authelia/internal/suites/NetworkACL/configuration.yml

###############################################################
#                Authelia minimal configuration               #
###############################################################

port: 9091

logs_level: debug

jwt_secret: unsecure_password

authentication_backend:
  file:
    path: /var/lib/authelia/users.yml

session:
  secret: unsecure_session_secret
  domain: example.com
  expiration: 3600 # 1 hour
  inactivity: 300 # 5 minutes

# Configuration of the storage backend used to store data and secrets. i.e. totp data
storage:
  local:
    path: /var/lib/authelia/db.sqlite

# Access Control
#
# Access control is a set of rules you can use to restrict user access to certain
# resources.
access_control:
  default_policy: deny
  rules:
    - domain: secure.example.com
      policy: one_factor
      networks:
        - 192.168.240.201/32

    - domain: secure.example.com
      policy: bypass
      networks:
        - 192.168.240.202/32
        - 192.168.240.203/32

    - domain: secure.example.com
      policy: two_factor

# Configuration of the authentication regulation mechanism.
regulation:
  # Set it to 0 to disable max_retries.
  max_retries: 3
  # The user is banned if the authenticaction failed `max_retries` times in a `find_time` seconds window.
  find_time: 300
  # The length of time before a banned user can login again.
  ban_time: 900

notifier:
  # Use a SMTP server for sending notifications
  smtp:
    host: smtp
    port: 1025
    sender: admin@example.com
    disable_require_tls: true
Add network criteria in ACLs to specify policy based on network subnet. 2019-03-28 05:09:01 +07:00			`###############################################################`
			`# Authelia minimal configuration #`
			`###############################################################`

			`port: 9091`

			`logs_level: debug`

Bootstrap Go implementation of Authelia. This is going to be the v4. Expected improvements: - More reliable due to static typing. - Bump of performance. - Improvement of logging. - Authelia can be shipped as a single binary. - Will likely work on ARM architecture. 2019-04-25 04:52:08 +07:00			`jwt_secret: unsecure_password`

Add network criteria in ACLs to specify policy based on network subnet. 2019-03-28 05:09:01 +07:00			`authentication_backend:`
			`file:`
Fix and parallelize integration tests. 2019-11-30 23:49:52 +07:00			`path: /var/lib/authelia/users.yml`
Add network criteria in ACLs to specify policy based on network subnet. 2019-03-28 05:09:01 +07:00
			`session:`
			`secret: unsecure_session_secret`
			`domain: example.com`
Update expiration timeouts from milliseconds to seconds. 2019-12-06 15:59:32 +07:00			`expiration: 3600 # 1 hour`
			`inactivity: 300 # 5 minutes`
Add network criteria in ACLs to specify policy based on network subnet. 2019-03-28 05:09:01 +07:00
			`# Configuration of the storage backend used to store data and secrets. i.e. totp data`
			`storage:`
			`local:`
Allow administrator to provide a Google Analytics tracking ID. Providing a GA tracking ID allows administrators to analyze how the portal is used by their users in large environments, i.e., with many users. This will make even more sense when we have users and admins management interfaces. 2019-12-07 23:40:42 +07:00			`path: /var/lib/authelia/db.sqlite`
Add network criteria in ACLs to specify policy based on network subnet. 2019-03-28 05:09:01 +07:00
			`# Access Control`
			`#`
Declare suites as Go structs and bootstrap e2e test framework in Go. Some tests are not fully rewritten in Go, a typescript wrapper is called instead until we remove the remaining TS tests and dependencies. Also, dockerize every components (mainly Authelia backend, frontend and kind) so that the project does not interfere with user host anymore (open ports for instance). The only remaining intrusive change is the one done during bootstrap to add entries in /etc/hosts. It will soon be avoided using authelia.com domain that I own. 2019-11-02 21:32:58 +07:00			`# Access control is a set of rules you can use to restrict user access to certain`
Add network criteria in ACLs to specify policy based on network subnet. 2019-03-28 05:09:01 +07:00			`# resources.`
			`access_control:`
			`default_policy: deny`
			`rules:`
			`- domain: secure.example.com`
			`policy: one_factor`
			`networks:`
			`- 192.168.240.201/32`

			`- domain: secure.example.com`
			`policy: bypass`
			`networks:`
			`- 192.168.240.202/32`
			`- 192.168.240.203/32`

			`- domain: secure.example.com`
			`policy: two_factor`

			`# Configuration of the authentication regulation mechanism.`
Declare suites as Go structs and bootstrap e2e test framework in Go. Some tests are not fully rewritten in Go, a typescript wrapper is called instead until we remove the remaining TS tests and dependencies. Also, dockerize every components (mainly Authelia backend, frontend and kind) so that the project does not interfere with user host anymore (open ports for instance). The only remaining intrusive change is the one done during bootstrap to add entries in /etc/hosts. It will soon be avoided using authelia.com domain that I own. 2019-11-02 21:32:58 +07:00			`regulation:`
Add network criteria in ACLs to specify policy based on network subnet. 2019-03-28 05:09:01 +07:00			`# Set it to 0 to disable max_retries.`
			`max_retries: 3`
Declare suites as Go structs and bootstrap e2e test framework in Go. Some tests are not fully rewritten in Go, a typescript wrapper is called instead until we remove the remaining TS tests and dependencies. Also, dockerize every components (mainly Authelia backend, frontend and kind) so that the project does not interfere with user host anymore (open ports for instance). The only remaining intrusive change is the one done during bootstrap to add entries in /etc/hosts. It will soon be avoided using authelia.com domain that I own. 2019-11-02 21:32:58 +07:00			# The user is banned if the authenticaction failed `max_retries` times in a `find_time` seconds window.
Add network criteria in ACLs to specify policy based on network subnet. 2019-03-28 05:09:01 +07:00			`find_time: 300`
			`# The length of time before a banned user can login again.`
			`ban_time: 900`

			`notifier:`
			`# Use a SMTP server for sending notifications`
			`smtp:`
Declare suites as Go structs and bootstrap e2e test framework in Go. Some tests are not fully rewritten in Go, a typescript wrapper is called instead until we remove the remaining TS tests and dependencies. Also, dockerize every components (mainly Authelia backend, frontend and kind) so that the project does not interfere with user host anymore (open ports for instance). The only remaining intrusive change is the one done during bootstrap to add entries in /etc/hosts. It will soon be avoided using authelia.com domain that I own. 2019-11-02 21:32:58 +07:00			`host: smtp`
Add network criteria in ACLs to specify policy based on network subnet. 2019-03-28 05:09:01 +07:00			`port: 1025`
			`sender: admin@example.com`
Force TLS and valid x509 certs in SMTP Notifier by default - Adjust AUTH LOGIN functionality to be closer to AUTH PLAIN - Removed: secure (notifier smtp conf) boolean string - Added: disable_verify_cert (notifier smtp conf) boolean - disables X509 validation of certificates - Added: disable_require_tls (notifier smtp conf) boolean - allows emails to be sent over plain text (for non-authenticated only) - Added: trusted_cert (notifier smtp conf) string (path) - allows specifying the path of a PEM format cert to add to trusted cert pool - Make SMTP notifier return errors on connection over plain text - Make SMTP notifier return errors on TLS connection with invalid certs - Implemented various debug logging for the SMTP notifier - Implemented explicit SMTP closes on errors (previously left con open) - Split SMTPNotifier Send func to seperate funcs for: - writing future test suites and startup checks more easily - organization and readability - Add details of changes to docs/security.yml - Adjust config.yml's (template and test) for the changes 2019-12-30 09:03:51 +07:00			`disable_require_tls: true`