2

I’m looking for a Web app (self-hosted on GNU/Linux server, FLOSS) that allows me to read/create/edit notes and upload/download files (ideally as attachments to notes). It can be a wiki, but it doesn’t have to be.

As I want to access this site also from devices which I don’t trust (e.g., public computers which could have keyloggers installed), and I can’t use a mobile phone for two-factor authentication, I want to use one-time passwords which I’ll print out and carry with me.

  • I’ll be the only user of the site. My account (or one of my accounts, in case the app requires using a new account for each OTP) should also have a stable password, which I’ll only use on trusted devices.

  • Accessing the notes (and ideally, but not necessarily, also the files) must only be possible while logged in.

  • It should let me generate a new set of one-time passwords, and optionally invalidate previously generated unused passwords. Ideally it would only allow this while not using a one-time password currently (or maybe only via SSH, or from an admin account, etc.).

  • The app should only allow one concurrent session. If multiple sessions are detected (e.g., from different IPs, user agents, whatever) it should logout all of them, requiring me to use another one-time password to login again.

  • When I’m logging out, the session should be invalidated, so even if an attacker copied my session cookie, they should not be able to browse the site after I logged out.

(I’m aware that this doesn’t protect me from eavesdroppers that have control over the device, as they are able to read what I access, or even take over my session on that device; but the important part is that these eavesdroppers can’t access the site anymore after I logged out/in once.)

2

I am not sure if there is an application that supports all this out of the box. You can, however, run a combination.

I would recommend running DokuWiki as a lightweight wiki software.
Then you can run privacyIDEA as the two factor authentication solution. It supports a wide range of different two factor authentication objects. I just added the paper passwords to the todo list at GitHub - but maybe you can get with another token type.
And you need a plugin to connect the DokuWiki login to the two factors - which you can find in my GitHub repo.

This way you could cover all of your points - except this session thing - for now.

  • Can you edit your question to include a link to your GitHub repo? Thanks! – RockPaperLizard Nov 30 '15 at 6:32
  • 1
    I was only allowed to add two links. dokuwiki plugin. It is a bit old... still named after LinOTP, which privacyIDEA is a more modern fork of. privacyIDEA repo – cornelinux Nov 30 '15 at 10:19
  • Thanks. You can post your additional link(s) in a comment, and I will add them for you. :-) – RockPaperLizard Nov 30 '15 at 10:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.