Keep IPv6 router announcements working with forwarding on

With net.ipv6.conf.all.forwarding=1, Linux ignores router announcements
unless accept_ra is 2, so a server that gets its IPv6 route by SLAAC
(e.g. a Raspberry Pi at home) lost IPv6 once the route expired.

The sysctl file now also sets accept_ra=2 for the default and for every
network card and the IPv6 default-route interface, except where
accept_ra is 0. "update" rewrites the file, which fixes existing
installs. A new health check warns while the uplink still has
accept_ra=1.

README.md

@@ -40,19 +40,6 @@ dependencies on the server: the binary installs, updates and removes itself.
 - **HTTPS built in:** Let's Encrypt, a self-signed certificate, your own
   certificate files, or plain HTTP behind a reverse proxy.
 
-## Screenshots
-
-| | |
-|---|---|
-| ![Peers list with status, endpoint, latency sparklines and 30-day traffic](screenshots/peers.png) | ![Peer page with traffic and latency charts, connection details and history](screenshots/peer.png) |
-| **Peers:** status, endpoint, latency and traffic at a glance | **Peer:** traffic, latency, connection history and settings |
-| ![Server page with health checks, interface, endpoint, client defaults and firewall](screenshots/server.png) | ![Settings with users, web interface and API tokens](screenshots/settings.png) |
-| **Server:** health, address plan, client defaults and firewall | **Settings:** users, web interface and API tokens |
-| ![My account page with profile, password and own app tokens](screenshots/account.png) | ![Sign-in page](screenshots/login.png) |
-| **My account:** profile, password and your app tokens | **Sign-in** |
-
-The screenshots show sample data from the built-in simulator.
-
 ## Security
 
 - **Client private keys are never stored.** A config is shown once, as a
@@ -65,16 +52,19 @@ The screenshots show sample data from the built-in simulator.
   `CAP_NET_ADMIN` and `CAP_NET_BIND_SERVICE`, and can write only to
   `/opt/ghostwire`.
 - **Sign-in:** one or more users, all admins. Passwords are stored as argon2id hashes.
-  After 5 failed attempts, sign-in is locked for 15 minutes. Sessions use an
+  After 5 failed attempts from one IP address, sign-in from it is locked for 15
+  minutes; wrong two-step codes count too. Sessions use an
   HttpOnly, SameSite=Strict cookie and last 12 hours by default.
-- **Two-step sign-in:** each user can add an authenticator app (TOTP), security
-  keys such as a YubiKey, and passkeys that sign in without a password, under
-  My account. Turning it on gives 10 one-time recovery codes. An admin can
-  require it for everyone (Settings → Sign-in) and reset it for a user who lost
-  their phone or key. Security keys and passkeys use WebAuthn and need the
-  server's domain name with a trusted certificate (Let's Encrypt, certificate
-  files, or a reverse proxy); on a self-signed certificate or an IP address,
-  only the authenticator app is offered. API tokens never need a second step.
+- **Two-step sign-in:** each user can add an authenticator app (TOTP) and
+  passkeys under My account. A passkey signs in on its own, without username
+  and password, and also works as the second step after a password. It can live
+  on the device (Touch ID, Face ID, Windows Hello), in a password manager, or on
+  a YubiKey with a PIN set. Turning it on gives 10 one-time recovery codes. An
+  admin can require it for everyone (Settings → Sign-in) and reset it for a user
+  who lost their phone or key. Passkeys use WebAuthn and need the server's
+  domain name with a trusted certificate (Let's Encrypt, certificate files, or a
+  reverse proxy); on a self-signed certificate or an IP address, only the
+  authenticator app is offered. API tokens never need a second step.
 - **API tokens** are stored only as hashes and can be read-only or full access.
 - `config.json` holds the server private key and is readable only by the
   service (0600).
@@ -227,7 +217,7 @@ After editing `config.json` by hand, run `sudo systemctl reload ghostwire`.
 | File | Content |
 |---|---|
 | `GHOSTWIRE` | the program |
-| `config.json` | all settings, server key, peers, token hashes (0600) |
+| `config.json` | all settings, server key, peers, pending setup links with their PINs, user password hashes, authenticator app secrets, passkeys, recovery code and token hashes (0600) |
 | `stats.json` | traffic and connection history per peer |
 | `geo-country.mmdb`, `geo-asn.mmdb` | DB-IP Lite databases for country and network lookups |
 | `GHOSTWIRE.jsonl` | log, one JSON object per line. Changes carry `"audit":true` |
@@ -237,7 +227,8 @@ After editing `config.json` by hand, run `sudo systemctl reload ghostwire`.
 
 Base path `/api/v1`. The web interface signs in with a session cookie; every
 user is an admin. Apps and scripts use `Authorization: Bearer <token>`; create
-the token under Settings → Pair iOS app. A token belongs to the user who made
+the token under Settings → Pair iOS app, or in the iOS app under Settings →
+Access → API tokens. A token belongs to the user who made
 it and is revoked when that user is deleted. A read-only token may only use
 GET. Full-access tokens can do everything the web interface does except backup
 and restore. Users, passwords and API tokens need a full-access token even for
@@ -262,7 +253,7 @@ POST   /auth/login/totp · /auth/login/recovery {"ticket", "code"}
 POST   /auth/login/key/begin {"ticket"} · /auth/login/key/finish?ticket=  (body: the WebAuthn credential)
 POST   /auth/login/passkey/begin · /auth/login/passkey/finish?id=
 signed in: GET /auth/mfa · POST /auth/mfa/totp/setup · /auth/mfa/totp/confirm · DELETE /auth/mfa/totp
-signed in: POST /auth/mfa/keys/begin {"passkey"} · /auth/mfa/keys/finish?name= · PATCH|DELETE /auth/mfa/keys/{id}
+signed in: POST /auth/mfa/keys/begin · /auth/mfa/keys/finish?name= · PATCH|DELETE /auth/mfa/keys/{id}
 signed in: POST /auth/mfa/recovery-codes
 GET    /status                           GET /stats?range=24h|7d|30d|90d
 GET    /server         PATCH /server     POST /server/rotate-key     GET /server/detect-ip
@@ -306,7 +297,8 @@ override a drop in another table, so if ufw or firewalld is active, allow UDP
 
 The native iPhone app (SwiftUI, iOS 17+) lives in its own project,
 GHOSTWIRE-Companion. It does everything the web interface does except
-password, API tokens and backups. Pair it in the web interface under
+backup and restore, and adding an authenticator app or passkeys for two-step
+sign-in. Pair it in the web interface under
 Settings → Pair iOS app: scan the QR code, or tap "Copy pairing code" and paste
 it into the app's "Enter manually". Self-signed certificates are pinned during
 pairing.

app.js

@@ -144,7 +144,6 @@
     if (!m) return '';
     const parts = [];
     if (m.totp) parts.push('App');
-    if (m.keys) parts.push(m.keys === 1 ? '1 key' : m.keys + ' keys');
     if (m.passkeys) parts.push(m.passkeys === 1 ? '1 passkey' : m.passkeys + ' passkeys');
     return parts.join(', ');
   }
@@ -636,7 +635,7 @@
     // allows it.
     const passkeyRow = h('div', { class: 'loginalt', hidden: true },
       h('div', { class: 'or' }, 'or'),
-      h('button', { type: 'button', class: 'btn altbtn', onClick: async () => {
+      h('button', { type: 'button', class: 'btn altbtn signin', onClick: async () => {
         err.textContent = '';
         try {
           const b = await api('POST', '/auth/login/passkey/begin');
@@ -644,7 +643,7 @@
           await api('POST', '/auth/login/passkey/finish?id=' + encodeURIComponent(b.id), cred);
           await signedIn();
         } catch (x) { err.textContent = keyError(x); }
-      } }, icon('key', 18), 'Sign in with a passkey'));
+      } }, icon('key', 18), h('span', { class: 'en' }, 'Sign in with a passkey'), h('span', { class: 'ja', lang: 'ja', 'aria-hidden': 'true' }, 'パスキーでサインイン')));
     if (window.PublicKeyCredential) {
       api('GET', '/auth/options').then((o) => { passkeyRow.hidden = !o.passkeys; }).catch(() => {});
     }
@@ -706,7 +705,7 @@
   function keyError(x) {
     if (x && x.name === 'NotAllowedError') return 'Cancelled or timed out. Try again.';
     if (x && x.name === 'InvalidStateError') return 'This key is already set up for your account.';
-    if (x && x.name === 'SecurityError') return 'Security keys need this site on its domain name with a trusted certificate.';
+    if (x && x.name === 'SecurityError') return 'Passkeys need this site on its domain name with a trusted certificate.';
     return x.message;
   }
 
@@ -720,11 +719,11 @@
     let mode = canKey ? 'key' : methods.includes('totp') ? 'totp' : 'recovery';
     const box = h('div', { class: 'loginform' });
     const TITLES = {
-      key: ['Use your security key', 'Insert your key and touch it, or use the passkey on this device.'],
+      key: ['Use your passkey', 'Confirm with Touch ID, Face ID, Windows Hello or your password manager, or insert your YubiKey and touch it.'],
       totp: ['Enter the code', 'The 6-digit code from your authenticator app.'],
       recovery: ['Use a recovery code', 'One of the codes you saved when you set up two-step sign-in. Each works once.'],
     };
-    const LINKS = { key: 'Use a security key instead', totp: 'Use an authenticator code instead', recovery: 'Use a recovery code' };
+    const LINKS = { key: 'Use a passkey instead', totp: 'Use an authenticator code instead', recovery: 'Use a recovery code' };
     const head = h('div', { class: 'logintext' });
     const draw = () => {
       const err = h('p', { class: 'err-text', role: 'alert' });
@@ -733,7 +732,7 @@
         .map((m) => h('button', { type: 'button', class: 'linkbtn', onClick: () => { mode = m; draw(); } }, LINKS[m]));
       const foot = h('div', { class: 'loginlinks' }, others, h('button', { type: 'button', class: 'linkbtn', onClick: showLogin }, 'Start over'));
       if (mode === 'key') {
-        const btn = h('button', { type: 'button', class: 'btn primary' }, 'Use security key');
+        const btn = h('button', { type: 'button', class: 'btn primary' }, 'Use passkey');
         const go = async () => {
           err.textContent = '';
           btn.disabled = true;
@@ -788,8 +787,7 @@
         h('p', null, 'This server asks for a second step after the password. Add one to continue.')),
       h('div', { class: 'loginform' },
         h('button', { type: 'button', class: 'btn primary', onClick: () => addTOTP(done) }, 'Use an authenticator app'),
-        keys ? h('button', { type: 'button', class: 'btn altbtn', onClick: () => addKey(false, done) }, 'Use a security key') : null,
-        keys ? h('button', { type: 'button', class: 'btn altbtn', onClick: () => addKey(true, done) }, 'Use a passkey') : null,
+        keys ? h('button', { type: 'button', class: 'btn altbtn', onClick: () => addPasskey(done) }, 'Use a passkey') : null,
         h('div', { class: 'loginlinks' }, h('button', { type: 'button', class: 'linkbtn', onClick: logout }, 'Sign out'))))));
   }
 
@@ -841,30 +839,28 @@
     code.focus();
   }
 
-  // addKey adds a security key, or with passkey a passkey that also signs
-  // in without a password.
-  function addKey(passkey, onDone) {
-    const nm = h('input', { id: 'kn', value: passkey ? 'Passkey' : 'YubiKey', autocomplete: 'off', maxLength: 64 });
+  // addPasskey adds a passkey. It signs in on its own, and also serves as
+  // the second step after a password.
+  function addPasskey(onDone) {
+    const nm = h('input', { id: 'kn', value: 'Passkey', autocomplete: 'off', maxLength: 64 });
     const e = h('p', { class: 'err-text', role: 'alert' });
-    const btn = h('button', { type: 'submit', class: 'btn primary' }, passkey ? 'Add passkey' : 'Add security key');
+    const btn = h('button', { type: 'submit', class: 'btn primary' }, 'Add passkey');
     dialog((close) => h('form', { class: 'dlg', onSubmit: async (ev) => {
       ev.preventDefault();
       e.textContent = '';
       btn.disabled = true;
       try {
-        const opts = await api('POST', '/auth/mfa/keys/begin', { passkey });
+        const opts = await api('POST', '/auth/mfa/keys/begin');
         const cred = await webauthnCreate(opts);
         const res = await api('POST', '/auth/mfa/keys/finish?name=' + encodeURIComponent(nm.value.trim()), cred);
         close();
-        toast((passkey ? 'Passkey' : 'Security key') + ' added');
+        toast('Passkey added');
         afterAdd(res, onDone);
       } catch (x) { e.textContent = keyError(x); btn.disabled = false; }
     } },
-    h('h2', null, passkey ? 'Add a passkey' : 'Add a security key'),
-    h('p', null, passkey
-      ? 'A passkey signs you in on its own, without username and password. It can live in your password manager, on this device (Touch ID, Face ID, Windows Hello) or on a YubiKey.'
-      : 'A YubiKey or other FIDO2 key, asked for after your password. Have it ready: your browser asks you to insert and touch it.'),
-    h('div', { class: 'field' }, h('label', { htmlFor: 'kn' }, 'Name'), nm, h('span', { class: 'hint' }, 'So you can tell your keys apart')),
+    h('h2', null, 'Add a passkey'),
+    h('p', null, 'A passkey signs you in on its own, without username and password, and also works as the second step after your password. It can live on this device (Touch ID, Face ID, Windows Hello), in your password manager, or on a YubiKey with a PIN set.'),
+    h('div', { class: 'field' }, h('label', { htmlFor: 'kn' }, 'Name'), nm, h('span', { class: 'hint' }, 'So you can tell your passkeys apart, for example "MacBook" or "YubiKey"')),
     e,
     h('div', { class: 'foot' }, h('button', { type: 'button', class: 'btn', onClick: close }, 'Cancel'), btn)));
     nm.select();
@@ -910,7 +906,7 @@
       }
       for (const k of s.keys) {
         rows.push(h('div', { class: 'mfarow' }, h('div', { class: 'grow' }, h('strong', null, k.name),
-          h('div', { class: 'hint' }, (k.passkey ? 'Passkey' : 'Security key') + ' · added ' + fmtDate(k.created) + ' · ' + (k.lastUsed ? 'last used ' + ago(k.lastUsed) : 'not used yet'))),
+          h('div', { class: 'hint' }, 'Added ' + fmtDate(k.created) + ' · ' + (k.lastUsed ? 'last used ' + ago(k.lastUsed) : 'not used yet'))),
         h('button', { type: 'button', class: 'btn small', onClick: () => renameKey(k) }, 'Rename'),
         h('button', { type: 'button', class: 'btn danger small', onClick: () => removeKey(k) }, 'Remove')));
       }
@@ -922,9 +918,8 @@
         rows.length ? h('div', { class: 'mfalist' }, rows) : h('div', { class: 'notice' }, s.required ? 'Two-step sign-in is required on this server.' : 'Two-step sign-in is off for your account.'),
         h('div', { class: 'actions section' },
           s.totp ? null : h('button', { type: 'button', class: 'btn primary', onClick: () => addTOTP(draw) }, 'Add authenticator app'),
-          keys ? h('button', { type: 'button', class: 'btn', onClick: () => addKey(false, draw) }, 'Add security key') : null,
-          keys ? h('button', { type: 'button', class: 'btn', onClick: () => addKey(true, draw) }, 'Add passkey') : null),
-        keys ? null : h('p', { class: 'hint section' }, 'Security keys and passkeys need this site on its domain name with a trusted certificate (Let\'s Encrypt or certificate files).'),
+          keys ? h('button', { type: 'button', class: 'btn', onClick: () => addPasskey(draw) }, 'Add passkey') : null),
+        keys ? null : h('p', { class: 'hint section' }, 'Passkeys need this site on its domain name with a trusted certificate (Let\'s Encrypt or certificate files).'),
       ].filter(Boolean));
     };
     draw();
@@ -1839,7 +1834,7 @@
       h('div', { class: 'foot' }, h('button', { type: 'button', class: 'btn', onClick: close }, 'Cancel'), h('button', { type: 'submit', class: 'btn primary' }, 'Reset password'))));
     };
     const resetMFA = async (u) => {
-      if (!await confirmDialog({ title: 'Reset two-step sign-in for ' + u.username + '?', text: 'Their authenticator app, security keys, passkeys and recovery codes are removed. They sign in with their password and can set it up again.', ok: 'Reset', danger: true })) return;
+      if (!await confirmDialog({ title: 'Reset two-step sign-in for ' + u.username + '?', text: 'Their authenticator app, passkeys and recovery codes are removed. They sign in with their password and can set it up again.', ok: 'Reset', danger: true })) return;
       try { await api('POST', '/users/' + u.id + '/reset-mfa'); toast('Two-step sign-in reset for ' + u.username); reloadUsers(); } catch (x) { toast(x.message, true); }
     };
     const deleteUser = async (u) => {
@@ -2017,7 +2012,7 @@
 
       h('section', { class: 'card', 'aria-labelledby': 'sgn' },
         h('h2', { id: 'sgn' }, 'Sign-in'),
-        h('p', { class: 'lead' }, 'Everyone sets up two-step sign-in under My account: an authenticator app, security keys such as a YubiKey, or passkeys. Changes apply immediately.'),
+        h('p', { class: 'lead' }, 'Everyone sets up two-step sign-in under My account: an authenticator app or passkeys, including on a YubiKey. Changes apply immediately.'),
         h('label', { class: 'check' }, requireBox, h('span', null, 'Require two-step sign-in for everyone', h('br'),
           h('span', { class: 'hint' }, 'Users without it are asked to set it up right after their password. To help someone who lost their phone or key, use Edit → Reset two-step sign-in.')))),
 

config.go

@@ -204,6 +204,9 @@ func (c *Config) applyDefaults() {
 		c.Users = []User{u}
 	}
 	c.Admin = nil
+	for i := range c.Users {
+		dropSecurityKeys(&c.Users[i])
+	}
 	for i := range c.APITokens {
 		if c.APITokens[i].UserID == "" {
 			c.APITokens[i].UserID = c.Users[0].ID // tokens from before users existed

kernel.go

@@ -3,6 +3,8 @@ package main
 import (
 	"log/slog"
 	"net/netip"
+	"os"
+	"strings"
 	"sync"
 	"time"
 )
@@ -38,6 +40,15 @@ type Kernel interface {
 	Close() error
 }
 
+// readSysctl returns the trimmed content of a /proc/sys file, or "".
+func readSysctl(path string) string {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return ""
+	}
+	return strings.TrimSpace(string(b))
+}
+
 // Reconciler applies the config to the kernel whenever it is triggered and
 // remembers the outcome for the health report.
 type Reconciler struct {

kernel_linux.go

@@ -3,13 +3,13 @@
 package main
 
 import (
+	"cmp"
 	"errors"
 	"fmt"
 	"net"
 	"net/netip"
 	"os"
 	"slices"
-	"strings"
 
 	"github.com/vishvananda/netlink"
 	"golang.zx2c4.com/wireguard/wgctrl"
@@ -318,14 +318,6 @@ func publicAddr(uplink string, v6 bool) (bool, string) {
 	return false, "no address on " + uplink
 }
 
-func readSysctl(path string) string {
-	b, err := os.ReadFile(path)
-	if err != nil {
-		return ""
-	}
-	return strings.TrimSpace(string(b))
-}
-
 func (k *linuxKernel) Checks(c *Config) []Check {
 	var out []Check
 	link, err := netlink.LinkByName(c.Server.Interface)
@@ -341,6 +333,19 @@ func (k *linuxKernel) Checks(c *Config) []Check {
 		v := readSysctl("/proc/sys/net/ipv6/conf/all/forwarding")
 		out = append(out, Check{"IPv6 forwarding", v == "1", "net.ipv6.conf.all.forwarding=" + v})
 	}
+	// With IPv6 forwarding on, accept_ra 1 means router announcements are
+	// ignored: an IPv6 route learned from them expires (see sysctlConf).
+	if readSysctl("/proc/sys/net/ipv6/conf/all/forwarding") == "1" {
+		up := cmp.Or(k.Uplink(c, true), k.Uplink(c, false))
+		if ra := readSysctl("/proc/sys/net/ipv6/conf/" + up + "/accept_ra"); up != "" && ra != "" {
+			ok := ra != "1"
+			detail := "net.ipv6.conf." + up + ".accept_ra=" + ra
+			if !ok {
+				detail += ": IPv6 from router announcements stops working; run " + appName + " update"
+			}
+			out = append(out, Check{"IPv6 router announcements", ok, detail})
+		}
+	}
 	ok, detail := firewallPresent()
 	out = append(out, Check{"nftables rules", ok, detail})
 	up4 := k.Uplink(c, false)

main_test.go

@@ -12,6 +12,7 @@ import (
 	"net/netip"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -376,6 +377,38 @@ func TestUnitFile(t *testing.T) {
 	}
 }
 
+func TestSysctlConf(t *testing.T) {
+	dir := t.TempDir()
+	conf, sys := filepath.Join(dir, "conf"), filepath.Join(dir, "net")
+	for name, ra := range map[string]string{"eth0": "1", "wlan0": "2", "eth1": "0", "br0": "1", "veth1": "1", "lo": "1"} {
+		_ = os.MkdirAll(filepath.Join(conf, name), 0o755)
+		_ = os.WriteFile(filepath.Join(conf, name, "accept_ra"), []byte(ra+"\n"), 0o644)
+	}
+	for _, name := range []string{"eth0", "wlan0", "eth1"} { // network cards
+		_ = os.MkdirAll(filepath.Join(sys, name, "device"), 0o755)
+	}
+	_ = os.MkdirAll(filepath.Join(sys, "veth1"), 0o755)
+	// br0 carries the default route; the lo line is the kernel's unreachable route.
+	routes := filepath.Join(dir, "ipv6_route")
+	_ = os.WriteFile(routes, []byte(
+		"00000000000000000000000000000000 00 00000000000000000000000000000000 00 fe800000000000000000000000000001 00000400 00000001 00000000 00000003     br0\n"+
+			"00000000000000000000000000000000 00 00000000000000000000000000000000 00 00000000000000000000000000000000 ffffffff 00000001 00000000 00200200       lo\n"), 0o644)
+
+	got := raInterfaces(conf, sys, routes)
+	if want := []string{"br0", "eth0", "wlan0"}; !slices.Equal(got, want) {
+		t.Fatalf("raInterfaces = %v, want %v", got, want)
+	}
+	c := sysctlConf(got)
+	for _, want := range []string{"net.ipv6.conf.all.forwarding=1\n", "net.ipv6.conf.default.accept_ra=2\n", "net.ipv6.conf.eth0.accept_ra=2\n", "net.ipv6.conf.br0.accept_ra=2\n"} {
+		if !strings.Contains(c, want) {
+			t.Errorf("sysctl conf lacks %q:\n%s", want, c)
+		}
+	}
+	if strings.Contains(c, "eth1") || strings.Contains(c, "veth1") {
+		t.Errorf("sysctl conf names eth1 (accept_ra 0) or veth1 (virtual):\n%s", c)
+	}
+}
+
 func TestWriteIfChanged(t *testing.T) {
 	p := filepath.Join(t.TempDir(), "x.conf")
 	if ch, err := writeIfChanged(p, "a\n", 0o644); !ch || err != nil {
@@ -1050,7 +1083,7 @@ func TestMFA(t *testing.T) {
 	if o := adm("GET", "/auth/options", nil, 200); o["passkeys"] != false {
 		t.Fatalf("passkeys offered on an IP address: %v", o)
 	}
-	adm("POST", "/auth/mfa/keys/begin", map[string]bool{"passkey": true}, 400)
+	adm("POST", "/auth/mfa/keys/begin", nil, 400)
 
 	// Turn on the authenticator app; the first method brings recovery codes.
 	setup := adm("POST", "/auth/mfa/totp/setup", nil, 200)
@@ -1121,3 +1154,30 @@ func TestMFA(t *testing.T) {
 		t.Fatal("reset left methods behind")
 	}
 }
+
+// TestDropSecurityKeys checks that security keys from v0.3.0 are deleted on
+// load, and recovery codes with them when nothing else is left.
+func TestDropSecurityKeys(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "config.json")
+	cfg := `{"users": [
+		{"id": "a", "username": "a", "passwordHash": "x", "mfa": {"keys": [{"id": "k", "name": "YubiKey", "passkey": false}], "recoveryCodes": ["h"]}},
+		{"id": "b", "username": "b", "passwordHash": "x", "mfa": {"keys": [{"id": "k1", "name": "YubiKey", "passkey": false}, {"id": "k2", "name": "Mac", "passkey": true}], "recoveryCodes": ["h"]}}
+	]}`
+	if err := os.WriteFile(path, []byte(cfg), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	store, err := openStore(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	c := store.Get()
+	if a := c.Users[0].MFA; len(a.Keys) != 0 || len(a.RecoveryCodes) != 0 {
+		t.Fatalf("user a kept %v", a)
+	}
+	if b := c.Users[1].MFA; len(b.Keys) != 1 || b.Keys[0].Name != "Mac" || len(b.RecoveryCodes) != 1 {
+		t.Fatalf("user b: %v", b)
+	}
+	if b, _ := os.ReadFile(path); strings.Contains(string(b), "YubiKey") {
+		t.Fatal("security key still in config.json")
+	}
+}

mfa.go

@@ -24,9 +24,10 @@ import (
 	"github.com/go-webauthn/webauthn/webauthn"
 )
 
-// Two-step sign-in for the web interface: an authenticator app (TOTP),
-// security keys such as a YubiKey and passkeys (both WebAuthn), plus
-// one-time recovery codes. API tokens never need a second step.
+// Two-step sign-in for the web interface: an authenticator app (TOTP) and
+// passkeys (WebAuthn, also on a YubiKey), plus one-time recovery codes. A
+// passkey signs in on its own and also serves as the second step after a
+// password. API tokens never need a second step.
 //
 // After a correct password, a user with two-step sign-in gets a short-lived
 // ticket instead of a session; the ticket and a code or key turn into the
@@ -41,16 +42,29 @@ type UserMFA struct {
 	Handle        []byte     `json:"handle,omitempty"`        // WebAuthn user handle
 }
 
-// MFAKey is a security key or passkey.
+// MFAKey is a passkey.
 type MFAKey struct {
 	ID         string              `json:"id"`
 	Name       string              `json:"name"`
-	Passkey    bool                `json:"passkey"` // discoverable: signs in without a password
+	Passkey    bool                `json:"passkey"` // false only for security keys added by v0.3.0, which are deleted
 	Created    time.Time           `json:"created"`
 	LastUsed   *time.Time          `json:"lastUsed,omitempty"`
 	Credential webauthn.Credential `json:"credential"`
 }
 
+// dropSecurityKeys deletes the security keys v0.3.0 could add; only
+// passkeys are supported. A user left without a method loses their
+// recovery codes too.
+func dropSecurityKeys(u *User) {
+	if u.MFA == nil {
+		return
+	}
+	u.MFA.Keys = slices.DeleteFunc(u.MFA.Keys, func(k MFAKey) bool { return !k.Passkey })
+	if !u.hasMFA() {
+		u.MFA.RecoveryCodes = nil
+	}
+}
+
 func (u *User) hasMFA() bool {
 	return u.MFA != nil && (u.MFA.TOTPSecret != "" || len(u.MFA.Keys) > 0)
 }
@@ -166,7 +180,7 @@ func (w waUser) WebAuthnCredentials() []webauthn.Credential {
 	return out
 }
 
-// keysAvailable reports whether security keys and passkeys can work on this
+// keysAvailable reports whether passkeys can work on this
 // address: WebAuthn needs a domain name (not an IP address) and a
 // certificate the browser trusts, or localhost.
 func (a *App) keysAvailable(r *http.Request) bool {
@@ -179,7 +193,7 @@ func (a *App) keysAvailable(r *http.Request) bool {
 
 func (a *App) webAuthn(r *http.Request) (*webauthn.WebAuthn, error) {
 	if !a.keysAvailable(r) {
-		return nil, badRequest("security keys and passkeys need a domain name with a trusted certificate")
+		return nil, badRequest("passkeys need a domain name with a trusted certificate")
 	}
 	scheme := "https"
 	if r.TLS == nil && hostOnly(r.Host) == "localhost" {
@@ -198,12 +212,11 @@ type ticket struct {
 	ip      string
 	expires time.Time
 	fails   int
-	key     *webauthn.SessionData // a security key challenge, once asked for
+	key     *webauthn.SessionData // a passkey challenge, once asked for
 }
 
 type ceremony struct {
 	userID  string // "" for a passkey sign-in
-	passkey bool
 	data    *webauthn.SessionData
 	expires time.Time
 }
@@ -430,7 +443,7 @@ func (a *App) loginRecovery(w http.ResponseWriter, r *http.Request) {
 	a.signedIn(w, r, u, "recovery code")
 }
 
-// loginKeyBegin asks for one of the user's security keys or passkeys.
+// loginKeyBegin asks for one of the user's passkeys, as the second step.
 func (a *App) loginKeyBegin(w http.ResponseWriter, r *http.Request) {
 	var in struct{ Ticket string }
 	if err := readJSON(r, &in); err != nil {
@@ -448,7 +461,7 @@ func (a *App) loginKeyBegin(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if u.MFA == nil || len(u.MFA.Keys) == 0 {
-		writeErr(w, badRequest("no security key is set up"))
+		writeErr(w, badRequest("no passkey is set up"))
 		return
 	}
 	opts, data, err := wa.BeginLogin(waUser{u}, webauthn.WithUserVerification(protocol.VerificationDiscouraged))
@@ -488,13 +501,13 @@ func (a *App) loginKeyFinish(w http.ResponseWriter, r *http.Request) {
 	cred, err := wa.FinishLogin(waUser{u}, *data, r)
 	if err != nil {
 		a.auth.ticketFailed(id, ip)
-		slog.Warn("login failed", "user", u.Username, "remote", ip, "reason", "security key: "+err.Error())
-		a.signInFailed(w, errors.New("the security key was not accepted"))
+		slog.Warn("login failed", "user", u.Username, "remote", ip, "reason", "passkey: "+err.Error())
+		a.signInFailed(w, errors.New("the passkey was not accepted"))
 		return
 	}
 	a.keyUsed(u.ID, cred)
 	a.auth.dropTicket(id)
-	a.signedIn(w, r, u, "security key")
+	a.signedIn(w, r, u, "passkey")
 }
 
 // keyUsed stores the key's new signature counter and when it was used.
@@ -561,7 +574,7 @@ func (a *App) loginPasskeyFinish(w http.ResponseWriter, r *http.Request) {
 			u := &cfg.Users[i]
 			if u.MFA != nil && len(u.MFA.Handle) > 0 && bytes.Equal(u.MFA.Handle, handle) {
 				for _, k := range u.MFA.Keys {
-					if k.Passkey && bytes.Equal(k.Credential.ID, rawID) {
+					if bytes.Equal(k.Credential.ID, rawID) {
 						found = u
 						return waUser{u}, nil
 					}
@@ -587,7 +600,6 @@ func (a *App) loginPasskeyFinish(w http.ResponseWriter, r *http.Request) {
 type keyView struct {
 	ID       string     `json:"id"`
 	Name     string     `json:"name"`
-	Passkey  bool       `json:"passkey"`
 	Created  time.Time  `json:"created"`
 	LastUsed *time.Time `json:"lastUsed"`
 }
@@ -604,7 +616,7 @@ func (a *App) mfaStatus(w http.ResponseWriter, r *http.Request) {
 	if m := u.MFA; m != nil {
 		keys := []keyView{}
 		for _, k := range m.Keys {
-			keys = append(keys, keyView{k.ID, k.Name, k.Passkey, k.Created, k.LastUsed})
+			keys = append(keys, keyView{k.ID, k.Name, k.Created, k.LastUsed})
 		}
 		out["totp"], out["totpAdded"], out["keys"], out["recoveryLeft"] = m.TOTPSecret != "", m.TOTPAdded, keys, len(m.RecoveryCodes)
 	}
@@ -710,13 +722,8 @@ func (a *App) totpRemove(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, map[string]any{"ok": true})
 }
 
-// keyBegin starts adding a security key ({"passkey": false}) or a passkey.
+// keyBegin starts adding a passkey.
 func (a *App) keyBegin(w http.ResponseWriter, r *http.Request) {
-	var in struct{ Passkey bool }
-	if err := readJSON(r, &in); err != nil {
-		writeErr(w, err)
-		return
-	}
 	wa, err := a.webAuthn(r)
 	if err != nil {
 		writeErr(w, err)
@@ -748,17 +755,14 @@ func (a *App) keyBegin(w http.ResponseWriter, r *http.Request) {
 	for _, k := range u.MFA.Keys {
 		exclude = append(exclude, k.Credential.Descriptor())
 	}
-	sel := protocol.AuthenticatorSelection{ResidentKey: protocol.ResidentKeyRequirementDiscouraged, UserVerification: protocol.VerificationDiscouraged}
-	if in.Passkey {
-		sel = protocol.AuthenticatorSelection{ResidentKey: protocol.ResidentKeyRequirementRequired, UserVerification: protocol.VerificationRequired}
-	}
+	sel := protocol.AuthenticatorSelection{ResidentKey: protocol.ResidentKeyRequirementRequired, UserVerification: protocol.VerificationRequired}
 	opts, data, err := wa.BeginRegistration(waUser{u}, webauthn.WithAuthenticatorSelection(sel), webauthn.WithExclusions(exclude))
 	if err != nil {
 		writeErr(w, err)
 		return
 	}
 	a.auth.mu.Lock()
-	a.auth.mfa.enrolls[p.UserID] = &ceremony{userID: p.UserID, passkey: in.Passkey, data: data, expires: time.Now().Add(ticketTTL)}
+	a.auth.mfa.enrolls[p.UserID] = &ceremony{userID: p.UserID, data: data, expires: time.Now().Add(ticketTTL)}
 	a.auth.mu.Unlock()
 	writeJSON(w, http.StatusOK, opts)
 }
@@ -792,13 +796,13 @@ func (a *App) keyFinish(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if name == "" {
-		name = map[bool]string{false: "Security key", true: "Passkey"}[cer.passkey]
+		name = "Passkey"
 	}
 	if len(name) > maxKeyName {
 		name = name[:maxKeyName]
 	}
 	var codes []string
-	key := MFAKey{ID: newID(), Name: name, Passkey: cer.passkey, Created: time.Now().UTC(), Credential: *cred}
+	key := MFAKey{ID: newID(), Name: name, Passkey: true, Created: time.Now().UTC(), Credential: *cred}
 	if err := a.store.Update(func(c *Config) error {
 		_, u := c.userByID(p.UserID)
 		if u == nil || u.MFA == nil {
@@ -811,7 +815,7 @@ func (a *App) keyFinish(w http.ResponseWriter, r *http.Request) {
 		writeErr(w, err)
 		return
 	}
-	a.audit(r, map[bool]string{false: "security key added", true: "passkey added"}[cer.passkey], "key", name)
+	a.audit(r, "passkey added", "key", name)
 	writeJSON(w, http.StatusOK, map[string]any{"ok": true, "recoveryCodes": codes})
 }
 
@@ -865,7 +869,7 @@ func (a *App) keyRemove(w http.ResponseWriter, r *http.Request) {
 		writeErr(w, err)
 		return
 	}
-	a.audit(r, "security key removed", "key", name)
+	a.audit(r, "passkey removed", "key", name)
 	writeJSON(w, http.StatusOK, map[string]any{"ok": true})
 }
 
@@ -917,17 +921,9 @@ func (a *App) resetMFA(w http.ResponseWriter, r *http.Request) {
 
 // mfaSummary is what user lists show.
 func mfaSummary(u *User) map[string]any {
-	out := map[string]any{"totp": false, "keys": 0, "passkeys": 0}
+	out := map[string]any{"totp": false, "passkeys": 0}
 	if m := u.MFA; m != nil {
-		keys, passkeys := 0, 0
-		for _, k := range m.Keys {
-			if k.Passkey {
-				passkeys++
-			} else {
-				keys++
-			}
-		}
-		out["totp"], out["keys"], out["passkeys"] = m.TOTPSecret != "", keys, passkeys
+		out["totp"], out["passkeys"] = m.TOTPSecret != "", len(m.Keys)
 	}
 	return out
 }

setup.go

@@ -12,6 +12,7 @@ import (
 	"os/user"
 	"path/filepath"
 	"runtime"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -273,7 +274,51 @@ WantedBy=multi-user.target
 // rewrite the unit for every release.
 const unitVersion = "unit-1"
 
-const sysctlConf = "net.ipv4.ip_forward=1\nnet.ipv6.conf.all.forwarding=1\n"
+// sysctlConf turns on forwarding. With IPv6 forwarding on, Linux ignores
+// router announcements unless accept_ra is 2, and a server that gets its
+// IPv6 route from them (SLAAC, e.g. a Raspberry Pi at home) loses IPv6 when
+// the route expires. So every interface in ras keeps accepting them, as
+// pivpn does for its uplink.
+func sysctlConf(ras []string) string {
+	var b strings.Builder
+	b.WriteString("net.ipv4.ip_forward=1\nnet.ipv6.conf.all.forwarding=1\nnet.ipv6.conf.default.accept_ra=2\n")
+	for _, name := range ras {
+		fmt.Fprintf(&b, "net.ipv6.conf.%s.accept_ra=2\n", name)
+	}
+	return b.String()
+}
+
+// raInterfaces returns the network cards and the interface of the IPv6
+// default route, except those where router announcements are switched off
+// (accept_ra 0). The directories are /proc/sys/net/ipv6/conf and
+// /sys/class/net, routes is /proc/net/ipv6_route.
+func raInterfaces(confDir, netDir, routes string) []string {
+	want := map[string]bool{}
+	if b, err := os.ReadFile(routes); err == nil {
+		for _, line := range strings.Split(string(b), "\n") {
+			f := strings.Fields(line)
+			if len(f) == 10 && f[0] == strings.Repeat("0", 32) && f[1] == "00" && f[9] != "lo" {
+				want[f[9]] = true
+			}
+		}
+	}
+	entries, _ := os.ReadDir(netDir)
+	for _, e := range entries {
+		// Only real devices: bridges, veth and tunnels come and go.
+		if _, err := os.Stat(filepath.Join(netDir, e.Name(), "device")); err == nil {
+			want[e.Name()] = true
+		}
+	}
+	var out []string
+	for name := range want {
+		v := readSysctl(filepath.Join(confDir, name, "accept_ra"))
+		if v == "1" || v == "2" {
+			out = append(out, name)
+		}
+	}
+	slices.Sort(out)
+	return out
+}
 
 // writeSystemFiles writes the unit, sysctl and module files. It reports
 // whether the unit changed (systemd must then reload).
@@ -281,7 +326,8 @@ func writeSystemFiles() (unitChanged bool, err error) {
 	if unitChanged, err = writeIfChanged(unitPath, unitFile(), 0o644); err != nil {
 		return false, err
 	}
-	sysChanged, err := writeIfChanged(sysctlPath, sysctlConf, 0o644)
+	ras := raInterfaces("/proc/sys/net/ipv6/conf", "/sys/class/net", "/proc/net/ipv6_route")
+	sysChanged, err := writeIfChanged(sysctlPath, sysctlConf(ras), 0o644)
 	if err != nil {
 		return false, err
 	}

users.go

@@ -21,7 +21,7 @@ type userView struct {
 	LastLogin          *tokenUse      `json:"lastLogin"` // since the service started
 	Tokens             int            `json:"tokens"`
 	You                bool           `json:"you"`
-	MFA                map[string]any `json:"mfa"` // {"totp": bool, "keys": n, "passkeys": n}
+	MFA                map[string]any `json:"mfa"` // {"totp": bool, "passkeys": n}
 }
 
 func (a *App) userView(c *Config, u *User, me string) userView {