Cloudron Forum

Live demo

Hello everyone,

Ctfreak allows for the centralized execution of various types of tasks:

• Shell scripts (bash/powershell) on multiple servers concurrently via SSH
• SQL scripts on multiple databases concurrently (mysql/mariadb/postgresql)
• HTTP request calls
• Workflows (to launch other tasks)

It also provides the ability to send notifications based on the results.

Some use cases include:

• Replacing all the crontabs on your servers
• Running your scripts through a nice and responsive web app
• Regularly checking if your website is still up
• ...

The FREE Edition has some restrictions but does the job for personal use or small and medium-sized enterprises.

I'm offering to package it for Cloudron (it's easier for me since I'm the author ), but before that, I would like to know if you're interested?

I have released ctfreak 1.10.1 to facilitate integration with Cloudron: there is no longer a need to wait for the next Cloudron release to enable OIDC.

Here are the details:

https://git.cloudron.io/cloudron/ctfreak-app/-/issues/1

Insert directly into the database? I'll have nightmares if we choose that path

I suggest going through the API instead (which will keep the script functional in case of modifications made to the database in future revisions).

On a new running instance of ctfreak (which still has its default admin account), we should launch (only once):

# Install jq & curl
apt install jq curl -y

# Retrieve access token for default user 'admin'
API_ACCESS_TOKEN=$(curl -s --request POST --url 'http://localhost:6700/api/v1/token?grant_type=password&username=admin&password=ctfreak' | jq --raw-output '.access_token')

# Add cloudron auth provider
curl -s --request POST \
  --url http://localhost:6700/api/v1/authProviders \
  --header "authorization: Bearer ${API_ACCESS_TOKEN}" \
  --header 'content-type: application/json' \
  --data '{"name":"Cloudron","enabledFg":true,"authProviderType":"OIDC","oidcAuthProvider":{"clientId":"'$CLOUDRON_OIDC_CLIENT_ID'","clientSecret":"'$CLOUDRON_OIDC_CLIENT_SECRET'","discoveryEndpoint":"'$CLOUDRON_OIDC_DISCOVERY_URL'"}}'

Options to add to manifest:

"oidc": {
    "loginRedirectUri": "/oidc/callback",
    "logoutRedirectUri": "/",
    "tokenSignatureAlgorithm": "RS256"
}

(I haven't tested it with cloudron)

@DualOSWinWiz With release 1.17.0, there is now a 5-second delay between failed login attempts.

Hi

@nebulon

I tried to package ctfreak for cloudron:

https://github.com/jypsoftware/ctfreak-cloudron

I was able to test it successfully on my test Cloudron instance.

Hello,

Indeed, there must be at least one local admin account, with the purpose of ensuring access is still possible even if the OIDC server becomes unavailable.

If the goal is to secure access, @nebulon 's suggestion (a strong unique password) is the right one.

No, but there is at least a one-second delay between each attempt.

Let's imagine a bot attempting to log in with a different password every second. In 5 years, it would have time to test 5x365x24x3600 = 1.5x10^8 combinations.

Now, if you choose a password of only 10 characters from [a-zA-Z0-9], that gives 8.4x10^17 combinations.

Before the bot finds your password, you have at least a few million years ahead of you...

While waiting for me to start packaging, you can perform a quick test using:

docker run --name ctfreak -p 6700:6700 -e TZ=Europe/Paris jypsoftware/ctfreak

@girish

Alright. Here is my account: https://git.cloudron.io/jypelle

Thx @marcusquinn !!

https://ctfreak.com/download/version

or

https://hub.docker.com/r/jypsoftware/ctfreak/tags

@girish https://ctfreak.com/docs/changelog#v1-5-1

Great! Thx @nebulon

Hi robi

You have to create a telegram bot and retrieve its API Token and ChatID.

@girish license file is here: https://github.com/jypsoftware/ctfreak-cloudron/blob/master/ctfreak-app/LICENSE

Would you prefer me to move the file to the root directory?

Thx @nebulon, I will not hesitate to come back to you if I have any questions.

Great!

For OIDC configuration, unfortunately, at the moment, it can only be done through the web interface. However, I'll make a note of it as a possible future enhancement.