fix: a shell opens without the password and code again while the user's last use of a shell is within web.shell_auth_timeout minutes.

ADR.md

@@ -909,7 +909,10 @@ Manager cannot set it. The shell runs as the console account of the signed-in us
 it is never root and each administrator's shell is the administrator's own; a user without
 console login gets none. `POST /shell` signs the user in again with the password
 and TOTP code and gives a one-time ticket valid 30 seconds; a WebSocket on `GET /shell` with that
-ticket gets the shell. The WebSocket of RFC 6455 is implemented on the standard library inside the
+ticket gets the shell. Asking for the password and code at every opening of the page is tiresome,
+so within `web.shell_auth_timeout` minutes of the user's last sign-in or keystroke a ticket is given
+without them; the times are kept in the web service's memory only, so a restart asks again, and 0
+keeps the sign-in at every opening. The WebSocket of RFC 6455 is implemented on the standard library inside the
 web service's `http.server`, server side only, without extensions. `systemd-run --pty` starts the
 shell in a transient unit with a PAM login session, outside the sandbox, and `setsid --ctty`
 makes the terminal its controlling terminal so window sizes reach the shell. A shell idle for

README.md

@@ -114,7 +114,7 @@ must have the type shown below; an unknown section or setting is an error.
 | `p2s` | `enabled` | boolean | `false` | Road-warrior access |
 | `p2s` | `address_pool` | string | | CIDR assigned to road-warrior clients |
 | `wireguard` | `enabled` | boolean | `false` | WireGuard endpoint |
-| `wireguard` | `address` | string | | Address and prefix for `wg0`, for example `192.168.200.1/24` |
+| `wireguard` | `address` | string | | The router's own address on `wg0` with the prefix of the peers' network, for example `192.168.200.1/24`; the network and the broadcast address of a network larger than /31 are refused |
 | `wireguard` | `listen_port` | integer | `51820` | UDP port |
 | `openvpn` | `enabled` | boolean | `false` | OpenVPN access for users |
 | `openvpn` | `address_pool` | string | | IPv4 CIDR assigned to OpenVPN clients |
@@ -130,6 +130,7 @@ must have the type shown below; an unknown section or setting is an error.
 | `web` | `status_content` | string | `basic` | What `/` and `/status` show: `basic`, `standard` or `full` (see Status web service) |
 | `web` | `shell` | boolean | `false` | `/shell` opens a login shell for a member of `admins` with console login (see The shell) |
 | `web` | `shell_idle_minutes` | integer | `15` | Minutes without a keystroke after which a shell is closed, 1 to 1440 |
+| `web` | `shell_auth_timeout` | integer | `15` | Minutes after the last use of a shell in which a new shell opens without signing in again, 0 (always sign in) to 1440 |
 | `ssh` | `ldap_login` | boolean | `false` | sshd accepts the directory password of the console accounts in the directory (see Console login and SSH) |
 | `https` | `enabled` | boolean | `true` | Caddy serves the status web service and the Router Manager over HTTPS for `wan.local_fqdn` |
 | `https` | `email` | string | | The e-mail address of the Let's Encrypt account |
@@ -980,12 +981,14 @@ vpn-config-edit set web.shell true
 
 | Request | Body | Answer |
 | --- | --- | --- |
-| `POST /shell` | `{"password", "code"}`; `code` only for a user enrolled for TOTP | `{"ticket", "expires_in": 30}` |
+| `POST /shell` | `{"password", "code"}`; `code` only for a user enrolled for TOTP; `{}` within `web.shell_auth_timeout` | `{"ticket", "expires_in": 30}` |
 | `GET /shell?ticket=<ticket>` | a WebSocket handshake | the terminal |
 
 `POST /shell` needs an access token of `/auth`, not one of `vpn-router-token`, and signs its user
 in again: a wrong password or code gets 403 and counts as a failed login; it gets 403 too while
-`web.shell` is `false` or the user's console login is off. The ticket opens one
+`web.shell` is `false` or the user's console login is off. Without a password it gives a ticket
+while the user's last sign-in of `POST /shell` or keystroke in a shell is less than
+`web.shell_auth_timeout` minutes ago, and `{"ticket": null}` otherwise. The ticket opens one
 shell for the same user within 30 seconds. Over the WebSocket, binary messages of the client
 are keystrokes, a text message `{"cols", "rows"}` sets the window size, and binary messages of
 the router are the terminal's output. The shell is a PAM login session of the console account,
@@ -1006,7 +1009,7 @@ when it ended and why, and each refused ticket or shell with the reason.
 | `wireguard` | The public key and port of `wg0`, and each peer's public key, endpoint, allowed IPs, handshake age and traffic; no private or preshared key |
 | `docker` | `docker.exposed_ports` and the rules of the `VPN-ROUTER-DOCKER` chain |
 | `postgresql` | `clusters`: each PostgreSQL cluster of `pg_lsclusters` with its version, name, port, status and data directory, and for one that is online its `settings`: `server_version`, `listen_addresses`, `port`, `max_connections`, `shared_buffers`, `effective_cache_size`, `work_mem`, `password_encryption`, `ssl` and `timezone`; `null` when `pg_lsclusters` fails |
-| `caddy` | The installed Caddy: `version`, and `source`, `upstream` once Caddy's repository is configured and `ubuntu` otherwise; `null` when Caddy is not installed |
+| `caddy` | The installed Caddy: `version`, `source`, `upstream` once Caddy's repository is configured and `ubuntu` otherwise, and `service`, the state of `caddy.service`; `null` when Caddy is not installed |
 
 ### The /postgresql page
 
@@ -1157,7 +1160,7 @@ OpenVPN (`openvpn`) and WireGuard (`wireguard`), with the same token as `/users`
 
 | Request | Body | Answer |
 | --- | --- | --- |
-| `GET /remote-access` | | `{"p2s", "openvpn", "wireguard", "running", "local_fqdn"}` |
+| `GET /remote-access` | | `{"p2s", "openvpn", "wireguard", "running", "local_fqdn", "wireguard_server"}`; `wireguard_server` is `{"public_key", "endpoint", "allowed_ips"}`: the router's WireGuard public key (`null` before setup made it), `<wan.local_fqdn>:<wireguard.listen_port>` (`null` without a name) and the networks a peer reaches through the tunnel, the router's local CIDRs and the WireGuard network |
 | `PUT /remote-access/<system>` | any of the settings of the section `p2s`, `openvpn` or `wireguard` | the section |
 
 `running` tells for each system whether setup runs it. IKEv2 and OpenVPN run once enabled with an

debian-package/debian/changelog

@@ -1,3 +1,41 @@
+vpn-router (0.25.4-1) unstable; urgency=medium
+
+  fix: a shell opens without the password and code again while the user's last use of a shell is within web.shell_auth_timeout minutes.
+
+  * New setting web.shell_auth_timeout, 15 minutes by default, 0 to 1440:
+    POST /shell without a password gives a ticket while the user's last
+    sign-in of POST /shell or keystroke in a shell is within it, and a
+    null ticket otherwise; 0 asks for the password and code every time.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Tue, 03 Nov 2026 06:00:00 +0100
+
+vpn-router (0.25.3-1) unstable; urgency=medium
+
+  fix: /config gives the state of caddy.service with the installed Caddy, for the Router Manager's Web page.
+
+  * caddy of /config is {"version", "source", "service"}.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Tue, 03 Nov 2026 05:00:00 +0100
+
+vpn-router (0.25.2-1) unstable; urgency=medium
+
+  fix: wireguard.address must be the router's own address in its network, not the network or broadcast address, from which the peers' addresses are told apart.
+
+  * A wireguard.address that is the network or the broadcast address of a
+    network larger than /31, such as 192.168.232.0/24, is refused with the
+    first address of the network as the example.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Tue, 03 Nov 2026 02:30:00 +0100
+
+vpn-router (0.25.1-1) unstable; urgency=medium
+
+  fix: /remote-access gives the router's WireGuard public key, endpoint and allowed IPs, which a peer's configuration needs.
+
+  * GET /remote-access answers wireguard_server: {"public_key",
+    "endpoint", "allowed_ips"}.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Tue, 03 Nov 2026 01:30:00 +0100
+
 vpn-router (0.25.0-1) unstable; urgency=medium
 
   feature: a VPN user has WireGuard peers, each a device with its public key and IPs, kept in the directory and written into wg0.conf by setup.

debian-package/src/usr/lib/vpn-router/vpnrouter.py

@@ -38,6 +38,8 @@ SITE_TO_SITE   = SWANCTL_CONF_D / 'site-to-site.conf'
 ROAD_WARRIOR   = SWANCTL_CONF_D / 'road-warrior.conf'
 P2S_FORWARDER  = pathlib.Path('/etc/systemd/resolved.conf.d/p2s-forwarder.conf')
 WG_CONF        = pathlib.Path('/etc/wireguard/wg0.conf')
+#: The router's WireGuard public key, which setup writes with its private key.
+WG_PUBLIC_KEY  = pathlib.Path('/etc/wireguard/wg0.pub')
 #: The lines around the [Peer] sections of the users' WireGuard peers in WG_CONF, which setup writes from the directory.
 WG_PEERS_BEGIN = "# BEGIN WireGuard peers of the users of the router's directory"
 WG_PEERS_END   = "# END WireGuard peers of the users of the router's directory"
@@ -56,7 +58,7 @@ SCHEMA = {
     'openvpn':    {'enabled': False, 'address_pool': '', 'port': 1194, 'protocol': 'udp'},
     'docker':     {'mode': 'auto', 'exposed_ports': []},
     'web':        {'enabled': True, 'listen': DEFAULT_LISTEN, 'port': 7081, 'database': '', 'trusted_proxies': [],
-                   'status_content': 'basic', 'shell': False, 'shell_idle_minutes': 15},
+                   'status_content': 'basic', 'shell': False, 'shell_idle_minutes': 15, 'shell_auth_timeout': 15},
     'ssh':        {'ldap_login': False},
     'https':      {'enabled': True, 'email': '', 'web_port': 7444, 'manager_port': 7443, 'caddy_source': 'ubuntu'},
     'pki':        {'root_name': 'VPN Router Root CA', 'root_days': 7300, 'ca_days': 3650, 'key': 'rsa-4096',
@@ -199,7 +201,7 @@ CA_NAME_MAX = 64
 #: What / and /status of the web service show, web.status_content, from the least to the most.
 STATUS_CONTENTS = ('basic', 'standard', 'full')
 
-#: The longest web.shell_idle_minutes, a day.
+#: The longest web.shell_idle_minutes and web.shell_auth_timeout, a day.
 SHELL_IDLE_MAX = 1440
 
 DOCKER_MODES = ('auto', 'on', 'off')
@@ -456,10 +458,16 @@ def validate(cfg):
     wg_address = _get(cfg, 'wireguard', 'address')
     if wg_address:
         try:
-            ipaddress.ip_interface(wg_address)
+            interface = ipaddress.ip_interface(wg_address)
         except ValueError:
             raise ConfigError(
                 f'wireguard.address: {wg_address!r} is not an address with prefix')
+        # The router's own address on wg0, from which the peers' addresses of the same network are told apart.
+        network = interface.network
+        if network.num_addresses > 2 and interface.ip in (network.network_address, network.broadcast_address):
+            raise ConfigError(
+                f'wireguard.address: {wg_address} is the network or broadcast address of {network}; give the '
+                f'router\'s own address in it, such as {next(network.hosts())}/{network.prefixlen}')
 
     port = _get(cfg, 'wireguard', 'listen_port')
     if not 1 <= port <= 65535:
@@ -491,6 +499,9 @@ def validate(cfg):
     shell_idle = _get(cfg, 'web', 'shell_idle_minutes')
     if not 1 <= shell_idle <= SHELL_IDLE_MAX:
         raise ConfigError(f'web.shell_idle_minutes: {shell_idle} is not between 1 and {SHELL_IDLE_MAX}')
+    shell_auth = _get(cfg, 'web', 'shell_auth_timeout')
+    if not 0 <= shell_auth <= SHELL_IDLE_MAX:
+        raise ConfigError(f'web.shell_auth_timeout: {shell_auth} is not between 0 and {SHELL_IDLE_MAX}')
 
     https_ports = []
     for option in ('web_port', 'manager_port'):

debian-package/src/usr/lib/vpn-router/web

@@ -38,8 +38,9 @@ Pages:
            the DER certificate and CRL of the root (root) and of each issuing CA, which the
            certificates name in their AIA and CRL distribution points; no authentication
   /shell   while web.shell is true, a login shell of the user's console account on a terminal, for
-           a member of admins whose console login is on: POST signs the
-           user in again for a one-time ticket (see shell_ticket()), GET with it is a WebSocket
+           a member of admins whose console login is on: POST signs the user in again, unless
+           the user used a shell within web.shell_auth_timeout minutes, for a one-time ticket
+           (see shell_ticket()), GET with it is a WebSocket
            that carries the terminal (see Handler.shell())
   /auth   sign-in with a user's password and TOTP code, refresh and sign-out (see auth())
   /metrics/history
@@ -89,6 +90,7 @@ import collections
 import configparser
 import fcntl
 import hashlib
+import ipaddress
 import json
 import os
 import pwd
@@ -188,6 +190,9 @@ _auth_lock = threading.Lock()
 _shell_tickets = {}
 _shell_lock = threading.Lock()
 
+#: The last use of a shell of each user, a sign-in of POST /shell or a keystroke: user -> monotonic time.
+_shell_used = {}
+
 
 def read_json(path):
     """The object in a JSON file, or {} when the file is missing or holds no object."""
@@ -402,7 +407,7 @@ def postgresql_databases():
 
 def details(state):
     """What /config shows: the configuration without its secrets, and what the router resolved and runs; caddy is the
-    installed Caddy, {version, source}, null when it is not installed."""
+    installed Caddy, {version, source, service}, service the state of caddy.service, null when it is not installed."""
     configuration = state.get('configuration', {})
     caddy = package_version('caddy')
     return {
@@ -419,8 +424,8 @@ def details(state):
         },
         'postgresql': postgresql_configuration(),
         # Caddy is upstream's once its repository is configured (vpn-router-caddy).
-        'caddy': {'version': caddy, 'source': 'upstream' if vpnrouter.CADDY_APT_SOURCE.is_file() else 'ubuntu'}
-                 if caddy else None,
+        'caddy': {'version': caddy, 'source': 'upstream' if vpnrouter.CADDY_APT_SOURCE.is_file() else 'ubuntu',
+                  'service': unit_state('caddy.service')} if caddy else None,
     }
 
 
@@ -823,13 +828,32 @@ def backup(method, path, body):
     return 200, {'settings': backup_settings(cfg['backup'])}
 
 
+def wireguard_server(cfg, state):
+    """What a WireGuard peer's configuration needs of the router: {public_key, endpoint, allowed_ips}; public_key is
+    null before setup made the key pair, endpoint, <wan.local_fqdn>:<wireguard.listen_port>, null without a name, and
+    allowed_ips the networks reached through the tunnel, the router's local CIDRs and the WireGuard network."""
+    try:
+        public_key = vpnrouter.WG_PUBLIC_KEY.read_text(encoding='utf-8').strip() or None
+    except OSError:
+        public_key = None
+    fqdn = cfg['wan']['local_fqdn'].strip()
+    address = cfg['wireguard']['address'].strip()
+    networks = section(state, 'network').get('local_cidrs')
+    allowed = [cidr for cidr in networks if isinstance(cidr, str)] if isinstance(networks, list) else []
+    if address:
+        allowed.append(str(ipaddress.ip_interface(address).network))
+    return {'public_key': public_key, 'endpoint': f'{fqdn}:{cfg["wireguard"]["listen_port"]}' if fqdn else None,
+            'allowed_ips': list(dict.fromkeys(allowed))}
+
+
 def remote_access(state, method, path, body):
     """Answer a /remote-access request: the HTTP status and the JSON document.
 
-      GET /remote-access            {"p2s", "openvpn", "wireguard", "running", "local_fqdn"}: the settings of the three
-                                    remote access systems (REMOTE_ACCESS), whether setup runs each (running: {p2s,
-                                    openvpn, wireguard}), and wan.local_fqdn, which IKEv2 and OpenVPN need with the
-                                    router's VPN server certificate
+      GET /remote-access            {"p2s", "openvpn", "wireguard", "running", "local_fqdn", "wireguard_server"}: the
+                                    settings of the three remote access systems (REMOTE_ACCESS), whether setup runs
+                                    each (running: {p2s, openvpn, wireguard}), wan.local_fqdn, which IKEv2 and OpenVPN
+                                    need with the router's VPN server certificate, and what a WireGuard peer's
+                                    configuration needs of the router (wireguard_server)
       PUT /remote-access/<system>   change any of the settings of the system's section; answers the section
 
     A change is made as /site-to-site makes one, and applied by restarting vpn-router-setup without waiting for it.
@@ -843,7 +867,8 @@ def remote_access(state, method, path, body):
             cfg = vpnrouter.load_config()
             return 200, {**{system: cfg[system] for system in REMOTE_ACCESS},
                          'running': {system: bool(state.get(system)) for system in REMOTE_ACCESS},
-                         'local_fqdn': cfg['wan']['local_fqdn']}
+                         'local_fqdn': cfg['wan']['local_fqdn'],
+                         'wireguard_server': wireguard_server(cfg, state)}
         if method != 'PUT' or len(parts) != 2 or parts[1] not in REMOTE_ACCESS:
             return 404, {'error': f'no route {method} {path}'}
         system = parts[1]
@@ -1084,19 +1109,28 @@ def shell_ticket(name, body):
     """Answer POST /shell: the HTTP status and the JSON document.
 
     The user named by the token signs in again with {"password", "code"?}; a wrong password or code is 403 and counts
-    as a failed login. The answer is {"ticket", "expires_in"}: a ticket that opens one shell (GET /shell) for the
-    same user within SHELL_TICKET_SECONDS. 403 while web.shell is false or the user's console login is not on.
+    as a failed login. Without a password, the user is not asked to sign in while its last use of a shell (see
+    _shell_used) is less than web.shell_auth_timeout minutes ago. The answer is {"ticket", "expires_in"}: a ticket that
+    opens one shell (GET /shell) for the same user within SHELL_TICKET_SECONDS, or a null ticket when the user must
+    sign in. 403 while web.shell is false or the user's console login is not on.
     """
     if not isinstance(name, str):
         return 403, {'error': 'the shell needs a token of a signed-in user'}
     if not isinstance(body, dict):
         return 400, {'error': 'the body must be a JSON object'}
     try:
-        if not vpnrouter.load_config()['web']['shell']:
+        options = vpnrouter.load_config()['web']
+        if not options['shell']:
             return 403, {'error': 'the shell is disabled; vpn-config-edit set web.shell true enables it'}
         if console_account(name) is None:
             return 403, {'error': f'console login is not enabled for {name}; vpn-router-user console sets it'}
-        vpnrouter_users.login(name, body.get('password'), body.get('code'))
+        if 'password' not in body:
+            with _shell_lock:
+                used = _shell_used.get(name)
+            if used is None or time.monotonic() - used >= options['shell_auth_timeout'] * 60:
+                return 200, {'ticket': None, 'expires_in': 0}
+        else:
+            vpnrouter_users.login(name, body.get('password'), body.get('code'))
     except vpnrouter_users.Failure as failure:
         if failure.status == 5:
             return 403, {'error': 'the password or the code is wrong'}
@@ -1111,6 +1145,7 @@ def shell_ticket(name, body):
         for unused in [key for key, (_, expires) in _shell_tickets.items() if expires <= now]:
             del _shell_tickets[unused]
         _shell_tickets[ticket] = (name, now + SHELL_TICKET_SECONDS)
+        _shell_used[name] = now
     return 200, {'ticket': ticket, 'expires_in': SHELL_TICKET_SECONDS}
 
 
@@ -1315,6 +1350,8 @@ class Handler(BaseHTTPRequestHandler):
                     if opcode == BINARY:
                         os.write(master, payload)
                         typed[0] = time.monotonic()
+                        with _shell_lock:
+                            _shell_used[name] = typed[0]
                     elif opcode == TEXT:
                         size = json.loads(payload)
                         fcntl.ioctl(master, termios.TIOCSWINSZ, struct.pack('HHHH', int(size['rows']), int(size['cols']), 0, 0))

debian-package/src/usr/share/doc/vpn-router/vpn-router.json.example

@@ -63,7 +63,8 @@
     "trusted_proxies": [],
     "status_content": "basic",
     "shell": false,
-    "shell_idle_minutes": 15
+    "shell_idle_minutes": 15,
+    "shell_auth_timeout": 15
   },
   "ssh": {
     "ldap_login": false