Portal - CyberMind-FR/secubox-deb GitHub Wiki

Portal โ€” entry and session page ๐ŸŸ 

EN | FR | ๐ŸŸ  AUTH | the box's front door: services, session, protection

What it is for. secubox-portal provides the login of the box and the /portal/ page: a read-only overview of the services, the identity and sessions of the person logged in, the protection state and the certificates. It decides nothing: it only displays.

  • Package: secubox-portal ยท page /portal/ ยท API /api/v1/portal/ ยท config /etc/secubox/portal.toml
  • Accounts are read from /etc/secubox/users.json (same store as secubox-auth).

The /portal/ page โ€” Services et session

Read-only. Without a session the page says "Aucune mesure : session requise" with a link to the login form; a missing measurement shows "โ€”", never a made-up zero. ?embed=1 embeds it (it announces its height), ?demo=1 shows fictitious data under an orange banner.

Block Content
Tiles health score and uptime, services online (WAF, HAProxy, nginx, system), active sessions and accounts, logins in 24 h, active bans, valid certificates and next renewal
Services the four services tracked by the health report; a link is offered only when it exists
Quick access links to the main panels, system resources
Session and identity who is logged in (/portal/verify)
Open sessions administrator sessions
Protection today's WAF activity
Certificates summary from the certificate monitor, see Certificates
Cookies ยท GDPR cookie audit summary
Most visited sites / origin networks last 60 minutes, by host and by AS
Latest events the 5 latest portal events

A search box filters services, links and sites.

API

Method Path Guard Purpose
GET /health none liveness
GET /status read version, number of sessions and accounts
GET /summary read accounts, logins 24 h, recent events, webhooks
GET /verify read validity and identity of the current session
GET /theme, /branding read look of the login page
POST /login, /logout, /recover login open and close a session; password recovery
GET/DELETE /sessions, /sessions/{user} session list or close sessions
GET/POST/DELETE /users, /users/create, /users/{user}, /users/change-password session accounts
GET /history, /stats session events and counters
GET/POST/DELETE /webhooks session notifications

Operations note โ€” login.html is a shared path

The login form is the file /usr/share/secubox/www/login.html. It is shipped by secubox-portal alone (Replaces/Breaks: secubox-hub (<< 1.9.6~)). It handles the password step, the TOTP challenge for enrolled users, forced TOTP enrolment for the administrator, the one-minute elevation token handed over by the identity manager (#elevation=โ€ฆ) and ?deconnexion=1.

Why this matters. An old secubox-hub build used to ship its own bootstrap login.html (without TOTP) at the same path. Reinstalling it replaced the TOTP page: the administrator could no longer finish logging in, sessions.json stayed empty, and since sessions fail closed every module rejected every session โ€” a box-wide lockout.

  • Never ship login.html from another package, and never copy a stale one by hand.
  • After reinstalling or downgrading secubox-hub or secubox-portal, check that the file is the portal's (it must contain the TOTP step).
  • If a lockout happens, restore the portal's login.html from the secubox-portal package and log in again to recreate the sessions.
  • The /portal/ page redesign (portal 2.4.0) does not touch login.html.

See also