97 lines
2.4 KiB
Bash
Executable File
97 lines
2.4 KiB
Bash
Executable File
#!/bin/sh
|
|
#
|
|
# SQLite: Emergency script to disable a user's MFA (TOTP)
|
|
# Use this if a user is locked out of MFA (lost their authenticator app)
|
|
#
|
|
# Usage:
|
|
# docker exec -it dockhand /app/scripts/emergency/sqlite/reset-mfa.sh <username>
|
|
#
|
|
# Example:
|
|
# docker exec -it dockhand /app/scripts/emergency/sqlite/reset-mfa.sh admin
|
|
#
|
|
|
|
set -e
|
|
|
|
echo "========================================"
|
|
echo " Dockhand - Reset User MFA (SQLite)"
|
|
echo "========================================"
|
|
echo ""
|
|
|
|
# Check arguments
|
|
if [ -z "$1" ]; then
|
|
echo "Usage: $0 <username>"
|
|
echo ""
|
|
echo "Example:"
|
|
echo " $0 admin"
|
|
exit 1
|
|
fi
|
|
|
|
USERNAME="$1"
|
|
|
|
# Default database path
|
|
DB_PATH="${DOCKHAND_DB:-/app/data/db/dockhand.db}"
|
|
|
|
# Check if running locally (not in Docker)
|
|
if [ ! -f "$DB_PATH" ] && [ -f "./data/db/dockhand.db" ]; then
|
|
DB_PATH="./data/db/dockhand.db"
|
|
fi
|
|
|
|
if [ ! -f "$DB_PATH" ]; then
|
|
echo "Error: Database not found at $DB_PATH"
|
|
echo "Set DOCKHAND_DB environment variable to specify the database path"
|
|
exit 1
|
|
fi
|
|
|
|
# Check if user exists
|
|
EXISTING=$(sqlite3 "$DB_PATH" "SELECT COUNT(*) FROM users WHERE username='$USERNAME';")
|
|
|
|
if [ "$EXISTING" -eq "0" ]; then
|
|
echo "Error: User '$USERNAME' not found"
|
|
echo ""
|
|
echo "Available users:"
|
|
sqlite3 "$DB_PATH" "SELECT username FROM users;" | while read user; do
|
|
echo " - $user"
|
|
done
|
|
exit 1
|
|
fi
|
|
|
|
# Show current MFA state
|
|
MFA_ENABLED=$(sqlite3 "$DB_PATH" "SELECT mfa_enabled FROM users WHERE username='$USERNAME';")
|
|
if [ "$MFA_ENABLED" = "1" ] || [ "$MFA_ENABLED" = "true" ]; then
|
|
STATUS="enabled"
|
|
else
|
|
STATUS="already disabled"
|
|
fi
|
|
|
|
echo "This script will disable MFA (TOTP) for user '$USERNAME'."
|
|
echo "Backup codes will also be wiped — they cannot be reused."
|
|
echo ""
|
|
echo "Database: $DB_PATH"
|
|
echo "Username: $USERNAME"
|
|
echo "Current MFA: $STATUS"
|
|
echo ""
|
|
printf "Continue? [y/N]: "
|
|
read CONFIRM
|
|
|
|
case "$CONFIRM" in
|
|
[yY]|[yY][eE][sS])
|
|
;;
|
|
*)
|
|
echo "Aborted."
|
|
exit 0
|
|
;;
|
|
esac
|
|
|
|
echo ""
|
|
echo "Disabling MFA for user '$USERNAME'..."
|
|
sqlite3 "$DB_PATH" "UPDATE users SET mfa_enabled=0, mfa_secret=NULL, updated_at=datetime('now') WHERE username='$USERNAME';"
|
|
|
|
if [ $? -eq 0 ]; then
|
|
echo ""
|
|
echo "MFA disabled successfully for user '$USERNAME'."
|
|
echo "The user can now log in with just their password and can re-enable MFA from their profile."
|
|
else
|
|
echo "Error: Failed to disable MFA"
|
|
exit 1
|
|
fi
|