68 lines
4.9 KiB
PHP
68 lines
4.9 KiB
PHP
<?php
|
|
/**
|
|
* @author Daniel J. Summers <daniel@bitbadger.solutions>
|
|
* @license MIT
|
|
*/
|
|
|
|
declare(strict_types=1);
|
|
|
|
include '../../start.php';
|
|
|
|
FeedReaderCentral\Security::verifyUser(redirectIfAnonymous: false);
|
|
|
|
page_head('Security Modes | Documentation'); ?>
|
|
<h1>Configuring Security Modes</h1>
|
|
<p class=back-link><?=hx_get('./', '⟨⟨ Documentation Home')?>
|
|
<article class=docs>
|
|
<h2>Security Modes</h2>
|
|
<p><strong>Single-User</strong> mode assumes that every connection to the application is the same person. It is
|
|
designed for one person to use on a trusted internal network; under no circumstances should an instance
|
|
configured this way be reachable from the Internet. However, it is a low-friction way to keep up with feeds from
|
|
multiple devices on a home network.
|
|
<p><strong>Single-User with Password</strong> mode operates the same way as Single-User mode does, but the
|
|
application will require a password. Depending on the strength of the password, this model may be appropriate
|
|
for Internet access, but its intent is more for keeping other internal network users from accessing the site
|
|
and reading the items before its intended user is able to do so. The password should be set using the CLI.
|
|
<p><strong>Multi-User</strong> mode requires both an e-mail address and password before allowing the user to
|
|
proceed. It is the most appropriate configuration for an Internet-facing instance, and it can also be used to
|
|
provide access to multiple users on an internal network. Managing users is performed via the CLI.
|
|
<h2 id=manage-users>Managing Users in Multi-User Mode</h2>
|
|
<p>Users can be added or deleted, and passwords set, using the <code>user</code> CLI utility.<br><br>
|
|
<em>(For all the “password” parameters, if a character in the password conflicts with a shell escape
|
|
character, enclose the password in double-quotes for *sh or single-quotes for PowerShell.)</em>
|
|
<h3>Add a User</h3>
|
|
<p><code>php-cli utils/user.php add-user alice@example.com AlicesSecur3P4ssword</code>
|
|
<p>The utility should respond with the e-mail address and password that were added. If a user with that e-mail
|
|
address already exists, the utility will not add it again.
|
|
<h3>Set a User’s Password</h3>
|
|
<p><code>php-cli utils/user.php set-password bob@example.com AN3wPassCauseB0bForg0t1t</code>
|
|
<h3>Delete a User</h3>
|
|
<p><code>php-cli utils/user.php delete-user carol@example.com</code>
|
|
<p>The utility will require confirmation that the user and their feeds should be deleted. Any input that starts with
|
|
the letter “y” will confirm, and any other input will cancel the process.
|
|
<h2 id=change-to-multi>Changing from Single-User to Multi-User Mode</h2>
|
|
<p>In Single-User mode, the application uses a known e-mail address and password to mimic multi-user mode where that
|
|
user is always logged on. If you have been using the application this way, and decide that you want to run in
|
|
multi-user mode instead, you will need to update <code>SECURITY_MODEL</code> in <code>user-config.php</code> to
|
|
<code>Security::MultiUserMode</code>.
|
|
<p>The e-mail address used for Single-User mode is not allowed to log on in Multi-User mode. If you want to preserve
|
|
the feeds defined by the single user, use the CLI to replace its e-mail address and password.
|
|
<p><code>php-cli utils/user.php migrate-single-user dave@example.com Dav3sPas$wort</code>
|
|
<p>If, however, you do not wish to maintain the single user’s information at all, delete it.
|
|
<p><code>php-cli utils/user.php remove-single-user</code>
|
|
<h2 id=change-multi-to-single>Changing from Multi-User to any Single-User Mode</h2>
|
|
<p>This scenario is possible, but not really advisable. When the application is in any Single-User mode, it only
|
|
displays feeds from the Single-User mode user. The information for the other users remains in the database,
|
|
though, so this change is not destructive.
|
|
<h2 id=change-single-to-pw>Changing from Single-User to Single-User with Password Mode</h2>
|
|
<p>Set <code>SECURITY_MODEL</code> in <code>user-config.php</code> to <code>Security::SingleUserPasswordMode</code>,
|
|
then use the <code>user</code> CLI utility to set a password.
|
|
<p><code>php-cli util/user.php set-single-password aNiceC0mplexPassw0rd</code>
|
|
<h2 id=change-pw-to-single>Changing from Single-User with Password to Single-User Mode</h2>
|
|
<p>If you decide you do not want to enter a password, but want to maintain single-user mode, set
|
|
<code>SECURITY_MODEL</code> in <code>user-config.php</code> to <code>Security::SingleUserMode</code>, then run
|
|
the <code>user</code> CLI utility to reset the single user back to its expected default.
|
|
<p><code>php-cli util/user.php reset-single-password</code>
|
|
</article><?php
|
|
page_foot();
|