">
    <link rel="icon" type="image/png" sizes="32x32" href="/enigma-bbs/assets/images/favicon-32x32.png">
    <link rel="stylesheet" href="/enigma-bbs/assets/css/style.css?v=">
    <!-- Begin Jekyll SEO tag v2.7.1 -->
<title>Security | ENiGMA½ BBS Software</title>
<meta name="generator" content="Jekyll v4.2.1" />
<meta property="og:title" content="Security" />
<meta property="og:locale" content="en_US" />
<meta name="description" content="Security Unlike in the golden era of BBSing, modern Internet-connected systems are prone to hacking attempts, eavesdropping, etc. While plain-text passwords, insecure data over Plain Old Telephone Service (POTS), and so on was good enough then, modern systems must employ protections against attacks. ENiGMA½ comes with many security features that help keep the system and your users secure — not limited to: Passwords are never stored in plain-text, but instead are stored using Password-Based Key Derivation Function 2 (PBKDF2). Even the system operator can never know your password! Alternatives to insecure Telnet logins are built in: SSH and secure WebSockets for example. A built in web server with TLS support (aka HTTPS). Optional Two-Factor Authentication (2FA) via One-Time-Password (OTP) for users, supporting Google Authenticator, Time-Based One-Time Password Algorithm (TOTP, RFC-6238), and HMAC-Based One-Time Password Algorithm (HOTP, RFC-4266)." />
<meta property="og:description" content="Security Unlike in the golden era of BBSing, modern Internet-connected systems are prone to hacking attempts, eavesdropping, etc. While plain-text passwords, insecure data over Plain Old Telephone Service (POTS), and so on was good enough then, modern systems must employ protections against attacks. ENiGMA½ comes with many security features that help keep the system and your users secure — not limited to: Passwords are never stored in plain-text, but instead are stored using Password-Based Key Derivation Function 2 (PBKDF2). Even the system operator can never know your password! Alternatives to insecure Telnet logins are built in: SSH and secure WebSockets for example. A built in web server with TLS support (aka HTTPS). Optional Two-Factor Authentication (2FA) via One-Time-Password (OTP) for users, supporting Google Authenticator, Time-Based One-Time Password Algorithm (TOTP, RFC-6238), and HMAC-Based One-Time Password Algorithm (HOTP, RFC-4266)." />
<meta property="og:site_name" content="ENiGMA½ BBS Software" />
<meta property="og:type" content="article" />
<meta property="article:published_time" content="2023-08-27T23:25:06+00:00" />
<meta name="twitter:card" content="summary" />
<meta property="twitter:title" content="Security" />
<script type="application/ld+json">
{"description":"Security Unlike in the golden era of BBSing, modern Internet-connected systems are prone to hacking attempts, eavesdropping, etc. While plain-text passwords, insecure data over Plain Old Telephone Service (POTS), and so on was good enough then, modern systems must employ protections against attacks. ENiGMA½ comes with many security features that help keep the system and your users secure — not limited to: Passwords are never stored in plain-text, but instead are stored using Password-Based Key Derivation Function 2 (PBKDF2). Even the system operator can never know your password! Alternatives to insecure Telnet logins are built in: SSH and secure WebSockets for example. A built in web server with TLS support (aka HTTPS). Optional Two-Factor Authentication (2FA) via One-Time-Password (OTP) for users, supporting Google Authenticator, Time-Based One-Time Password Algorithm (TOTP, RFC-6238), and HMAC-Based One-Time Password Algorithm (HOTP, RFC-4266).","publisher":{"@type":"Organization","logo":{"@type":"ImageObject","url":"/enigma-bbs/assets/images/enigma-logo.png"}},"url":"/enigma-bbs/configuration/security.html","@type":"BlogPosting","headline":"Security","dateModified":"2023-08-27T23:25:06+00:00","datePublished":"2023-08-27T23:25:06+00:00","mainEntityOfPage":{"@type":"WebPage","@id":"/enigma-bbs/configuration/security.html"},"@context":"https://schema.org"}</script>
<!-- End Jekyll SEO tag -->

  </head>

  <body>

    <div id="container">
        <div class="sidebar" id="sidebar">
        <hr class="mobile-divide">
            <div class="container">
          <a href="/enigma-bbs/"><img src="/enigma-bbs/assets/images/enigma-logo.png" class="logo" alt="Enigma logo"></a>
            </div>

            <ul>


  <li>Installation</li>
  <ul>


    <li><a href="/enigma-bbs/installation/installation-methods.html">Installation Methods</a></li>


    <li><a href="/enigma-bbs/installation/install-script.html">Install Script</a></li>


    <li><a href="/enigma-bbs/installation/docker.html">Docker</a></li>


    <li><a href="/enigma-bbs/installation/manual.html">Manual Installation</a></li>


      <li>OS / Hardware Specific</li>
      <ul>


    <li><a href="/enigma-bbs/installation/hardware/rpi.html">Raspberry Pi</a></li>


    <li><a href="/enigma-bbs/installation/hardware/windows.html">Installation Under Windows</a></li>


    </ul>


    <li><a href="/enigma-bbs/installation/network.html">Network Setup</a></li>


    <li><a href="/enigma-bbs/installation/testing.html">Testing Your Installation</a></li>


    <li><a href="/enigma-bbs/installation/production.html">Production Installation</a></li>


      </ul>

  <li>Configuration</li>
  <ul>


    <li><a href="/enigma-bbs/configuration/creating-config.html">Creating Initial Config Files</a></li>


    <li><a href="/enigma-bbs/configuration/sysop-setup.html">SysOp Setup</a></li>


    <li><a href="/enigma-bbs/configuration/config-files.html">Configuration Files</a></li>


    <li><a href="/enigma-bbs/configuration/config-hjson.html">System Configuration</a></li>


    <li><a href="/enigma-bbs/configuration/hjson.html">HJSON Config Files</a></li>


    <li><a href="/enigma-bbs/configuration/menu-hjson.html">Menu HSJON</a></li>


    <li><a href="/enigma-bbs/configuration/directory-structure.html">Directory Structure</a></li>


    <li><a href="/enigma-bbs/configuration/external-binaries.html">External Support Binaries</a></li>


    <li><a href="/enigma-bbs/configuration/archivers.html">Archivers</a></li>


    <li><a href="/enigma-bbs/configuration/file-transfer-protocols.html">File Transfer Protocols</a></li>


    <li><a href="/enigma-bbs/configuration/email.html">Email</a></li>


    <li><a href="/enigma-bbs/configuration/colour-codes.html">Colour Codes</a></li>


    <li><a href="/enigma-bbs/configuration/event-scheduler.html">Event Scheduler</a></li>


    <li><a href="/enigma-bbs/configuration/acs.html">Access Condition System (ACS)</a></li>


      <li class="active-nav">Security</li>


      </ul>

  <li>Miscellaneous</li>
  <ul>


    <li><a href="/enigma-bbs/misc/user-interrupt.html">User Interruptions</a></li>


      </ul>

  <li>File Base</li>
  <ul>


    <li><a href="/enigma-bbs/filebase/index.html">About File Areas</a></li>


    <li><a href="/enigma-bbs/filebase/first-file-area.html">Configuring a File Base</a></li>


    <li><a href="/enigma-bbs/filebase/acs.html">ACS</a></li>


    <li><a href="/enigma-bbs/filebase/uploads.html">Uploads</a></li>


    <li><a href="/enigma-bbs/filebase/web-access.html">Web Access</a></li>


    <li><a href="/enigma-bbs/filebase/tic-support.html">TIC Support</a></li>


    <li><a href="/enigma-bbs/filebase/network-mounts-and-symlinks.html">Network Mounts &amp; Symlinks</a></li>


      </ul>

  <li>Message Areas</li>
  <ul>


    <li><a href="/enigma-bbs/messageareas/configuring-a-message-area.html">Message Base</a></li>


    <li><a href="/enigma-bbs/messageareas/message-networks.html">Message Networks</a></li>


    <li><a href="/enigma-bbs/messageareas/bso-import-export.html">BSO Import / Export</a></li>


    <li><a href="/enigma-bbs/messageareas/netmail.html">Netmail</a></li>


    <li><a href="/enigma-bbs/messageareas/qwk.html">QWK Support</a></li>


    <li><a href="/enigma-bbs/messageareas/ftn.html">FidoNet-Style Networks (FTN)</a></li>


      </ul>

  <li>Art</li>
  <ul>


    <li><a href="/enigma-bbs/art/general.html">General Art Information</a></li>


    <li><a href="/enigma-bbs/art/themes.html">Themes</a></li>


    <li><a href="/enigma-bbs/art/mci.html">MCI Codes</a></li>


      <li>Views</li>
      <ul>


    <li><a href="/enigma-bbs/art/views/button_view.html">Button View</a></li>


    <li><a href="/enigma-bbs/art/views/edit_text_view.html">Edit Text View</a></li>


    <li><a href="/enigma-bbs/art/views/full_menu_view.html">Full Menu View</a></li>


    <li><a href="/enigma-bbs/art/views/horizontal_menu_view.html">Horizontal Menu View</a></li>


    <li><a href="/enigma-bbs/art/views/mask_edit_text_view.html">Mask Edit Text View</a></li>


    <li><a href="/enigma-bbs/art/views/multi_line_edit_text_view.html">Multi Line Edit Text View</a></li>


    <li><a href="/enigma-bbs/art/views/spinner_menu_view.html">Spinner Menu View</a></li>


    <li><a href="/enigma-bbs/art/views/text_view.html">Text View</a></li>


    <li><a href="/enigma-bbs/art/views/toggle_menu_view.html">Toggle Menu View</a></li>


    <li><a href="/enigma-bbs/art/views/vertical_menu_view.html">Vertical Menu View</a></li>


    </ul>


      </ul>

  <li>Servers</li>
  <ul>


      <li>Login Servers</li>
      <ul>


    <li><a href="/enigma-bbs/servers/loginservers/telnet.html">Telnet Server</a></li>


    <li><a href="/enigma-bbs/servers/loginservers/ssh.html">SSH Server</a></li>


    <li><a href="/enigma-bbs/servers/loginservers/websocket.html">Web Socket / Web Interface Server</a></li>


    </ul>


      <li>Content Servers</li>
      <ul>


    <li><a href="/enigma-bbs/servers/contentservers/web-server.html">Web Server</a></li>


    <li><a href="/enigma-bbs/servers/contentservers/gopher.html">Gopher Server</a></li>


    <li><a href="/enigma-bbs/servers/contentservers/nntp.html">NNTP Server</a></li>


    </ul>


      </ul>

  <li>Modding</li>
  <ul>


    <li><a href="/enigma-bbs/modding/local-doors.html">Local Doors</a></li>


    <li><a href="/enigma-bbs/modding/door-servers.html">Door Servers</a></li>


    <li><a href="/enigma-bbs/modding/telnet-bridge.html">Telnet Bridge</a></li>


    <li><a href="/enigma-bbs/modding/existing-mods.html">Existing Mods</a></li>


    <li><a href="/enigma-bbs/modding/file-area-list.html">File Area List</a></li>


    <li><a href="/enigma-bbs/modding/last-callers.html">Last Callers</a></li>


    <li><a href="/enigma-bbs/modding/whos-online.html">Who's Online</a></li>


    <li><a href="/enigma-bbs/modding/user-list.html">User List</a></li>


    <li><a href="/enigma-bbs/modding/msg-conf-list.html">Message Conference List</a></li>


    <li><a href="/enigma-bbs/modding/msg-area-list.html">Message Area List</a></li>


    <li><a href="/enigma-bbs/modding/bbs-list.html">BBS List</a></li>


    <li><a href="/enigma-bbs/modding/rumorz.html">Rumorz</a></li>


    <li><a href="/enigma-bbs/modding/file-transfer-protocol-select.html">File Transfer Protocol Select</a></li>


    <li><a href="/enigma-bbs/modding/onelinerz.html">Onelinerz</a></li>


    <li><a href="/enigma-bbs/modding/show-art.html">The Show Art Module</a></li>


    <li><a href="/enigma-bbs/modding/file-base-download-manager.html">File Base Download Manager</a></li>


    <li><a href="/enigma-bbs/modding/file-base-web-download-manager.html">File Base Web Download Manager</a></li>


    <li><a href="/enigma-bbs/modding/set-newscan-date.html">Set Newscan Date Module</a></li>


    <li><a href="/enigma-bbs/modding/node-msg.html">Node to Node Messaging</a></li>


    <li><a href="/enigma-bbs/modding/top-x.html">TopX</a></li>


    <li><a href="/enigma-bbs/modding/user-2fa-otp-config.html">2FA/OTP Config</a></li>


    <li><a href="/enigma-bbs/modding/autosig-edit.html">Auto Signature Editor</a></li>


    <li><a href="/enigma-bbs/modding/menu-modules.html">Menu Modules</a></li>


      </ul>

  <li>Administration</li>
  <ul>


    <li><a href="/enigma-bbs/admin/administration.html">Administration</a></li>


      </ul>

  <li>Modding</li>
  <ul>


    <li><a href="/enigma-bbs/modding/wfc.html">Waiting For Caller (WFC)</a></li>


      </ul>

  <li>Administration</li>
  <ul>


    <li><a href="/enigma-bbs/admin/oputil.html">oputil</a></li>


    <li><a href="/enigma-bbs/admin/updating.html">Updating</a></li>


      </ul>

  <li>Troubleshooting</li>
  <ul>


    <li><a href="/enigma-bbs/troubleshooting/monitoring-logs.html">Monitoring Logs</a></li>


    </ul>


</ul>

        </div>
        <div class="main_area">
          <div class="container">
            <section id="main_content">
              <div class="PageNavigation">

              <a class="btn" style="float:left;margin-right: 20px;" href="/enigma-bbs/configuration/acs.html">« Access Condition System (ACS)</a>

              <a href="#sidebar" class="btn menu_button">MENU</a>

              <a class="btn" style="float: right;margin-left: 20px" href="/enigma-bbs/misc/user-interrupt.html">User Interruptions »</a>

              <br clear="both">
              </div>

                <div class="page">
    <h1 class="page-title">Security</h1>
    <h2 id="security">Security</h2>
<p>Unlike in the golden era of BBSing, modern Internet-connected systems are prone to hacking attempts, eavesdropping, etc. While plain-text passwords, insecure data over <a href="https://en.wikipedia.org/wiki/Plain_old_telephone_service">Plain Old Telephone Service (POTS)</a>, and so on was good enough then, modern systems must employ protections against attacks. ENiGMA½ comes with many security features that help keep the system and your users secure — not limited to:</p>
<ul>
  <li>Passwords are <strong>never</strong> stored in plain-text, but instead are stored using <a href="https://en.wikipedia.org/wiki/PBKDF2">Password-Based Key Derivation Function 2 (PBKDF2)</a>. Even the system operator can <em>never</em> know your password!</li>
  <li>Alternatives to insecure Telnet logins are built in: <a href="https://en.wikipedia.org/wiki/Secure_Shell">SSH</a> and secure <a href="https://en.wikipedia.org/wiki/WebSocket">WebSockets</a> for example.</li>
  <li>A built in web server with <a href="https://en.wikipedia.org/wiki/Transport_Layer_Security">TLS</a> support (aka HTTPS).</li>
  <li>Optional <a href="https://en.wikipedia.org/wiki/Multi-factor_authentication">Two-Factor Authentication (2FA)</a> via <a href="https://en.wikipedia.org/wiki/One-time_password">One-Time-Password (OTP)</a> for users, supporting <a href="http://google-authenticator.com/">Google Authenticator</a>, <a href="https://tools.ietf.org/html/rfc6238">Time-Based One-Time Password Algorithm (TOTP, RFC-6238)</a>, and <a href="https://tools.ietf.org/html/rfc4226">HMAC-Based One-Time Password Algorithm (HOTP, RFC-4266)</a>.</li>
</ul>

<h2 id="two-factor-authentication-via-one-time-password">Two-Factor Authentication via One-Time Password</h2>
<p>Enabling Two-Factor Authentication via One-Time-Password (2FA/OTP) on an account adds an extra layer of security (“<em>something a user has</em>”) in addition to their password (“<em>something a user knows</em>”). Providing 2FA/OTP to your users has some prerequisites:</p>
<ul>
  <li>
<a href="/enigma-bbs/configuration/email.html">A configured email gateway</a> such that the system can send out emails.</li>
  <li>One or more secure servers enabled such as <a href="../servers/ssh.md">SSH</a> or secure <a href="../servers/websocket.md">WebSockets</a> (that is, WebSockets over a secure connection such as TLS).</li>
  <li>The <a href="../servers/web-server.md">web server</a> enabled and exposed over TLS (HTTPS).</li>
</ul>

<blockquote>
  <p><img class="emoji" title=":information_source:" alt=":information_source:" src="https://github.githubassets.com/images/icons/emoji/unicode/2139.png" height="20" width="20"> For WebSockets and the web server, ENiGMA½ <em>may</em> listen on insecure channels if behind a secure web proxy.</p>
</blockquote>

<h3 id="user-registration-flow">User Registration Flow</h3>
<p>Due to the nature of 2FA/OTP, even if enabled on your system, users must opt-in and enable this feature on their account. Users must also have a valid email address such that a registration link can be sent to them. To opt-in, users must enable the option, which will cause the system to email them a registration link. Following the link provides the following:</p>

<ol>
  <li>A secret for manual entry into a OTP device.</li>
  <li>If applicable, a scannable QR code for easy device entry (e.g. Google Authenticator)</li>
  <li>A confirmation prompt in which the user must enter a OTP code. If entered correctly, this validates everything is set up properly and 2FA/OTP will be enabled for the account. Backup codes will also be provided at this time. Future logins will now prompt the user for their OTP after they enter their standard password.</li>
</ol>

<blockquote>
  <p><img class="emoji" title=":warning:" alt=":warning:" src="https://github.githubassets.com/images/icons/emoji/unicode/26a0.png" height="20" width="20"> Serving 2FA/OTP registration links over insecure (HTTP) can expose secrets intended for the user and is <strong>highly</strong> discouraged!</p>
</blockquote>

<blockquote>
  <p><img class="emoji" title=":memo:" alt=":memo:" src="https://github.githubassets.com/images/icons/emoji/unicode/1f4dd.png" height="20" width="20"> +ops can also manually enable or disable 2FA/OTP for a user using <a href="/enigma-bbs/admin/oputil.html">oputil</a>, but this is generally discouraged.</p>
</blockquote>

<h4 id="recovery">Recovery</h4>
<p>In the situation that a user loses their 2FA/OTP device (such as a lost phone with Google Auth), there are some options:</p>
<ul>
  <li>Utilize one of their backup codes.</li>
  <li>Contact the SysOp.</li>
</ul>

<p><img class="emoji" title=":warning:" alt=":warning:" src="https://github.githubassets.com/images/icons/emoji/unicode/26a0.png" height="20" width="20"> There is no way for a user to disable 2FA/OTP without first fully logging in! This is by design as a security measure.</p>

<h3 id="acs-checks">ACS Checks</h3>
<p>Various places throughout the system that implement <a href="/enigma-bbs/configuration/acs.html">ACS</a> can make 2FA specific checks:</p>
<ul>
  <li>
<code class="language-plaintext highlighter-rouge">AR#</code>: Current users <strong>required</strong> authentication factor. <code class="language-plaintext highlighter-rouge">AR2</code> for example means 2FA/OTP is required for this user.</li>
  <li>
<code class="language-plaintext highlighter-rouge">AF#</code>: Current users <strong>active</strong> authentication factor. <code class="language-plaintext highlighter-rouge">AF2</code> means the user is authenticated with some sort of 2FA (such as One-Time-Password).</li>
</ul>

<p>See <a href="/enigma-bbs/configuration/acs.html">ACS</a> for more information.</p>

<h4 id="example">Example</h4>
<p>The following example illustrates using an <code class="language-plaintext highlighter-rouge">AR</code> ACS check to require applicable users to go through an additional 2FA/OTP process during login:</p>

<pre><code class="language-hjson">login: {
    art: USERLOG
    next: [
        {
            //  users with AR2+ must first pass 2FA/OTP
            acs: AR2
            next: loginTwoFactorAuthOTP
        }
        {
            //  everyone else skips ahead
            next: fullLoginSequenceLoginArt
        }
    ]
    // ...
}
</code></pre>

</div>

              <div class="PageNavigation">

              <a class="btn" style="float:left;margin-right: 20px;" href="/enigma-bbs/configuration/acs.html">« Access Condition System (ACS)</a>


              <a class="btn" style="float: right;margin-left: 20px" href="/enigma-bbs/misc/user-interrupt.html">User Interruptions »</a>

              <br clear="both">
              </div>
            </section>
          </div>
        </div>
      </div>


  </body>
</html>