fix: a service account may be named by a GUID in lowercase, as the Router Manager proposes for a new one.

fix: the package installs vpnrouter_passkeys, without which the web service and vpn-router-user do not start.
feature: users sign in to the Router Manager with passkeys, and console login needs a TOTP token, so a user without one is refused the shell, SSH and sudo.
2026-10-26 09:11:13 +01:00 · 2026-10-26 08:40:24 +01:00 · 2026-10-26 08:35:10 +01:00 · 2026-10-26 07:56:23 +01:00 · 2026-10-26 07:18:39 +01:00 · 2026-10-26 02:59:56 +01:00
14 changed files with 774 additions and 117 deletions
@@ -909,7 +909,10 @@ Manager cannot set it. The shell runs as the console account of the signed-in us
 it is never root and each administrator's shell is the administrator's own; a user without
 console login gets none. `POST /shell` signs the user in again with the password
 and TOTP code and gives a one-time ticket valid 30 seconds; a WebSocket on `GET /shell` with that
-ticket gets the shell. The WebSocket of RFC 6455 is implemented on the standard library inside the
+ticket gets the shell. Asking for the password and code at every opening of the page is tiresome,
+so within `web.shell_auth_timeout` minutes of the user's last sign-in or keystroke a ticket is given
+without them; the times are kept in the web service's memory only, so a restart asks again, and 0
+keeps the sign-in at every opening. The WebSocket of RFC 6455 is implemented on the standard library inside the
 web service's `http.server`, server side only, without extensions. `systemd-run --pty` starts the
 shell in a transient unit with a PAM login session, outside the sandbox, and `setsid --ctty`
 makes the terminal its controlling terminal so window sizes reach the shell. A shell idle for
@@ -942,10 +945,62 @@ so slapd's otp overlay and password policy apply as for the Router Manager: the
 by the code, and the lockout. Members of `vpn-router-console` get sudo with that password. SSH
 accepts it only while `ssh.ldap_login` is set, in a `Match Group` drop-in of sshd. Switching console
 login off keeps the `posixAccount`, hidden by nslcd's filter, so the uid and the home stay the
-user's; leaving `admins` switches it off.
+user's; leaving `admins` switches it off. A console reaches root through sudo, so a password alone
+must not open one: console login needs a TOTP token. Switching it on is refused without one, and
+the token is checked at use rather than only when it is switched on, because an administrator can
+remove it later: the shell's ticket and every minute of an open shell check it, nslcd's
+`pam_authz_search` requires `oathTOTPUser`, and removing the token ends the sessions of the user's
+own POSIX account.

 Consequences: Each administrator's shell, SSH session and sudo run as the administrator, logged
 under the administrator's name. The directory becomes part of the system's name service through
-nslcd, and the system knows only the accounts with console login on. A user enrolled for TOTP types
-the code after the password at the SSH and sudo prompts. Homes are created at the first login and
+nslcd, and the system knows only the accounts with console login on. The user types the code
+after the password at the SSH and sudo prompts. An administrator whose console login was switched
+on before the token was required is refused until enrolling. Homes are created at the first login and
 are not removed with the user. A password is changed through the directory, not with `passwd`.
+
+## ADR-35: WireGuard peers are the devices of the VPN users, kept in the directory
+
+Context: The WireGuard endpoint could be switched on from the Router Manager, but its peers were
+written by hand into `wg0.conf`, so nobody could connect without SSH. A peer is a P2S client like
+an OpenVPN or IKEv2 user, and one person may have several devices.
+
+Decision: A VPN user's entry holds the user's WireGuard peers in the multi-valued attribute
+`vpnRouterWireGuardPeer`, one value `<public key> <IP>[,<IP>...]` per device; the router never
+sees a private key. `PUT /users/<name>` replaces a user's peers after checking the keys, which
+are unique, and the IPs, which do not overlap another peer's or cover the router's address. Setup
+reads the peers of the users who are not disabled from the directory and writes them as a marked
+block of `[Peer]` sections into `wg0.conf`; sections outside the block, added by hand, stay. A
+change of the peers, and disabling, enabling or removing a user with peers, restart setup. The
+Router Manager adds and removes peers on the WireGuard tab of Remote access management, where the
+endpoint is, choosing the user for each.
+
+Consequences: Peers follow their users: disabling a user drops the user's devices, and the
+directory's backup holds them. A peer cannot exist without a VPN user. A change restarts
+`wg-quick@wg0` through setup, which briefly interrupts the other peers.
+
+## ADR-36: Passkeys sign in to the Router Manager only, verified by the router with python3-fido2
+
+Context: Typing the password and a TOTP code at every sign-in to the Router Manager is tedious.
+WebAuthn needs a browser, HTTPS and a domain name; OpenVPN, IKEv2, WireGuard, SSH and sudo have no
+browser, and the sudo PAM module for security keys needs the key at the router. The router signs
+users in (`/auth`) and keeps them in its directory. The standard library cannot read CBOR or COSE
+keys; Ubuntu packages Yubico's python-fido2 in noble (1.1) and resolute (2.0), whose server API is
+the same once the JSON mapping of WebAuthn Level 3 is switched on, which 2.0 always uses.
+
+Decision: A passkey is a discoverable credential with user verification of the relying party
+`wan.local_fqdn`, with the user name as its user handle, so the sign-in needs no name. The router
+registers and verifies passkeys with python3-fido2 in `vpnrouter_passkeys`; the origin must be
+HTTPS on that name, which python-fido2 checks. Each passkey is a JSON value of the multi-valued
+`vpnRouterPasskey` on the user's entry, with the public key only. Registration needs the current
+password and code, so a session alone cannot add a lasting way in; removal needs neither. A
+passkey sign-in gives the same tokens as `/auth`; as it binds no password, the router checks that
+the user is enabled, not locked and not a service account. The begun steps are kept in the web
+service's memory for 2 minutes. The browser converts the options and answers with
+`PublicKeyCredential.parseCreationOptionsFromJSON`, `parseRequestOptionsFromJSON` and `toJSON`.
+
+Consequences: Passkeys are a convenience for the Router Manager; the password and code stay for
+everything else, the shell included. A changed `wan.local_fqdn` orphans every passkey. The
+Router Manager on another name, or in development on `localhost`, cannot use them. Failed passkey
+sign-ins do not count towards the directory's lockout, but the sign-in calls are rate limited.
+Browsers without the JSON methods of WebAuthn Level 3 cannot add or use passkeys.
@@ -114,7 +114,7 @@ must have the type shown below; an unknown section or setting is an error.
 | `p2s` | `enabled` | boolean | `false` | Road-warrior access |
 | `p2s` | `address_pool` | string | | CIDR assigned to road-warrior clients |
 | `wireguard` | `enabled` | boolean | `false` | WireGuard endpoint |
-| `wireguard` | `address` | string | | Address and prefix for `wg0`, for example `192.168.200.1/24` |
+| `wireguard` | `address` | string | | The router's own address on `wg0` with the prefix of the peers' network, for example `192.168.200.1/24`; the network and the broadcast address of a network larger than /31 are refused |
 | `wireguard` | `listen_port` | integer | `51820` | UDP port |
 | `openvpn` | `enabled` | boolean | `false` | OpenVPN access for users |
 | `openvpn` | `address_pool` | string | | IPv4 CIDR assigned to OpenVPN clients |
@@ -130,6 +130,7 @@ must have the type shown below; an unknown section or setting is an error.
 | `web` | `status_content` | string | `basic` | What `/` and `/status` show: `basic`, `standard` or `full` (see Status web service) |
 | `web` | `shell` | boolean | `false` | `/shell` opens a login shell for a member of `admins` with console login (see The shell) |
 | `web` | `shell_idle_minutes` | integer | `15` | Minutes without a keystroke after which a shell is closed, 1 to 1440 |
+| `web` | `shell_auth_timeout` | integer | `15` | Minutes after the last use of a shell in which a new shell opens without signing in again, 0 (always sign in) to 1440 |
 | `ssh` | `ldap_login` | boolean | `false` | sshd accepts the directory password of the console accounts in the directory (see Console login and SSH) |
 | `https` | `enabled` | boolean | `true` | Caddy serves the status web service and the Router Manager over HTTPS for `wan.local_fqdn` |
 | `https` | `email` | string | | The e-mail address of the Let's Encrypt account |
@@ -237,9 +238,17 @@ an FQDN or an IPv4 or IPv6 address. They are written to the strongSwan configura
 strongSwan reads an address as an IP identity and a name as an FQDN, so a leading `@` is not needed
 and is refused. Road-warrior and OpenVPN access need a name in `wan.local_fqdn`.

-WireGuard peers are added by hand in `/etc/wireguard/wg0.conf`. The package owns the
-`[Interface]` section of that file and rewrites it when the settings above change, but it
-carries every `[Peer]` section across untouched.
+WireGuard peers are P2S users' devices: a VPN user of the router's directory may have up to 16
+peers, each with its public key and its IPs, IPv4 addresses or networks, kept in the user's
+entry (`vpnRouterWireGuardPeer`) and set with `PUT /users/<name>` (`wireguard_peers`) or on the
+WireGuard tab of the Router Manager's Remote access management. A key is used by one peer only,
+the IPs of two peers may not overlap, and no peer's IPs cover the router's own address of
+`wireguard.address`. The package owns the `[Interface]` section of `/etc/wireguard/wg0.conf` and,
+between the lines `# BEGIN` and `# END WireGuard peers of the users of the router's directory`, a
+`[Peer]` section for each peer of a user who is not disabled; setup rewrites them when the
+settings or the peers change, and a change of a user's peers, disabling, enabling or removing a
+user with peers restarts setup. Every other `[Peer]` section, added by hand, is carried across
+untouched. While the directory cannot be reached, the users' peers in the file stay as they are.

 Every feature is independent. Leaving a group empty simply means that feature is not
 configured, and its generated files are removed.
@@ -691,7 +700,7 @@ vpn-router-user otp-remove alice

 | Command | Effect |
 | --- | --- |
-| `list` | The users with their kind, names and e-mail addresses, whether each is enabled or locked, has a certificate and is enrolled for TOTP |
+| `list` | The users with their kind, names and e-mail addresses, whether each is enabled or locked, has a certificate and is enrolled for TOTP, the number of passkeys and the console login |
 | `add <name> --first-name F --last-name L --email E` | Adds a VPN user and issues the certificate |
 | `add <name> [--email E]` | Adds a Manager-only account, with the e-mail address when given; one name without the other two options is refused |
 | `add <name> --service [--display-name N] [--description D] [--email E]` | Adds a service account, with its display name, description and e-mail address when given; the names are refused |
@@ -704,10 +713,13 @@ vpn-router-user otp-remove alice
 | `profile <name>` | The OpenVPN client profile, with the CA, the certificate and the key inline |
 | `otp-new <name>` | A new TOTP secret and its `otpauth://` URI, issued by `wan.local_fqdn`, for an authenticator app; nothing is stored |
 | `otp-enrol <name> <code>` | Stores the secret read from standard input when the code is a current code of it, replacing a secret the user has |
-| `otp-remove <name>` | Removes the user's TOTP secret |
-| `console <name> (--posix \| --account LOCAL \| --off)` | Switches the console login of a member of `admins` on, as the user's own POSIX account or a local account, or off (see Console login and SSH) |
+| `otp-remove <name>` | Removes the user's TOTP secret and ends the sessions of the user's own POSIX account |
+| `console <name> (--posix \| --account LOCAL \| --off)` | Switches the console login of a member of `admins` enrolled for TOTP on, as the user's own POSIX account or a local account, or off (see Console login and SSH) |
+| `passkeys-remove <name>` | Removes all the user's passkeys (see Passkeys) |

-A user name is 1 to 32 lowercase letters, digits and hyphens, starting with a letter; a
+A user name is 1 to 32 lowercase letters, digits and hyphens, starting with a letter, and a
+service account may instead be named by a GUID in lowercase, such as
+`3f2b8c1e-9a4d-4e6f-8b2a-1c5d7e9f0a3b`; a
 password has 8 to 128 characters; a first or last name has 1 to 64 printable characters; an
 e-mail address has one `@`, no spaces and a dot in its domain; a TOTP secret is 32 base32
 characters, as `otp-new` makes it, and a code 6 digits. Once enrolled, a user logs in to OpenVPN
@@ -728,9 +740,12 @@ certificates only, so `disable` does not affect it; `remove` revokes the certifi

 ### Console login and SSH

-A member of `admins` may have console login: the Router Manager's Shell page (see The shell),
-and, for the user's own POSIX account, SSH and sudo. Only root on the router switches it, with
-`vpn-router-user console` or a token of `vpn-router-token`, as for the group `admins`:
+A member of `admins` enrolled for TOTP may have console login: the Router Manager's Shell page
+(see The shell), and, for the user's own POSIX account, SSH and sudo. Only root on the router
+switches it, with `vpn-router-user console` or a token of `vpn-router-token`, as for the group
+`admins`. Switching it on is refused without the enrolment, and a user whose enrolment is removed
+is refused the shell, SSH and sudo until enrolling again; the user's open shells end within a
+minute, and removing the enrolment ends the sessions of the user's own POSIX account:

 ```sh
 vpn-router-user console alice --posix
@@ -742,9 +757,8 @@ vpn-config-edit set ssh.ldap_login true
 - **Own POSIX account** (`--posix`): the user's entry becomes a `posixAccount` of the directory
  with the user's name, a uid from 20000 up, the local group `vpn-router-console` as its group,
  `/home/<name>` and `/bin/bash`. `nslcd` makes it known to the system over slapd's local socket
-  and checks its password by binding as the user, so a user enrolled for TOTP types the password
-  followed by a current code, failed logins count towards the lockout, and a disabled user cannot
-  sign in. The home is created at the first login and kept when the user is removed. Members of
+  and checks its password by binding as the user, so the user types the password followed by a
+  current code, failed logins count towards the lockout, and a disabled user cannot sign in. The home is created at the first login and kept when the user is removed. Members of
  `vpn-router-console` may run any command with sudo, with the same password. A local account of
  the same name is refused.
 - **Local account** (`--account`): the console runs as an existing local account with a uid from
@@ -758,6 +772,26 @@ While `ssh.ldap_login` is `true`, setup lets sshd accept the password of the mem
 settings. A password change is made in the Router Manager or with `vpn-router-user passwd`, not
 with `passwd`.

+### Passkeys
+
+A user who is not a service account may sign in to the Router Manager with a passkey instead of
+the password and code. Passkeys are for that sign-in only: OpenVPN, the shell, SSH and sudo keep
+the password and code. A passkey belongs to `wan.local_fqdn`, so the browser offers it on the
+Router Manager's HTTPS address on that name, and passkeys need the name set; a passkey made
+before the name changes is no longer offered. The authenticator checks the user (a PIN or a
+fingerprint), and the passkey is kept by it or by the user's password manager.
+
+A user adds a passkey on the Router Manager's Account page with the current password and code,
+and removes it there. Each passkey is a value of `vpnRouterPasskey` on the user's entry, with its
+public key, label and the time it was added; a user has at most 10. An administrator removes all
+passkeys of a user on the Users page, through `/users`, or with:
+
+```sh
+vpn-router-user passkeys-remove alice
+```
+
+A disabled or locked user is refused a passkey sign-in too.
+
 ### Managing groups

 `vpn-router-group` manages the groups. A group has a name, with the rules of a user name, an
@@ -928,7 +962,9 @@ vpn-router-token --json --days 30

 | Request | Body | Answer |
 | --- | --- | --- |
-| `POST /auth` | `{"name", "password", "code"}`; `code` only for a user enrolled for TOTP | the tokens |
+| `POST /auth` | `{"name", "password", "code"}`; `code` only for a user enrolled for TOTP | the tokens and `"name"` |
+| `POST /auth/passkey` | `{}` | `{"id", "options"}`: a pending sign-in, valid 2 minutes, and the options of `navigator.credentials.get` in their JSON form |
+| `POST /auth/passkey/complete` | `{"id", "credential"}`, `credential` the browser's answer as its `toJSON()` gives it | the tokens and `"name"`, the user whose passkey signed |
 | `POST /auth/refresh` | `{"refresh_token"}` | new tokens; the refresh token given is used up |
 | `POST /auth/logout` | `{"refresh_token"}` | `{"revoked": true}`, or `false` for a token not known |

@@ -937,7 +973,9 @@ The tokens are `{"access_token", "token_type": "Bearer", "expires_in": 300, "ref
 get 401 with the same message; a refresh token is refused once its user is disabled, locked or
 removed. Changing a user's password, disabling, unlocking or removing the user revokes the
 user's refresh tokens. Five failed logins lock the account for 15 minutes (see the user
-directory). `/auth` and `/auth/refresh` take at most 10 calls a minute from one client address,
+directory). A passkey that does not sign, is not the user's, or of a disabled, locked or service
+account gets 401 too (see Passkeys). `/auth`, `/auth/passkey/complete` and `/auth/refresh` take
+at most 10 calls a minute from one client address,
 and answer 429 with `Retry-After` beyond that; for a call from one of `web.trusted_proxies`, by
 default the address the call came in on, the client address is the last entry of
 `X-Forwarded-For`.
@@ -961,8 +999,8 @@ every service and tunnel while the public status page shows less.

 ### The shell

-While `web.shell` is `true`, `/shell` gives a member of `admins` whose console login is on (see
-Console login and SSH) a login shell on the router, as the user's console account, for the
+While `web.shell` is `true`, `/shell` gives a member of `admins` whose console login is on and
+who is enrolled for TOTP (see Console login and SSH) a login shell on the router, as the user's console account, for the
 Router Manager's Shell page. It is off by default and switched on and off on the router only:

 ```sh
@@ -972,17 +1010,20 @@ vpn-config-edit set web.shell true

 | Request | Body | Answer |
 | --- | --- | --- |
-| `POST /shell` | `{"password", "code"}`; `code` only for a user enrolled for TOTP | `{"ticket", "expires_in": 30}` |
+| `POST /shell` | `{"password", "code"}`; `{}` within `web.shell_auth_timeout` | `{"ticket", "expires_in": 30}` |
 | `GET /shell?ticket=<ticket>` | a WebSocket handshake | the terminal |

 `POST /shell` needs an access token of `/auth`, not one of `vpn-router-token`, and signs its user
 in again: a wrong password or code gets 403 and counts as a failed login; it gets 403 too while
-`web.shell` is `false` or the user's console login is off. The ticket opens one
+`web.shell` is `false`, the user's console login is off or the user is not enrolled for TOTP. Without a password it gives a ticket
+while the user's last sign-in of `POST /shell` or keystroke in a shell is less than
+`web.shell_auth_timeout` minutes ago, and `{"ticket": null}` otherwise. The ticket opens one
 shell for the same user within 30 seconds. Over the WebSocket, binary messages of the client
 are keystrokes, a text message `{"cols", "rows"}` sets the window size, and binary messages of
 the router are the terminal's output. The shell is a PAM login session of the console account,
 run by `systemd-run` in a transient unit `vpn-router-shell-<id>`; sudo works as for SSH. It is closed after `web.shell_idle_minutes` without a keystroke, when the shell
-exits, or when the connection closes; the router then sends a close frame with the reason. The
+exits, when the connection closes, or within a minute of the user's console login being switched
+off or the TOTP enrolment removed; the router then sends a close frame with the reason. The
 journal of `vpn-router-web` records who opened each shell, from which address, in which unit,
 when it ended and why, and each refused ticket or shell with the reason.

@@ -998,7 +1039,7 @@ when it ended and why, and each refused ticket or shell with the reason.
 | `wireguard` | The public key and port of `wg0`, and each peer's public key, endpoint, allowed IPs, handshake age and traffic; no private or preshared key |
 | `docker` | `docker.exposed_ports` and the rules of the `VPN-ROUTER-DOCKER` chain |
 | `postgresql` | `clusters`: each PostgreSQL cluster of `pg_lsclusters` with its version, name, port, status and data directory, and for one that is online its `settings`: `server_version`, `listen_addresses`, `port`, `max_connections`, `shared_buffers`, `effective_cache_size`, `work_mem`, `password_encryption`, `ssl` and `timezone`; `null` when `pg_lsclusters` fails |
-| `caddy` | The installed Caddy: `version`, and `source`, `upstream` once Caddy's repository is configured and `ubuntu` otherwise; `null` when Caddy is not installed |
+| `caddy` | The installed Caddy: `version`, `source`, `upstream` once Caddy's repository is configured and `ubuntu` otherwise, and `service`, the state of `caddy.service`; `null` when Caddy is not installed |

 ### The /postgresql page

@@ -1017,9 +1058,9 @@ and answer bodies are JSON; a request body is at most 65536 bytes.

 | Request | Body | Answer |
 | --- | --- | --- |
-| `GET /users` | | `{"users": [{"name", "manager_only", "service", "internal", "enabled", "locked", "certificate", "otp", "console", "first_name", "last_name", "email"}, ...]}`; `console` is `null` or `{"enabled", "account", "local", "uid"}` |
+| `GET /users` | | `{"users": [{"name", "manager_only", "service", "internal", "enabled", "locked", "certificate", "otp", "console", "wireguard_peers", "passkeys", "first_name", "last_name", "email"}, ...], "wireguard": {"enabled", "address"}}`; `console` is `null` or `{"enabled", "account", "local", "uid"}`, `wireguard_peers` a list of `{"public_key", "ips"}`, `passkeys` a list of `{"id", "label", "created"}`, and `wireguard` the endpoint's settings, whose network the peers' addresses come from |
 | `POST /users` | `{"name", "password", "first_name", "last_name", "email"}` for a VPN user; `{"name", "password", "email"?}` for a Manager-only account | 201 and the user |
-| `PUT /users/<name>` | any of `{"first_name", "last_name", "email"}`; for a Manager-only account only `{"email"}`, `""` removing it | the user |
+| `PUT /users/<name>` | any of `{"first_name", "last_name", "email", "wireguard_peers"}`; `wireguard_peers`, `[{"public_key", "ips"}]`, replaces a VPN user's WireGuard peers (see Configuration); for a Manager-only account only `{"email"}`, `""` removing it | the user |
 | `PUT /users/<name>/password` | `{"password": ...}` | the user |
 | `POST /users/<name>/disable` | | the user |
 | `POST /users/<name>/enable` | | the user |
@@ -1029,6 +1070,7 @@ and answer bodies are JSON; a request body is at most 65536 bytes.
 | `POST /users/<name>/otp` | | `{"name", "secret", "uri"}`, a new TOTP secret; nothing is stored |
 | `PUT /users/<name>/otp` | `{"secret", "code"}` | the user, once the code matches the secret |
 | `DELETE /users/<name>/otp` | | the user |
+| `DELETE /users/<name>/passkeys` | | the user, without passkeys |
 | `PUT /users/<name>/console` | `{"enabled", "account"?}`; only with a token of `vpn-router-token` | the user |

 A failure is `{"error": ...}` with 400 for an invalid request, 404 for a user that does not
@@ -1075,8 +1117,11 @@ router manages them, their display name and description included. A failure is o
 | `PUT /account/password` | `{"current_password", "current_code", "password"}` | the user |
 | `POST /account/otp` | | `{"name", "secret", "uri"}`, a new TOTP secret; nothing is stored |
 | `PUT /account/otp` | `{"current_password", "current_code", "secret", "code"}` | the user, once the code matches the secret |
+| `POST /account/passkeys` | `{"current_password", "current_code"}` | `{"id", "options"}`: a pending registration, valid 2 minutes, and the options of `navigator.credentials.create` in their JSON form |
+| `PUT /account/passkeys` | `{"id", "credential", "label"?}`, `credential` the browser's answer as its `toJSON()` gives it; `label` at most 64 characters, `Passkey` without one | the user |
+| `DELETE /account/passkeys/<id>` | | the user |

-`current_code` is needed only for a user enrolled for TOTP. A wrong current password or code gets
+`current_code` is needed only for a user enrolled for TOTP; removing a passkey needs neither. A wrong current password or code gets
 403 and counts as a failed login; slapd accepts each code once, so a code used to sign in is not
 accepted again, and a change right after signing in waits for the next code. A user enrols or
 replaces the enrolment; removing it is left to `/users` and `vpn-router-user`. Changing the
@@ -1149,7 +1194,7 @@ OpenVPN (`openvpn`) and WireGuard (`wireguard`), with the same token as `/users`

 | Request | Body | Answer |
 | --- | --- | --- |
-| `GET /remote-access` | | `{"p2s", "openvpn", "wireguard", "running", "local_fqdn"}` |
+| `GET /remote-access` | | `{"p2s", "openvpn", "wireguard", "running", "local_fqdn", "wireguard_server"}`; `wireguard_server` is `{"public_key", "endpoint", "allowed_ips"}`: the router's WireGuard public key (`null` before setup made it), `<wan.local_fqdn>:<wireguard.listen_port>` (`null` without a name) and the networks a peer reaches through the tunnel, the router's local CIDRs and the WireGuard network |
 | `PUT /remote-access/<system>` | any of the settings of the section `p2s`, `openvpn` or `wireguard` | the section |

 `running` tells for each system whether setup runs it. IKEv2 and OpenVPN run once enabled with an
@@ -1,3 +1,99 @@
+vpn-router (0.26.2-1) unstable; urgency=medium
+
+  fix: a service account may be named by a GUID in lowercase, as the Router Manager proposes for a new one.
+
+  * vpn-router-user add --service and POST /service-accounts take a GUID
+    in lowercase as the name, besides a user name; users and groups keep
+    the rules of user names.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Mon, 26 Oct 2026 10:00:00 +0100
+
+vpn-router (0.26.1-1) unstable; urgency=medium
+
+  fix: the package installs vpnrouter_passkeys, without which the web service and vpn-router-user do not start.
+
+  * /usr/lib/vpn-router/vpnrouter_passkeys.py is part of the package.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Mon, 26 Oct 2026 08:45:00 +0100
+
+vpn-router (0.26.0-1) unstable; urgency=medium
+
+  feature: users sign in to the Router Manager with passkeys, and console login needs a TOTP token, so a user without one is refused the shell, SSH and sudo.
+
+  * Console login is switched on only for a user enrolled for TOTP. A user
+    whose console login is on without a token is refused POST /shell, the
+    shell's WebSocket, SSH and sudo; an open shell ends within a minute of
+    the token's removal or of console login being switched off, and
+    removing the token ends the sessions of the user's own POSIX account.
+  * POST /auth/passkey and /auth/passkey/complete sign a user in with a
+    passkey of wan.local_fqdn, giving the tokens of /auth; POST /auth also
+    answers the user's name.
+  * POST, PUT /account/passkeys and DELETE /account/passkeys/<id> add, with
+    the current password and code, and remove the user's passkeys, at most
+    10, kept in the new attribute vpnRouterPasskey; DELETE
+    /users/<name>/passkeys and vpn-router-user passkeys-remove remove all
+    passkeys of a user.
+  * Users have passkeys, [{"id", "label", "created"}], in /users and
+    /account; vpn-router-user list shows their number and a console login
+    refused for want of a TOTP token.
+  * The package depends on python3-fido2.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Tue, 03 Nov 2026 08:00:00 +0100
+
+vpn-router (0.25.4-1) unstable; urgency=medium
+
+  fix: a shell opens without the password and code again while the user's last use of a shell is within web.shell_auth_timeout minutes.
+
+  * New setting web.shell_auth_timeout, 15 minutes by default, 0 to 1440:
+    POST /shell without a password gives a ticket while the user's last
+    sign-in of POST /shell or keystroke in a shell is within it, and a
+    null ticket otherwise; 0 asks for the password and code every time.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Tue, 03 Nov 2026 06:00:00 +0100
+
+vpn-router (0.25.3-1) unstable; urgency=medium
+
+  fix: /config gives the state of caddy.service with the installed Caddy, for the Router Manager's Web page.
+
+  * caddy of /config is {"version", "source", "service"}.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Tue, 03 Nov 2026 05:00:00 +0100
+
+vpn-router (0.25.2-1) unstable; urgency=medium
+
+  fix: wireguard.address must be the router's own address in its network, not the network or broadcast address, from which the peers' addresses are told apart.
+
+  * A wireguard.address that is the network or the broadcast address of a
+    network larger than /31, such as 192.168.232.0/24, is refused with the
+    first address of the network as the example.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Tue, 03 Nov 2026 02:30:00 +0100
+
+vpn-router (0.25.1-1) unstable; urgency=medium
+
+  fix: /remote-access gives the router's WireGuard public key, endpoint and allowed IPs, which a peer's configuration needs.
+
+  * GET /remote-access answers wireguard_server: {"public_key",
+    "endpoint", "allowed_ips"}.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Tue, 03 Nov 2026 01:30:00 +0100
+
+vpn-router (0.25.0-1) unstable; urgency=medium
+
+  feature: a VPN user has WireGuard peers, each a device with its public key and IPs, kept in the directory and written into wg0.conf by setup.
+
+  * PUT /users/<name> takes wireguard_peers, [{"public_key", "ips"}],
+    which replaces the user's peers; keys are unique and IPs may not
+    overlap another peer's or cover the router's WireGuard address.
+  * GET /users answers each user's wireguard_peers and the WireGuard
+    endpoint's enabled and address.
+  * Setup writes a [Peer] section into wg0.conf for each peer of a user
+    who is not disabled, in a marked block, and keeps the peers added by
+    hand; changing a user's peers, disabling, enabling or removing a user
+    with peers applies at once.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Tue, 03 Nov 2026 00:00:00 +0100
+
 vpn-router (0.24.1-1) unstable; urgency=medium

  fix: the status gives the number of connected OpenVPN clients at most 5 seconds old instead of up to a minute.
@@ -22,6 +22,7 @@ Depends: ${misc:Depends},
         python3-jinja2,
         python3-ldap,
         python3-pyotp,
+         python3-fido2,
         python3-psycopg,
         python3-psutil,
         python3-prometheus-client,
@@ -4,6 +4,7 @@ src/usr/lib/vpn-router/vpnrouter_ldap.py              usr/lib/vpn-router/
 src/usr/lib/vpn-router/vpnrouter_net.py               usr/lib/vpn-router/
 src/usr/lib/vpn-router/vpnrouter_serve.py             usr/lib/vpn-router/
 src/usr/lib/vpn-router/vpnrouter_users.py             usr/lib/vpn-router/
+src/usr/lib/vpn-router/vpnrouter_passkeys.py          usr/lib/vpn-router/
 src/usr/lib/vpn-router/vpnrouter_auth.py              usr/lib/vpn-router/
 src/usr/lib/vpn-router/vpnrouter_metrics.py           usr/lib/vpn-router/
 src/usr/lib/vpn-router/vpnrouter_status.py            usr/lib/vpn-router/
@@ -587,7 +587,7 @@ def manage_console(cfg):
            f'base {vpnrouter_ldap.BASE}',
            'filter passwd (&(objectClass=posixAccount)(vpnRouterConsoleLogin=TRUE))',
            f'nss_min_uid {vpnrouter_ldap.CONSOLE_UID_MIN}',
-            'pam_authz_search (&(objectClass=posixAccount)(uid=$username)(vpnRouterConsoleLogin=TRUE))',
+            'pam_authz_search (&(objectClass=posixAccount)(objectClass=oathTOTPUser)(uid=$username)(vpnRouterConsoleLogin=TRUE))',
            'pam_password_prohibit_message The password is changed in the Router Manager or with vpn-router-user.',
            '',
        ])
@@ -38,6 +38,11 @@ SITE_TO_SITE   = SWANCTL_CONF_D / 'site-to-site.conf'
 ROAD_WARRIOR   = SWANCTL_CONF_D / 'road-warrior.conf'
 P2S_FORWARDER  = pathlib.Path('/etc/systemd/resolved.conf.d/p2s-forwarder.conf')
 WG_CONF        = pathlib.Path('/etc/wireguard/wg0.conf')
+#: The router's WireGuard public key, which setup writes with its private key.
+WG_PUBLIC_KEY  = pathlib.Path('/etc/wireguard/wg0.pub')
+#: The lines around the [Peer] sections of the users' WireGuard peers in WG_CONF, which setup writes from the directory.
+WG_PEERS_BEGIN = "# BEGIN WireGuard peers of the users of the router's directory"
+WG_PEERS_END   = "# END WireGuard peers of the users of the router's directory"
 OPENVPN_CONF   = pathlib.Path('/etc/openvpn/server/vpn-router.conf')
 OPENVPN_LDAP   = pathlib.Path('/etc/openvpn/server/vpn-router-ldap.conf')

@@ -53,7 +58,7 @@ SCHEMA = {
    'openvpn':    {'enabled': False, 'address_pool': '', 'port': 1194, 'protocol': 'udp'},
    'docker':     {'mode': 'auto', 'exposed_ports': []},
    'web':        {'enabled': True, 'listen': DEFAULT_LISTEN, 'port': 7081, 'database': '', 'trusted_proxies': [],
-                   'status_content': 'basic', 'shell': False, 'shell_idle_minutes': 15},
+                   'status_content': 'basic', 'shell': False, 'shell_idle_minutes': 15, 'shell_auth_timeout': 15},
    'ssh':        {'ldap_login': False},
    'https':      {'enabled': True, 'email': '', 'web_port': 7444, 'manager_port': 7443, 'caddy_source': 'ubuntu'},
    'pki':        {'root_name': 'VPN Router Root CA', 'root_days': 7300, 'ca_days': 3650, 'key': 'rsa-4096',
@@ -196,7 +201,7 @@ CA_NAME_MAX = 64
 #: What / and /status of the web service show, web.status_content, from the least to the most.
 STATUS_CONTENTS = ('basic', 'standard', 'full')

-#: The longest web.shell_idle_minutes, a day.
+#: The longest web.shell_idle_minutes and web.shell_auth_timeout, a day.
 SHELL_IDLE_MAX = 1440

 DOCKER_MODES = ('auto', 'on', 'off')
@@ -453,10 +458,16 @@ def validate(cfg):
    wg_address = _get(cfg, 'wireguard', 'address')
    if wg_address:
        try:
-            ipaddress.ip_interface(wg_address)
+            interface = ipaddress.ip_interface(wg_address)
        except ValueError:
            raise ConfigError(
                f'wireguard.address: {wg_address!r} is not an address with prefix')
+        # The router's own address on wg0, from which the peers' addresses of the same network are told apart.
+        network = interface.network
+        if network.num_addresses > 2 and interface.ip in (network.network_address, network.broadcast_address):
+            raise ConfigError(
+                f'wireguard.address: {wg_address} is the network or broadcast address of {network}; give the '
+                f'router\'s own address in it, such as {next(network.hosts())}/{network.prefixlen}')

    port = _get(cfg, 'wireguard', 'listen_port')
    if not 1 <= port <= 65535:
@@ -488,6 +499,9 @@ def validate(cfg):
    shell_idle = _get(cfg, 'web', 'shell_idle_minutes')
    if not 1 <= shell_idle <= SHELL_IDLE_MAX:
        raise ConfigError(f'web.shell_idle_minutes: {shell_idle} is not between 1 and {SHELL_IDLE_MAX}')
+    shell_auth = _get(cfg, 'web', 'shell_auth_timeout')
+    if not 0 <= shell_auth <= SHELL_IDLE_MAX:
+        raise ConfigError(f'web.shell_auth_timeout: {shell_auth} is not between 0 and {SHELL_IDLE_MAX}')

    https_ports = []
    for option in ('web_port', 'manager_port'):
@@ -887,6 +901,8 @@ def build_context(cfg, public_ip=None):
        'wg_enabled':      _get(cfg, 'wireguard', 'enabled'),
        'wg_address':      _get(cfg, 'wireguard', 'address'),
        'wg_listen_port':  _get(cfg, 'wireguard', 'listen_port'),
+        'wg_peers_begin':  WG_PEERS_BEGIN,
+        'wg_peers_end':    WG_PEERS_END,
        'openvpn_enabled': _get(cfg, 'openvpn', 'enabled'),
        'openvpn_pool':    openvpn_pool,
        'openvpn_network': str(openvpn_network.network_address) if openvpn_network else '',
@@ -981,27 +997,38 @@ def render(env, ctx, template_name, dest, mode):


 def existing_peers(path):
-    """Return the [Peer] sections of an existing WireGuard config.
+    """The block of the users' peers and the [Peer] sections added by hand of an existing WireGuard config, each ''
+    without one.

-    Peers are added by the operator by hand, so re-rendering the [Interface]
-    section must not discard them.
+    The block lies between WG_PEERS_BEGIN and WG_PEERS_END; the [Peer] sections outside it are the operator's, which
+    re-rendering the file keeps.
    """
    path = pathlib.Path(path)
    if not path.is_file():
-        return ''
-    lines = path.read_text(encoding='utf-8').splitlines(keepends=True)
+        return '', ''
+    text = path.read_text(encoding='utf-8')
+    block = ''
+    begin, end = text.find(WG_PEERS_BEGIN), text.find(WG_PEERS_END)
+    if begin != -1 and end > begin:
+        block = text[begin:end + len(WG_PEERS_END)]
+        text = text[:begin] + text[end + len(WG_PEERS_END):]
+    lines = text.splitlines(keepends=True)
    for index, line in enumerate(lines):
        if line.strip().lower() == '[peer]':
-            return ''.join(lines[index:])
-    return ''
+            return block, ''.join(lines[index:])
+    return block, ''


 def render_wg_conf(env, ctx, dest=WG_CONF, mode=0o600):
-    """Render wg0.conf, carrying any operator-defined peers across."""
-    content = env.get_template('wg0.conf.j2').render(ctx)
-    peers = existing_peers(dest)
-    if peers:
-        content = content.rstrip('\n') + '\n\n' + peers
+    """Render wg0.conf: the [Interface], the block of the users' peers of ctx's wg_peers, the block the file holds while
+    wg_peers is None, and the peers the operator added by hand, carried across."""
+    content = env.get_template('wg0.conf.j2').render(ctx).rstrip('\n') + '\n'
+    block, own = existing_peers(dest)
+    if ctx['wg_peers'] is not None:
+        block = env.get_template('wg0-peers.conf.j2').render(ctx).strip('\n') if ctx['wg_peers'] else ''
+    for part in (block, own):
+        if part.strip():
+            content += '\n' + part.strip('\n') + '\n'

    dest = pathlib.Path(dest)
    if dest.exists() and dest.read_text(encoding='utf-8') == content:
@@ -1070,6 +1097,13 @@ def configure(cfg=None, public_ip=None):
            notices = [f'the PKI is left as it is: the directory cannot be reached: {exc}']
    for notice in notices:
        warn(notice)
+    # The WireGuard peers of the users; None keeps those of wg0.conf while the directory cannot be reached.
+    ctx['wg_peers'] = None
+    if wg_ready(ctx):
+        try:
+            ctx['wg_peers'] = vpnrouter_ldap.wireguard_peers()
+        except ldap.LDAPError as exc:
+            warn(f'the WireGuard peers of the users are left as they are: the directory cannot be reached: {exc}')
    # What needs the router's own certificates.
    ctx['server_certificate'] = vpnrouter_pki.VPN_SERVER_CERT.is_file()
    for connection in ctx['connections']:
@@ -66,7 +66,9 @@ OVERLAYS = ('ppolicy', 'otp')
 #: authorization scopes, of which service marks a service account, displayName and
 #: description, the labels of a service account, and vpnRouterConsoleLogin and
 #: vpnRouterConsoleAccount, whether the user may use a console and the local account it runs as,
-#: without which it runs as the user's own posixAccount. vpnRouterAuthority is a CA of the PKI: its
+#: without which it runs as the user's own posixAccount, and vpnRouterWireGuardPeer, each a
+#: WireGuard peer of the user as "<public key> <IP>[,<IP>...]", and vpnRouterPasskey, each a
+#: passkey of the user as JSON (vpnrouter_passkeys). vpnRouterAuthority is a CA of the PKI: its
 #: certificate and CRL (cACertificate and certificateRevocationList of RFC 4523), its key, the
 #: CSR it waits with for the offline root, the number of its last CRL, where the CRL came from,
 #: and when it was retired. vpnRouterCertificate is a certificate a CA issued, named by its
@@ -97,11 +99,15 @@ SCHEMA_ATTRIBUTE_TYPES = (
    "EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )",
    f"( {SCHEMA_OID}.1.14 NAME 'vpnRouterConsoleAccount' DESC 'VPN router: the local account the console of the user runs as' "
    f"{_STRING} )",
+    f"( {SCHEMA_OID}.1.15 NAME 'vpnRouterWireGuardPeer' DESC 'VPN router: a WireGuard peer of the user, its public key and IPs' "
+    "EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024} )",
+    f"( {SCHEMA_OID}.1.16 NAME 'vpnRouterPasskey' DESC 'VPN router: a passkey of the user, its credential as JSON' "
+    "EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{4096} )",
 )
 SCHEMA_OBJECT_CLASSES = (
    f"( {SCHEMA_OID}.2.1 NAME 'vpnRouterAccount' DESC 'VPN router: properties of a user or a Manager-only account' "
    "SUP top AUXILIARY MAY ( mail $ vpnRouterScope $ displayName $ description $ vpnRouterConsoleLogin $ "
-    "vpnRouterConsoleAccount ) )",
+    "vpnRouterConsoleAccount $ vpnRouterWireGuardPeer $ vpnRouterPasskey ) )",
    f"( {SCHEMA_OID}.2.2 NAME 'vpnRouterAuthority' DESC 'VPN router: a CA of the PKI' SUP top STRUCTURAL MUST cn "
    "MAY ( cACertificate $ certificateRevocationList $ vpnRouterPrivateKey $ vpnRouterCertificateRequest $ "
    "vpnRouterCRLNumber $ vpnRouterCRLSource $ vpnRouterRetired ) )",
@@ -116,6 +122,9 @@ TOTP_ALGORITHM = '1.2.840.113549.2.7'
 TOTP_PERIOD = 30
 TOTP_WINDOW = 1

+#: The value of pwdAccountLockedTime that disables a user until it is enabled again.
+DISABLED = '000001010000Z'
+
 #: The indexes of the database.
 INDEXES = ('objectClass eq', 'uid eq', 'uidNumber eq', 'vpnRouterConsoleLogin eq')

@@ -287,6 +296,23 @@ def _ensure_manager(connection):
        MANAGER_SECRET.write_text(password, encoding='utf-8')


+def wireguard_peers():
+    """The WireGuard peers of the users who are not disabled, read as root: [(user, public key, [IP, ...])], sorted."""
+    connection = root()
+    try:
+        found = connection.search_s(USERS, ldap.SCOPE_ONELEVEL,
+                                    f'(&(vpnRouterWireGuardPeer=*)(!(pwdAccountLockedTime={DISABLED})))',
+                                    ['uid', 'vpnRouterWireGuardPeer'])
+    finally:
+        connection.unbind_s()
+    peers = []
+    for _, attributes in found:
+        for value in attributes['vpnRouterWireGuardPeer']:
+            key, _, ips = value.decode().partition(' ')
+            peers.append((attributes['uid'][0].decode(), key, ips.split(',')))
+    return sorted(peers)
+
+
 def provision():
    """Create or bring up to date the modules, the package's schema, database, ACLs, password policy, entries and service account."""
    connection = root()
@@ -0,0 +1,173 @@
+"""The passkeys of the router's users, for signing in to the Router Manager, with python3-fido2.
+
+A passkey is a discoverable WebAuthn credential with user verification, of the relying party
+wan.local_fqdn, so the browser offers it at the Router Manager's address on that name over HTTPS.
+Its user handle is the user name. Each passkey of a user is a value of vpnRouterPasskey on the
+user entry: a JSON object {"id", "credential", "label", "created"}, id the credential ID and
+credential the attested credential data (with the public key), both base64url. A user has at
+most PASSKEYS_MAX passkeys; service accounts have none.
+
+Registration and sign-in are two steps each: begin answers the options for the browser and a
+pending id, whose state the web service keeps in memory for PENDING_SECONDS; complete takes the
+id and the browser's answer. A request that cannot be done raises vpnrouter_users.Failure, with
+the statuses of that module; a sign-in that fails gives status 5 whatever the reason.
+"""
+
+import json
+import secrets
+import threading
+import time
+
+import fido2.features
+import ldap
+from fido2.server import Fido2Server
+from fido2.utils import websafe_decode, websafe_encode
+from fido2.webauthn import (AttestedCredentialData, PublicKeyCredentialRpEntity, PublicKeyCredentialUserEntity,
+                            ResidentKeyRequirement, UserVerificationRequirement)
+
+import vpnrouter
+import vpnrouter_users
+
+# The options and the browser's answers are in the JSON mapping of WebAuthn Level 3; python3-fido2 2.0 always uses it.
+_json_mapping = getattr(fido2.features, 'webauthn_json_mapping', None)
+if _json_mapping is not None:
+    _json_mapping.enabled = True
+
+#: The most passkeys of one user.
+PASSKEYS_MAX = 10
+#: The longest label of a passkey, in characters.
+LABEL_MAX = 64
+#: Seconds a begun registration or sign-in may be completed.
+PENDING_SECONDS = 120
+#: The most begun registrations and sign-ins kept at once.
+PENDING_MAX = 1000
+
+#: The begun registrations and sign-ins: pending id -> (kind, user name or None, state, monotonic time of expiry).
+_pending = {}
+_lock = threading.Lock()
+
+
+def server():
+    """The Fido2Server of the relying party wan.local_fqdn; passkeys need the name."""
+    fqdn = vpnrouter.load_config()['wan']['local_fqdn'].strip()
+    if not fqdn:
+        raise vpnrouter_users.Failure('passkeys need wan.local_fqdn, the name the Router Manager is reached at', 2)
+    return Fido2Server(rp=PublicKeyCredentialRpEntity(name=fqdn, id=fqdn))
+
+
+def keep(kind, name, state):
+    """Keep the state of a begun step and answer its pending id."""
+    pending = secrets.token_urlsafe(24)
+    now = time.monotonic()
+    with _lock:
+        for old in [key for key, (*_, expires) in _pending.items() if expires <= now]:
+            del _pending[old]
+        if len(_pending) >= PENDING_MAX:
+            raise vpnrouter_users.Failure('too many passkey requests at once; retry in a moment')
+        _pending[pending] = (kind, name, state, now + PENDING_SECONDS)
+    return pending
+
+
+def take(kind, name, pending):
+    """The state of a begun step of the kind and user, used up; None when it is unknown or expired."""
+    with _lock:
+        found = _pending.pop(pending, None) if isinstance(pending, str) else None
+    if found is None or found[0] != kind or found[1] != name or found[3] <= time.monotonic():
+        return None
+    return found[2]
+
+
+def credentials(attributes):
+    """The attested credential data of the passkeys of an entry."""
+    return [AttestedCredentialData(websafe_decode(passkey['credential']))
+            for _, passkey in vpnrouter_users.passkeys_of(attributes)]
+
+
+def register_begin(connection, name):
+    """Begin the registration of a passkey of the user: {"id", "options"}, options those of navigator.credentials.create."""
+    current = vpnrouter_users.entry(connection, name)
+    if vpnrouter_users.service(current):
+        raise vpnrouter_users.Failure(f'{name} is a service account, which has no passkeys', 2)
+    if len(vpnrouter_users.passkeys_of(current)) >= PASSKEYS_MAX:
+        raise vpnrouter_users.Failure(f'user {name} has {PASSKEYS_MAX} passkeys, the most; remove one first', 2)
+    options, state = server().register_begin(
+        PublicKeyCredentialUserEntity(id=name.encode(), name=name, display_name=name),
+        credentials(current),
+        resident_key_requirement=ResidentKeyRequirement.REQUIRED,
+        user_verification=UserVerificationRequirement.REQUIRED,
+    )
+    return {'id': keep('register', name, state), 'options': dict(options)}
+
+
+def register_complete(connection, name, pending, response, label):
+    """Store the passkey the browser created for a begun registration, with its label; the user (vpnrouter_users.summary)."""
+    state = take('register', name, pending)
+    if state is None:
+        raise vpnrouter_users.Failure('the registration is unknown or expired; begin it again', 2)
+    if label is None or (isinstance(label, str) and not label.strip()):
+        label = 'Passkey'
+    if not isinstance(label, str) or len(label.strip()) > LABEL_MAX:
+        raise vpnrouter_users.Failure(f'the label must be text of at most {LABEL_MAX} characters', 2)
+    if not isinstance(response, dict):
+        raise vpnrouter_users.Failure('credential must be the answer of navigator.credentials.create as JSON', 2)
+    try:
+        data = server().register_complete(state, response).credential_data
+    except (ValueError, KeyError, TypeError) as exc:
+        raise vpnrouter_users.Failure(f'the passkey is refused: {exc}', 2)
+    current = vpnrouter_users.entry(connection, name)
+    value = json.dumps({
+        'id': websafe_encode(data.credential_id),
+        'credential': websafe_encode(bytes(data)),
+        'label': label.strip(),
+        'created': time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime()),
+    }, separators=(',', ':'))
+    changes = [] if 'vpnrouteraccount' in vpnrouter_users.classes(current) else [(ldap.MOD_ADD, 'objectClass', [b'vpnRouterAccount'])]
+    changes.append((ldap.MOD_ADD, 'vpnRouterPasskey', [value.encode()]))
+    connection.modify_s(vpnrouter_users.dn_of(name), changes)
+    return vpnrouter_users.summary(vpnrouter_users.entry(connection, name))
+
+
+def remove(connection, name, passkey_id=None):
+    """Remove the user's passkey of the id, or all its passkeys without one; the user (vpnrouter_users.summary)."""
+    current = vpnrouter_users.entry(connection, name)
+    values = current.get('vpnRouterPasskey', [])
+    kept = [value for value, passkey in vpnrouter_users.passkeys_of(current)
+            if passkey_id is not None and passkey['id'] != passkey_id]
+    if passkey_id is not None and len(kept) == len(vpnrouter_users.passkeys_of(current)):
+        raise vpnrouter_users.Failure(f'user {name} has no passkey {passkey_id}', 3)
+    if len(kept) != len(values):
+        connection.modify_s(vpnrouter_users.dn_of(name), [(ldap.MOD_REPLACE, 'vpnRouterPasskey', kept)])
+    return vpnrouter_users.summary(vpnrouter_users.entry(connection, name))
+
+
+def login_begin():
+    """Begin a sign-in with a passkey: {"id", "options"}, options those of navigator.credentials.get, for any user."""
+    options, state = server().authenticate_begin(user_verification=UserVerificationRequirement.REQUIRED)
+    return {'id': keep('login', None, state), 'options': dict(options)}
+
+
+def login_complete(connection, pending, response):
+    """The name of the user whose passkey signed a begun sign-in, when the user is enabled, not locked and not a
+    service account."""
+    refused = vpnrouter_users.Failure('the passkey is not accepted', 5)
+    state = take('login', None, pending)
+    if state is None or not isinstance(response, dict):
+        raise refused
+    try:
+        name = websafe_decode(response['response']['userHandle']).decode()
+    except (KeyError, TypeError, ValueError):
+        raise refused
+    if not vpnrouter_users.NAME.match(name):
+        raise refused
+    try:
+        current = vpnrouter_users.entry(connection, name)
+    except vpnrouter_users.Failure:
+        raise refused
+    user = vpnrouter_users.summary(current)
+    if user['service'] or not user['enabled'] or user['locked']:
+        raise refused
+    try:
+        server().authenticate_complete(state, credentials(current), response)
+    except (ValueError, KeyError, TypeError):
+        raise refused
+    return name
@@ -20,19 +20,27 @@ optional description and at least one member; a group cannot be empty, so the la
 cannot leave it and a user who is the last member of a group cannot be removed. Groups only
 record membership; nothing on the router reads them.

+A VPN user may have WireGuard peers, each a device with its public key and its IPs, in
+vpnRouterWireGuardPeer; vpn-router-setup writes a [Peer] of wg0.conf for each peer of a user who
+is not disabled.
+
 A user may have a TOTP token: the user entry itself is an oathTOTPUser and oathTOTPToken whose
 oathTOTPToken points to itself, with the secret in oathSecret and the parameters of
 vpnrouter_ldap.TOTP_PARAMS. Enrolment stores nothing until a code of the new secret is
 verified: otp_new makes a secret and its otpauth URI, and otp_enrol stores the secret given a
 code of it. slapd's otp overlay then takes the password followed by a code at every bind.

+A user who is not a service account may have passkeys for signing in to the Router Manager, in
+vpnRouterPasskey (vpnrouter_passkeys registers and checks them).
+
 A user is disabled when pwdAccountLockedTime holds LOCKED, and locked when the password
 policy has set it after failed binds, for vpnrouter_ldap.LOCKOUT_SECONDS; unlock ends that.
 login() checks a user's password and code with a bind. Members of ADMIN_GROUP manage the
 router through the web service.

-A member of ADMIN_GROUP may have console login (console): the Shell page of the Router Manager,
-and SSH and sudo with the directory's password, followed by the code for an enrolled user. The
+A member of ADMIN_GROUP with a TOTP token may have console login (console): the Shell page of the
+Router Manager, and SSH and sudo with the directory's password followed by the code; without the
+token the console is refused, also for one whose console login was switched on before. The
 console runs as a local account, or as the user's own posixAccount, which the user entry becomes
 and nslcd serves to the system. Leaving ADMIN_GROUP switches it off. The module knows only the directory; the callers revoke a
 user's refresh tokens after the operations of vpnrouter_auth.REVOKING.
@@ -48,6 +56,8 @@ import calendar
 import contextlib
 import fcntl
 import grp
+import ipaddress
+import json
 import pwd
 import re
 import subprocess
@@ -64,6 +74,8 @@ import vpnrouter_pki

 #: A user name is one lowercase DNS label, as it is also the common name of the certificate.
 NAME = re.compile(r'^[a-z][a-z0-9-]{0,30}[a-z0-9]$|^[a-z]$')
+#: The other name of a service account: a GUID in lowercase hexadecimal, as the Router Manager proposes one.
+GUID = re.compile(r'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$')
 PASSWORD_MIN = 8
 PASSWORD_MAX = 128
 #: The longest first or last name, in characters.
@@ -78,7 +90,9 @@ LABELS = (('display_name', 'displayName'), ('description', 'description'))
 #: The attributes read for a user.
 ATTRIBUTES = ['uid', 'objectClass', 'pwdAccountLockedTime', 'givenName', 'sn', 'mail', 'oathTOTPToken', 'vpnRouterScope',
              'displayName', 'description', 'userCertificate;binary', 'vpnRouterConsoleLogin', 'vpnRouterConsoleAccount',
-              'uidNumber']
+              'uidNumber', 'vpnRouterWireGuardPeer', 'vpnRouterPasskey']
+#: The most WireGuard peers of one user.
+WIREGUARD_PEERS_MAX = 16
 #: The vpnRouterScope of a service account.
 SERVICE_SCOPE = 'service'
 #: The object classes of a VPN user and of a Manager-only account.
@@ -94,7 +108,7 @@ GROUP_ATTRIBUTES = ['cn', 'description', 'member']
 #: The longest group description, in characters.
 DESCRIPTION_MAX = 256
 #: The value of pwdAccountLockedTime that disables an account until it is enabled.
-LOCKED = b'000001010000Z'
+LOCKED = vpnrouter_ldap.DISABLED.encode()
 #: The group whose members manage the router through the web service.
 ADMIN_GROUP = 'admins'
 #: The digits of a TOTP code given to login().
@@ -123,9 +137,11 @@ def session():
            connection.unbind_s()


-def check_name(name):
-    if not isinstance(name, str) or not NAME.match(name):
-        raise Failure('a user name is 1 to 32 lowercase letters, digits and hyphens, starting with a letter', 2)
+def check_name(name, service=True):
+    """Refuse a name that is not a user name (NAME), or, with service, the GUID of a service account either."""
+    if not isinstance(name, str) or not (NAME.match(name) or service and GUID.match(name)):
+        raise Failure('a user name is 1 to 32 lowercase letters, digits and hyphens, starting with a letter'
+                      + (', or, for a service account, a GUID in lowercase' if service else ''), 2)


 def check_password(value):
@@ -244,6 +260,8 @@ def summary(attributes):
        'certificate': 'userCertificate;binary' in attributes,
        'otp': 'oathTOTPToken' in attributes,
        'console': console_of(attributes),
+        'wireguard_peers': peers_of(attributes),
+        'passkeys': [{key: passkey[key] for key in ('id', 'label', 'created')} for _, passkey in passkeys_of(attributes)],
    }
    for key, attribute in PERSON + LABELS:
        values = attributes.get(attribute)
@@ -267,6 +285,76 @@ def console_of(attributes):
    }


+def peers_of(attributes):
+    """The WireGuard peers of an entry as the answers show them: [{public_key, ips}], in the order they are stored."""
+    peers = []
+    for value in attributes.get('vpnRouterWireGuardPeer', []):
+        key, _, ips = value.decode().partition(' ')
+        peers.append({'public_key': key, 'ips': ips.split(',')})
+    return peers
+
+
+def passkeys_of(attributes):
+    """The passkeys of an entry (vpnrouter_passkeys) with their stored values: [(value, {id, credential, label,
+    created})]; values that cannot be read are left out."""
+    passkeys = []
+    for value in attributes.get('vpnRouterPasskey', []):
+        try:
+            passkey = json.loads(value)
+        except ValueError:
+            continue
+        if isinstance(passkey, dict) and all(isinstance(passkey.get(key), str) for key in ('id', 'credential', 'label', 'created')):
+            passkeys.append((value, passkey))
+    return passkeys
+
+
+def checked_peers(connection, name, peers):
+    """The values of vpnRouterWireGuardPeer for the user's WireGuard peers, [{public_key, ips}], when they are valid.
+
+    A public key is 32 bytes in base64, used by no other peer of any user; each peer has at least one IP, an IPv4
+    address or network, which no other peer of any user covers and which does not cover the router's own address of
+    wireguard.address. A user has at most WIREGUARD_PEERS_MAX peers.
+    """
+    if not isinstance(peers, list) or len(peers) > WIREGUARD_PEERS_MAX:
+        raise Failure(f'wireguard_peers must be a list of at most {WIREGUARD_PEERS_MAX} peers', 2)
+    router = vpnrouter.load_config()['wireguard']['address'].strip()
+    taken = [(other['name'], key, network)
+             for other in list_users(connection)['users'] if other['name'] != name
+             for peer in other['wireguard_peers'] for key in [peer['public_key']]
+             for network in (ipaddress.ip_network(ip) for ip in peer['ips'])]
+    values = []
+    for peer in peers:
+        key = peer.get('public_key') if isinstance(peer, dict) else None
+        ips = peer.get('ips') if isinstance(peer, dict) else None
+        try:
+            if not isinstance(key, str) or len(base64.b64decode(key.strip(), validate=True)) != 32:
+                raise ValueError
+        except ValueError:
+            raise Failure(f'{key!r} is not a WireGuard public key: 32 bytes in base64', 2)
+        key = key.strip()
+        if not isinstance(ips, list) or not ips or not all(isinstance(ip, str) for ip in ips):
+            raise Failure(f'the peer {key} needs at least one IP', 2)
+        networks = []
+        for ip in ips:
+            try:
+                network = ipaddress.ip_network(ip.strip(), strict=True)
+            except ValueError:
+                raise Failure(f'{ip!r} is not an IPv4 address or network of the peer {key}', 2)
+            if network.version != 4:
+                raise Failure(f'{ip!r} of the peer {key} is not IPv4', 2)
+            if router and ipaddress.ip_interface(router).ip in network:
+                raise Failure(f'{network} of the peer {key} covers the router\'s own address {router}', 2)
+            for owner, other_key, other in taken:
+                if other_key == key:
+                    raise Failure(f'the key {key} is a peer of {owner}', 4)
+                if network.overlaps(other):
+                    raise Failure(f'{network} of the peer {key} overlaps {other} of {owner}', 4)
+            networks.append(network)
+        taken += [(name, key, network) for network in networks]
+        values.append(f'{key} {",".join(str(network) for network in networks)}'.encode())
+    return values
+
+
 def classes(attributes):
    """The object classes of an entry, in lower case."""
    return {value.decode().lower() for value in attributes.get('objectClass', [])}
@@ -285,8 +373,8 @@ def free_uid(connection):


 def console(connection, name, enabled, account=None):
-    """Switch the console login of a member of ADMIN_GROUP on, as the local account given or, without one, as the
-    user's own posixAccount, or off.
+    """Switch the console login of a member of ADMIN_GROUP with a TOTP token on, as the local account given or, without
+    one, as the user's own posixAccount, or off.

    The posixAccount is added the first time and kept when the console login is switched off, so its uidNumber and the
    home it owns stay the user's. A local account must exist in the system's passwd with a uid from 1000 to below
@@ -309,6 +397,8 @@ def console(connection, name, enabled, account=None):
        raise Failure(f'{name} is a service account, which has no console', 2)
    if ADMIN_GROUP not in groups_of(connection, name):
        raise Failure(f'user {name} is not a member of {ADMIN_GROUP}', 2)
+    if 'oathTOTPToken' not in current:
+        raise Failure(f'user {name} has no TOTP token; console login needs one', 2)
    if account is not None:
        try:
            local = pwd.getpwnam(account)
@@ -376,8 +466,8 @@ def list_users(connection):
 def add(connection, name, password, values, service=False):
    """Add a user: a VPN user with its certificate when values gives all three person attributes, a Manager-only account
    with at most the e-mail address when it gives neither name, and, with service, a service account, with at most the
-    e-mail address and its labels (labels)."""
-    check_name(name)
+    e-mail address and its labels (labels); only a service account may be named by a GUID."""
+    check_name(name, service)
    details = person(values, required=False)
    vpn_user = 'givenName' in details or 'sn' in details
    if service and vpn_user:
@@ -412,7 +502,8 @@ def add(connection, name, password, values, service=False):


 def update(connection, name, values):
-    """Change the person attributes values gives; the cn follows the first and the last name.
+    """Change the person attributes values gives, the cn following the first and the last name, and of a VPN user the
+    WireGuard peers, wireguard_peers, which replace the user's peers (checked_peers).

    A Manager-only account has only the e-mail address, which '' removes; a service account also its labels
    (update_service).
@@ -421,6 +512,8 @@ def update(connection, name, values):
    if service(current):
        return update_service(connection, name, values)
    if manager_only(current):
+        if values.get('wireguard_peers') is not None:
+            raise Failure(f'user {name} is a Manager-only account, which has no VPN access and so no WireGuard peers', 2)
        if values.get('first_name') is not None or values.get('last_name') is not None:
            raise Failure(f'user {name} is a Manager-only account, which has no first or last name', 2)
        email = values.get('email')
@@ -433,16 +526,30 @@ def update(connection, name, values):
            connection.modify_s(dn_of(name), [(ldap.MOD_REPLACE, 'mail', [person({'email': email}, required=False)['mail'].encode()])])
        return summary(entry(connection, name))
    details = person(values, required=False)
-    if not details:
-        raise Failure('give at least one of first_name, last_name and email', 2)
-    names = {attribute: current[attribute][0].decode() for attribute in ('givenName', 'sn') if current.get(attribute)}
-    names.update({attribute: details[attribute] for attribute in ('givenName', 'sn') if attribute in details})
-    changes = [(ldap.MOD_REPLACE, attribute, [value.encode()]) for attribute, value in details.items()]
-    changes.append((ldap.MOD_REPLACE, 'cn', [common_name(names, name).encode()]))
+    peers = values.get('wireguard_peers')
+    if not details and peers is None:
+        raise Failure('give at least one of first_name, last_name, email and wireguard_peers', 2)
+    changes = []
+    if details:
+        names = {attribute: current[attribute][0].decode() for attribute in ('givenName', 'sn') if current.get(attribute)}
+        names.update({attribute: details[attribute] for attribute in ('givenName', 'sn') if attribute in details})
+        changes += [(ldap.MOD_REPLACE, attribute, [value.encode()]) for attribute, value in details.items()]
+        changes.append((ldap.MOD_REPLACE, 'cn', [common_name(names, name).encode()]))
+    if peers is not None:
+        if 'vpnrouteraccount' not in classes(current):
+            changes.append((ldap.MOD_ADD, 'objectClass', [b'vpnRouterAccount']))
+        changes.append((ldap.MOD_REPLACE, 'vpnRouterWireGuardPeer', checked_peers(connection, name, peers)))
    connection.modify_s(dn_of(name), changes)
+    if peers is not None:
+        apply_wireguard()
    return summary(entry(connection, name))


+def apply_wireguard():
+    """Have vpn-router-setup write the WireGuard peers of the users into wg0.conf, without waiting for it."""
+    subprocess.run(['systemctl', 'restart', '--no-block', 'vpn-router-setup.service'], capture_output=True)
+
+
 def update_service(connection, name, values):
    """Change any of the e-mail address and the labels (labels) of a service account that values gives; '' removes one."""
    if not service(entry(connection, name)):
@@ -466,14 +573,22 @@ def passwd(connection, name, password):


 def disable(connection, name):
-    if entry(connection, name).get('pwdAccountLockedTime') != [LOCKED]:
+    """Lock the user out; the WireGuard peers of a disabled user are left out of wg0.conf."""
+    current = entry(connection, name)
+    if current.get('pwdAccountLockedTime') != [LOCKED]:
        connection.modify_s(dn_of(name), [(ldap.MOD_REPLACE, 'pwdAccountLockedTime', [LOCKED])])
+        if 'vpnRouterWireGuardPeer' in current:
+            apply_wireguard()
    return summary(entry(connection, name))


 def enable(connection, name):
-    if entry(connection, name).get('pwdAccountLockedTime') == [LOCKED]:
+    """Let the user in again, with the WireGuard peers."""
+    current = entry(connection, name)
+    if current.get('pwdAccountLockedTime') == [LOCKED]:
        connection.modify_s(dn_of(name), [(ldap.MOD_DELETE, 'pwdAccountLockedTime', None)])
+        if 'vpnRouterWireGuardPeer' in current:
+            apply_wireguard()
    return summary(entry(connection, name))


@@ -550,13 +665,15 @@ def otp_enrol(connection, name, secret, code):


 def otp_remove(connection, name):
-    """Remove the user's TOTP token, when the user has one."""
-    if 'oathTOTPToken' in entry(connection, name):
+    """Remove the user's TOTP token, when the user has one, and end the console sessions it needed (end_sessions)."""
+    current = entry(connection, name)
+    if 'oathTOTPToken' in current:
        token = connection.search_s(dn_of(name), ldap.SCOPE_BASE, attrlist=TOKEN_ATTRIBUTES)[0][1]
        changes = [(ldap.MOD_DELETE, 'objectClass', [b'oathTOTPUser', b'oathTOTPToken']),
                   (ldap.MOD_DELETE, 'oathSecret', None)]
        changes += [(ldap.MOD_DELETE, attribute, None) for attribute in token]
        connection.modify_s(dn_of(name), changes)
+        end_sessions(current)
    return summary(entry(connection, name))


@@ -579,6 +696,8 @@ def remove(connection, name):
        raise Failure(f'the certificate cannot be revoked: {failure}', failure.status)
    connection.delete_s(dn_of(name))
    end_sessions(current)
+    if 'vpnRouterWireGuardPeer' in current:
+        apply_wireguard()
    return {'name': name, 'removed': True}


@@ -21,8 +21,8 @@ Pages:
           service_accounts())
  /groups  the groups of the router's directory: list, add, rename or describe, remove, and
           add and take out members (see groups())
-  /account the account of the signed-in user: its details, its password and its TOTP
-           enrolment (see account())
+  /account the account of the signed-in user: its details, its password, its TOTP
+           enrolment and its passkeys (see account())
  /site-to-site
           the site-to-site connections of the configuration: list, add, change and remove,
           applied by vpn-router-setup (see site_to_site())
@@ -38,10 +38,12 @@ Pages:
           the DER certificate and CRL of the root (root) and of each issuing CA, which the
           certificates name in their AIA and CRL distribution points; no authentication
  /shell   while web.shell is true, a login shell of the user's console account on a terminal, for
-           a member of admins whose console login is on: POST signs the
-           user in again for a one-time ticket (see shell_ticket()), GET with it is a WebSocket
+           a member of admins whose console login is on and who has a TOTP token: POST signs the user in again, unless
+           the user used a shell within web.shell_auth_timeout minutes, for a one-time ticket
+           (see shell_ticket()), GET with it is a WebSocket
           that carries the terminal (see Handler.shell())
-  /auth   sign-in with a user's password and TOTP code, refresh and sign-out (see auth())
+  /auth   sign-in with a user's password and TOTP code or with a passkey, refresh and sign-out
+           (see auth())
  /metrics/history
           the metrics the metrics service keeps, for a view: hour, day, month or year (see
           metrics_history())
@@ -56,7 +58,8 @@ token of vpn-router-token has the admin claim and names no user; it may call eve
 /account, and only such a token may change ADMIN_GROUP: create, rename to it, change, remove it,
 add or take out its members, and remove one of its members, and switch a user's console login.
 These paths and /auth are not
-served (404) while the key does not exist. /auth is limited to AUTH_LIMIT calls per client
+served (404) while the key does not exist. /auth but its sign-out and the beginning of a passkey
+sign-in is limited to AUTH_LIMIT calls per client
 address in AUTH_WINDOW seconds; the address of a call from one of web.trusted_proxies, by
 default the address the call came in on, is the last entry of its X-Forwarded-For header.

@@ -89,6 +92,7 @@ import collections
 import configparser
 import fcntl
 import hashlib
+import ipaddress
 import json
 import os
 import pwd
@@ -116,6 +120,7 @@ import vpnrouter_auth
 import vpnrouter_backup
 import vpnrouter_metrics
 import vpnrouter_net
+import vpnrouter_passkeys
 import vpnrouter_pki
 import vpnrouter_serve
 import vpnrouter_users
@@ -168,6 +173,9 @@ PUBLISHED = {'.crt': 'application/pkix-cert', '.crl': 'application/pkix-crl'}
 #: Seconds a ticket of POST /shell may open a shell.
 SHELL_TICKET_SECONDS = 30

+#: Seconds between the checks of an open shell's user, which end the shell once its console is refused.
+SHELL_CHECK_SECONDS = 60
+
 #: The largest WebSocket message accepted from a client, in bytes.
 MESSAGE_LIMIT = 65536

@@ -188,6 +196,9 @@ _auth_lock = threading.Lock()
 _shell_tickets = {}
 _shell_lock = threading.Lock()

+#: The last use of a shell of each user, a sign-in of POST /shell or a keystroke: user -> monotonic time.
+_shell_used = {}
+

 def read_json(path):
    """The object in a JSON file, or {} when the file is missing or holds no object."""
@@ -402,7 +413,7 @@ def postgresql_databases():

 def details(state):
    """What /config shows: the configuration without its secrets, and what the router resolved and runs; caddy is the
-    installed Caddy, {version, source}, null when it is not installed."""
+    installed Caddy, {version, source, service}, service the state of caddy.service, null when it is not installed."""
    configuration = state.get('configuration', {})
    caddy = package_version('caddy')
    return {
@@ -419,8 +430,8 @@ def details(state):
        },
        'postgresql': postgresql_configuration(),
        # Caddy is upstream's once its repository is configured (vpn-router-caddy).
-        'caddy': {'version': caddy, 'source': 'upstream' if vpnrouter.CADDY_APT_SOURCE.is_file() else 'ubuntu'}
-                 if caddy else None,
+        'caddy': {'version': caddy, 'source': 'upstream' if vpnrouter.CADDY_APT_SOURCE.is_file() else 'ubuntu',
+                  'service': unit_state('caddy.service')} if caddy else None,
    }


@@ -507,10 +518,12 @@ def html_of(status):
 def users(state, method, path, body):
    """Answer a /users request with vpnrouter_users: the HTTP status and the JSON document.

-      GET    /users                   the users
+      GET    /users                   the users, and {"enabled", "address"} of wireguard, whose network their
+                                      WireGuard peers take their addresses from
      POST   /users                   add a user: {"name", "password", "first_name", "last_name", "email"};
                                      without the names a Manager-only account
-      PUT    /users/<name>            change any of {"first_name", "last_name", "email"}
+      PUT    /users/<name>            change any of {"first_name", "last_name", "email", "wireguard_peers"};
+                                      wireguard_peers, [{"public_key", "ips"}], replaces the user's peers
      PUT    /users/<name>/password   set the password: {"password": ...}
      POST   /users/<name>/disable    lock the user out of OpenVPN
      POST   /users/<name>/enable     let the user in again
@@ -520,6 +533,7 @@ def users(state, method, path, body):
      POST   /users/<name>/otp        a new TOTP secret and its otpauth URI; nothing is stored
      PUT    /users/<name>/otp        store a TOTP secret: {"secret", "code"}, code a code of the secret
      DELETE /users/<name>/otp        remove the TOTP token
+      DELETE /users/<name>/passkeys   remove all the user's passkeys
      PUT    /users/<name>/console    switch console login on or off: {"enabled", "account"?}, account a local account,
                                      without which the user's own posixAccount; only a token of vpn-router-token

@@ -533,7 +547,8 @@ def users(state, method, path, body):
    name = parts[1] if len(parts) > 1 else None
    actions = {
        ('GET', 1, None): lambda connection: {
-            'users': [user for user in vpnrouter_users.list_users(connection)['users'] if not user['service']]},
+            'users': [user for user in vpnrouter_users.list_users(connection)['users'] if not user['service']],
+            'wireguard': {option: vpnrouter.load_config()['wireguard'][option] for option in ('enabled', 'address')}},
        ('POST', 1, None): lambda connection: vpnrouter_users.add(connection, body.get('name'), body.get('password'), body),
        ('PUT', 2, None): lambda connection: vpnrouter_users.update(connection, name, body),
        ('PUT', 3, 'password'): lambda connection: vpnrouter_users.passwd(connection, name, body.get('password')),
@@ -545,6 +560,7 @@ def users(state, method, path, body):
        ('POST', 3, 'otp'): lambda connection: vpnrouter_users.otp_new(connection, name),
        ('PUT', 3, 'otp'): lambda connection: vpnrouter_users.otp_enrol(connection, name, body.get('secret'), body.get('code')),
        ('DELETE', 3, 'otp'): lambda connection: vpnrouter_users.otp_remove(connection, name),
+        ('DELETE', 3, 'passkeys'): lambda connection: vpnrouter_passkeys.remove(connection, name),
        ('PUT', 3, 'console'): lambda connection: vpnrouter_users.console(connection, name, body.get('enabled'), body.get('account')),
    }
    # The vpnrouter_users operation of each route that may revoke refresh tokens.
@@ -820,13 +836,32 @@ def backup(method, path, body):
    return 200, {'settings': backup_settings(cfg['backup'])}


+def wireguard_server(cfg, state):
+    """What a WireGuard peer's configuration needs of the router: {public_key, endpoint, allowed_ips}; public_key is
+    null before setup made the key pair, endpoint, <wan.local_fqdn>:<wireguard.listen_port>, null without a name, and
+    allowed_ips the networks reached through the tunnel, the router's local CIDRs and the WireGuard network."""
+    try:
+        public_key = vpnrouter.WG_PUBLIC_KEY.read_text(encoding='utf-8').strip() or None
+    except OSError:
+        public_key = None
+    fqdn = cfg['wan']['local_fqdn'].strip()
+    address = cfg['wireguard']['address'].strip()
+    networks = section(state, 'network').get('local_cidrs')
+    allowed = [cidr for cidr in networks if isinstance(cidr, str)] if isinstance(networks, list) else []
+    if address:
+        allowed.append(str(ipaddress.ip_interface(address).network))
+    return {'public_key': public_key, 'endpoint': f'{fqdn}:{cfg["wireguard"]["listen_port"]}' if fqdn else None,
+            'allowed_ips': list(dict.fromkeys(allowed))}
+
+
 def remote_access(state, method, path, body):
    """Answer a /remote-access request: the HTTP status and the JSON document.

-      GET /remote-access            {"p2s", "openvpn", "wireguard", "running", "local_fqdn"}: the settings of the three
-                                    remote access systems (REMOTE_ACCESS), whether setup runs each (running: {p2s,
-                                    openvpn, wireguard}), and wan.local_fqdn, which IKEv2 and OpenVPN need with the
-                                    router's VPN server certificate
+      GET /remote-access            {"p2s", "openvpn", "wireguard", "running", "local_fqdn", "wireguard_server"}: the
+                                    settings of the three remote access systems (REMOTE_ACCESS), whether setup runs
+                                    each (running: {p2s, openvpn, wireguard}), wan.local_fqdn, which IKEv2 and OpenVPN
+                                    need with the router's VPN server certificate, and what a WireGuard peer's
+                                    configuration needs of the router (wireguard_server)
      PUT /remote-access/<system>   change any of the settings of the system's section; answers the section

    A change is made as /site-to-site makes one, and applied by restarting vpn-router-setup without waiting for it.
@@ -840,7 +875,8 @@ def remote_access(state, method, path, body):
            cfg = vpnrouter.load_config()
            return 200, {**{system: cfg[system] for system in REMOTE_ACCESS},
                         'running': {system: bool(state.get(system)) for system in REMOTE_ACCESS},
-                         'local_fqdn': cfg['wan']['local_fqdn']}
+                         'local_fqdn': cfg['wan']['local_fqdn'],
+                         'wireguard_server': wireguard_server(cfg, state)}
        if method != 'PUT' or len(parts) != 2 or parts[1] not in REMOTE_ACCESS:
            return 404, {'error': f'no route {method} {path}'}
        system = parts[1]
@@ -948,20 +984,27 @@ def account(name, method, path, body):
      POST /account/otp        a new TOTP secret and its otpauth URI; nothing is stored
      PUT  /account/otp        store a TOTP secret: {"current_password", "current_code"?, "secret", "code"},
                               code a code of the secret
+      POST /account/passkeys   begin the registration of a passkey: {"current_password", "current_code"?};
+                               {"id", "options"} for navigator.credentials.create
+      PUT  /account/passkeys   store the passkey: {"id", "credential", "label"?}, credential the browser's answer
+      DELETE /account/passkeys/<id>
+                               remove a passkey

-    A change needs the current password and, for an enrolled user, a current code; a wrong one is 403 and counts as
-    a failed login. A password change revokes the user's refresh tokens.
+    A change but the removal of a passkey needs the current password and, for an enrolled user, a current code; a wrong
+    one is 403 and counts as a failed login. A password change revokes the user's refresh tokens.
    """
    if body == 'invalid' or (body is not None and not isinstance(body, dict)):
        return 400, {'error': 'the body must be a JSON object'}
    body = body or {}
    route = (method, path.rstrip('/'))
-    if route not in (('GET', '/account'), ('PUT', '/account/password'), ('POST', '/account/otp'), ('PUT', '/account/otp')):
+    removing = method == 'DELETE' and path.startswith('/account/passkeys/') and len(path.strip('/').split('/')) == 3
+    if not removing and route not in (('GET', '/account'), ('PUT', '/account/password'), ('POST', '/account/otp'),
+                                      ('PUT', '/account/otp'), ('POST', '/account/passkeys'), ('PUT', '/account/passkeys')):
        return 404, {'error': f'no route {method} {path}'}
    try:
        if route == ('PUT', '/account/password'):
            vpnrouter_users.check_password(body.get('password'))
-        if method == 'PUT':
+        if route in (('PUT', '/account/password'), ('PUT', '/account/otp'), ('POST', '/account/passkeys')):
            vpnrouter_users.login(name, body.get('current_password'), body.get('current_code'))
        with vpnrouter_users.session() as connection:
            if route == ('GET', '/account'):
@@ -971,6 +1014,13 @@ def account(name, method, path, body):
                document = vpnrouter_users.passwd(connection, name, body['password'])
            elif route == ('POST', '/account/otp'):
                document = vpnrouter_users.otp_new(connection, name)
+            elif route == ('POST', '/account/passkeys'):
+                document = vpnrouter_passkeys.register_begin(connection, name)
+            elif route == ('PUT', '/account/passkeys'):
+                document = vpnrouter_passkeys.register_complete(connection, name, body.get('id'), body.get('credential'),
+                                                                body.get('label'))
+            elif removing:
+                document = vpnrouter_passkeys.remove(connection, name, urllib.parse.unquote(path.strip('/').split('/')[2]))
            else:
                document = vpnrouter_users.otp_enrol(connection, name, body.get('secret'), body.get('code'))
        if route == ('PUT', '/account/password'):
@@ -1043,7 +1093,10 @@ def refusal(claims, method, path, body):
 def auth(path, body):
    """Answer a POST to /auth with vpnrouter_users and vpnrouter_auth: the HTTP status and the JSON document.

-      POST /auth           sign in: {"name", "password", "code"?}; the tokens
+      POST /auth           sign in: {"name", "password", "code"?}; the tokens and the user's name
+      POST /auth/passkey   begin a sign-in with a passkey: {"id", "options"} for navigator.credentials.get
+      POST /auth/passkey/complete
+                           {"id", "credential"}, credential the browser's answer; the tokens and the user's name
      POST /auth/refresh   {"refresh_token"}; new tokens, the refresh token used up
      POST /auth/logout    {"refresh_token"}; the refresh token revoked
    """
@@ -1056,7 +1109,13 @@ def auth(path, body):
            with vpnrouter_users.session() as connection:
                if vpnrouter_users.service(vpnrouter_users.entry(connection, body['name'])):
                    raise vpnrouter_users.Failure('the name, the password or the code is wrong', 5)
-            return 200, vpnrouter_auth.issue(cfg, body['name'])
+            return 200, {**vpnrouter_auth.issue(cfg, body['name']), 'name': body['name']}
+        if path == '/auth/passkey':
+            return 200, vpnrouter_passkeys.login_begin()
+        if path == '/auth/passkey/complete':
+            with vpnrouter_users.session() as connection:
+                name = vpnrouter_passkeys.login_complete(connection, body.get('id'), body.get('credential'))
+            return 200, {**vpnrouter_auth.issue(cfg, name), 'name': name}
        name = vpnrouter_auth.take(cfg, body.get('refresh_token'))
        if path == '/auth/logout':
            return 200, {'revoked': name is not None}
@@ -1081,19 +1140,29 @@ def shell_ticket(name, body):
    """Answer POST /shell: the HTTP status and the JSON document.

    The user named by the token signs in again with {"password", "code"?}; a wrong password or code is 403 and counts
-    as a failed login. The answer is {"ticket", "expires_in"}: a ticket that opens one shell (GET /shell) for the
-    same user within SHELL_TICKET_SECONDS. 403 while web.shell is false or the user's console login is not on.
+    as a failed login. Without a password, the user is not asked to sign in while its last use of a shell (see
+    _shell_used) is less than web.shell_auth_timeout minutes ago. The answer is {"ticket", "expires_in"}: a ticket that
+    opens one shell (GET /shell) for the same user within SHELL_TICKET_SECONDS, or a null ticket when the user must
+    sign in. 403 while web.shell is false, the user's console login is not on or the user has no TOTP token.
    """
    if not isinstance(name, str):
        return 403, {'error': 'the shell needs a token of a signed-in user'}
    if not isinstance(body, dict):
        return 400, {'error': 'the body must be a JSON object'}
    try:
-        if not vpnrouter.load_config()['web']['shell']:
+        options = vpnrouter.load_config()['web']
+        if not options['shell']:
            return 403, {'error': 'the shell is disabled; vpn-config-edit set web.shell true enables it'}
-        if console_account(name) is None:
-            return 403, {'error': f'console login is not enabled for {name}; vpn-router-user console sets it'}
-        vpnrouter_users.login(name, body.get('password'), body.get('code'))
+        refusal = console_account(name)[1]
+        if refusal:
+            return 403, {'error': refusal}
+        if 'password' not in body:
+            with _shell_lock:
+                used = _shell_used.get(name)
+            if used is None or time.monotonic() - used >= options['shell_auth_timeout'] * 60:
+                return 200, {'ticket': None, 'expires_in': 0}
+        else:
+            vpnrouter_users.login(name, body.get('password'), body.get('code'))
    except vpnrouter_users.Failure as failure:
        if failure.status == 5:
            return 403, {'error': 'the password or the code is wrong'}
@@ -1108,14 +1177,20 @@ def shell_ticket(name, body):
        for unused in [key for key, (_, expires) in _shell_tickets.items() if expires <= now]:
            del _shell_tickets[unused]
        _shell_tickets[ticket] = (name, now + SHELL_TICKET_SECONDS)
+        _shell_used[name] = now
    return 200, {'ticket': ticket, 'expires_in': SHELL_TICKET_SECONDS}


 def console_account(name):
-    """The system account the console of the user runs as, or None while its console login is not on."""
+    """The system account the console of the user runs as and None, or None and the reason the user may not use a
+    console: its console login is off, or it has no TOTP token."""
    with vpnrouter_users.session() as connection:
-        console = vpnrouter_users.summary(vpnrouter_users.entry(connection, name))['console']
-    return console['account'] if console and console['enabled'] else None
+        user = vpnrouter_users.summary(vpnrouter_users.entry(connection, name))
+    if not user['console'] or not user['console']['enabled']:
+        return None, f'console login is not enabled for {name}; vpn-router-user console sets it'
+    if not user['otp']:
+        return None, f'{name} has no TOTP token; the shell needs one, enrolled on the Account page'
+    return user['console']['account'], None


 def take_ticket(name, ticket):
@@ -1240,8 +1315,9 @@ class Handler(BaseHTTPRequestHandler):

        The ticket must come from POST /shell for the user named by the token. Binary messages of the client are its
        keystrokes, a text message {"cols", "rows"} sets the window size, and binary messages of the server are the
-        terminal's output. The shell ends after web.shell_idle_minutes without a keystroke, when it exits, or when the
-        client closes the connection; the server then closes it with the reason. Each opening, end and refusal is logged
+        terminal's output. The shell ends after web.shell_idle_minutes without a keystroke, when it exits, when the
+        client closes the connection, or when a check of the user (SHELL_CHECK_SECONDS) finds its console login off or
+        its TOTP token gone; the server then closes it with the reason. Each opening, end and refusal is logged
        with its reason.
        """
        def refuse(code, message):
@@ -1267,11 +1343,11 @@ class Handler(BaseHTTPRequestHandler):
        if not options['shell']:
            return refuse(403, 'the shell is disabled; vpn-config-edit set web.shell true enables it')
        try:
-            login = console_account(name)
+            login, refusal = console_account(name)
        except (vpnrouter_users.Failure, ldap.LDAPError, OSError) as exc:
            return refuse(500, f'the user directory failed: {exc}')
-        if login is None:
-            return refuse(403, f'console login is not enabled for {name}')
+        if refusal:
+            return refuse(403, refusal)
        try:
            account = pwd.getpwnam(login)
        except KeyError:
@@ -1312,6 +1388,8 @@ class Handler(BaseHTTPRequestHandler):
                    if opcode == BINARY:
                        os.write(master, payload)
                        typed[0] = time.monotonic()
+                        with _shell_lock:
+                            _shell_used[name] = typed[0]
                    elif opcode == TEXT:
                        size = json.loads(payload)
                        fcntl.ioctl(master, termios.TIOCSWINSZ, struct.pack('HHHH', int(size['rows']), int(size['cols']), 0, 0))
@@ -1323,12 +1401,23 @@ class Handler(BaseHTTPRequestHandler):
        reader = threading.Thread(target=receive, name=f'{unit} input', daemon=True)
        reader.start()
        reason = 'the shell ended'
+        checked = started
        try:
            while not ended.is_set():
                left = typed[0] + idle - time.monotonic()
                if left <= 0:
                    reason = f'no keystroke for {options["shell_idle_minutes"]} minutes'
                    break
+                # The user's console login and TOTP token are checked again every SHELL_CHECK_SECONDS.
+                if time.monotonic() - checked >= SHELL_CHECK_SECONDS:
+                    checked = time.monotonic()
+                    try:
+                        refusal = console_account(name)[1]
+                    except (vpnrouter_users.Failure, ldap.LDAPError, OSError) as exc:
+                        refusal = f'the user directory failed: {exc}'
+                    if refusal:
+                        reason = refusal
+                        break
                if select.select([master], [], [], min(left, 1))[0]:
                    try:
                        output = os.read(master, 65536)
@@ -1370,7 +1459,7 @@ class Handler(BaseHTTPRequestHandler):
                                            'ca', 'shell', 'remote-access')
                          if path == f'/{name}' or path.startswith(f'/{name}/')), None)
        protected = path in ('/status/full', '/config', '/metrics/history', '/postgresql') or directory is not None
-        signing = path in ('/auth', '/auth/refresh', '/auth/logout')
+        signing = path in ('/auth', '/auth/passkey', '/auth/passkey/complete', '/auth/refresh', '/auth/logout')
        state = current() if protected or signing else {}
        claims = self.claims(state['key']) if protected and state['key'] else None
        payload = self.request_body() if (protected or signing) and self.command not in ('GET', 'HEAD') else None
@@ -1381,7 +1470,7 @@ class Handler(BaseHTTPRequestHandler):
        elif signing and self.command != 'POST':
            body, kind, code = b'Method not allowed\n', 'text/plain; charset=utf-8', 405
        elif signing:
-            wait = auth_wait(self.client()) if path != '/auth/logout' else 0
+            wait = auth_wait(self.client()) if path not in ('/auth/logout', '/auth/passkey') else 0
            if wait:
                code, document = 429, {'error': f'too many sign-in calls; retry in {wait} seconds'}
                extra.append(('Retry-After', str(wait)))
@@ -25,6 +25,7 @@ user exists, 1 anything else. -h or --help shows the commands and their options.
  vpn-router-user [--json] otp-enrol <name> <code>   (secret on stdin)
  vpn-router-user [--json] otp-remove <name>
  vpn-router-user [--json] console <name> (--posix | --account LOCAL | --off)
+  vpn-router-user [--json] passkeys-remove <name>
 """

 import argparse
@@ -37,6 +38,7 @@ import ldap

 import vpnrouter
 import vpnrouter_auth
+import vpnrouter_passkeys
 import vpnrouter_users
 from vpnrouter_users import Failure

@@ -57,8 +59,9 @@ HELP = {
    'otp-new': 'make a TOTP secret and its otpauth URI; nothing is stored',
    'otp-enrol': 'store the TOTP secret read from standard input, when the code is a code of it',
    'otp-remove': 'remove the TOTP token',
-    'console': "switch the console login of a member of admins on, as the user's own POSIX account in the directory "
-               'or as a local account, or off',
+    'console': "switch the console login of a member of admins with a TOTP token on, as the user's own POSIX account "
+               'in the directory or as a local account, or off',
+    'passkeys-remove': "remove all the user's passkeys",
 }

 #: The help of the person options.
@@ -118,14 +121,19 @@ def run(connection, options, secret):
        return vpnrouter_users.otp_enrol(connection, options.name, secret, options.code)
    if command == 'console':
        return vpnrouter_users.console(connection, options.name, not options.off, options.account)
+    if command == 'passkeys-remove':
+        return vpnrouter_passkeys.remove(connection, options.name)
    return getattr(vpnrouter_users, command.replace('-', '_'))(connection, options.name)


-def console_text(console):
-    """The console login of a user as a cell: -, off, posix (uid N) or local and the account."""
+def console_text(user):
+    """The console login of a user as a cell: -, off, posix (uid N) or local and the account, refused without a TOTP
+    token."""
+    console = user['console']
    if console is None or not console['enabled']:
        return '-' if console is None else 'off'
-    return f'local {console["account"]}' if console['local'] else f'posix (uid {console["uid"]})'
+    text = f'local {console["account"]}' if console['local'] else f'posix (uid {console["uid"]})'
+    return text if user['otp'] else f'{text}, refused: no OTP'


 def text_of(answer):
@@ -139,11 +147,11 @@ def text_of(answer):
    users = answer['users'] if 'users' in answer else [answer]
    if not users:
        return 'no users'
-    head = ('USER', 'KIND', 'STATE', 'CERTIFICATE', 'OTP', 'CONSOLE', 'FIRST NAME', 'LAST NAME', 'E-MAIL')
+    head = ('USER', 'KIND', 'STATE', 'CERTIFICATE', 'OTP', 'PASSKEYS', 'CONSOLE', 'FIRST NAME', 'LAST NAME', 'E-MAIL')
    rows = [(user['name'], 'internal' if user['internal'] else 'service' if user['service'] else 'manager' if user['manager_only'] else 'vpn',
             'disabled' if not user['enabled'] else 'locked' if user['locked'] else 'enabled',
             'issued' if user['certificate'] else 'missing',
-             'enrolled' if user['otp'] else '-', console_text(user['console']),
+             'enrolled' if user['otp'] else '-', str(len(user['passkeys'])) if user['passkeys'] else '-', console_text(user),
             user['first_name'] or '-', user['last_name'] or '-', user['email'] or '-')
            for user in users]
    widths = [max(len(row[column]) for row in (head, *rows)) for column in range(len(head))]
@@ -63,7 +63,8 @@
    "trusted_proxies": [],
    "status_content": "basic",
    "shell": false,
-    "shell_idle_minutes": 15
+    "shell_idle_minutes": 15,
+    "shell_auth_timeout": 15
  },
  "ssh": {
    "ldap_login": false
@@ -0,0 +1,9 @@
+{{ wg_peers_begin }}
+{% for user, key, ips in wg_peers -%}
+[Peer]
+# {{ user }}
+PublicKey = {{ key }}
+AllowedIPs = {{ ips | join(', ') }}
+
+{% endfor -%}
+{{ wg_peers_end }}
Author	SHA1	Message	Date
slawek	d1d565b1d9	fix: a service account may be named by a GUID in lowercase, as the Router Manager proposes for a new one. Release / release (push) Successful in 14s Details	2026-10-26 09:11:13 +01:00
slawek	e675540ce2	fix: the package installs vpnrouter_passkeys, without which the web service and vpn-router-user do not start. Release / release (push) Successful in 20s Details	2026-10-26 08:40:24 +01:00
slawek	90db6d46a2	feature: users sign in to the Router Manager with passkeys, and console login needs a TOTP token, so a user without one is refused the shell, SSH and sudo. Release / release (push) Successful in 14s Details	2026-10-26 08:35:10 +01:00
slawek	91cc64d6a6	fix: a shell opens without the password and code again while the user's last use of a shell is within web.shell_auth_timeout minutes. Release / release (push) Successful in 13s Details	2026-10-26 07:56:23 +01:00
slawek	a1f314d8c1	fix: /config gives the state of caddy.service with the installed Caddy, for the Router Manager's Web page. Release / release (push) Failing after 17m18s Details	2026-10-26 07:18:39 +01:00
slawek	7d8892b8c4	fix: wireguard.address must be the router's own address in its network, not the network or broadcast address, from which the peers' addresses are told apart. Release / release (push) Failing after 16m1s Details	2026-10-26 02:59:56 +01:00
slawek	4491377d9b	fix: /remote-access gives the router's WireGuard public key, endpoint and allowed IPs, which a peer's configuration needs. Release / release (push) Successful in 13s Details	2026-10-26 02:50:39 +01:00
slawek	f1d9c3bc36	feature: a VPN user has WireGuard peers, each a device with its public key and IPs, kept in the directory and written into wg0.conf by setup. Release / release (push) Successful in 13s Details	2026-10-26 02:33:58 +01:00