From f73c5d2a123351626ee87cb144db96e5fc866053 Mon Sep 17 00:00:00 2001
From: Ylian Saint-Hilaire <ysainthilaire@hotmail.com>
Date: Tue, 25 May 2021 22:30:33 -0700
Subject: [PATCH] Improved MeshCmd error messages.

---
 agents/MeshCmd-signed.exe   | Bin 4433088 -> 4433400 bytes
 agents/MeshCmd64-signed.exe | Bin 4047552 -> 4047864 bytes
 agents/meshcmd.js           |   8 +-
 webserver.js                | 171 +++++++++++++++++++-----------------
 4 files changed, 99 insertions(+), 80 deletions(-)

diff --git a/agents/MeshCmd-signed.exe b/agents/MeshCmd-signed.exe
index 74a3875d06b09b7e022f09ed9d0774e0549aabd3..fe2c160b56e3eaf5db57c671f8db0167b1700650 100644
GIT binary patch
delta 1486
zcmZ9_c{tPw9LI5E#xWQaN*D%XbHzAwCNoQHSh;IOlbJT>jG4h$b|;1*&7jLq^dxd@
zNaI#5A$v@6l#ZudojTW5jwJTm{?W6~{_*<j`+eS@Zb`oMa(}+Gn2AEu-cwGpQLfV6
z`TQnSP7~@2X@CY8AOmE99FPZCpa2ws62JjvpaN9E2CxyR0d=4OHi6AR6KnxmKpW@)
zJkSMtfB^J?0WbtaU<AGaTY)h!0j9tVn1gM=0$2hPumaZYO(>hd-W+tF4X_1vz#eP|
z4!{vO0cYR>T)__D26nci``i=fkjHom2H`c6<&p75vb^F!DvcAzj-s<TTaog+?s%k7
zouZ^`;GK|6jf<ucf_wrAUyjj-qNAuBI)O&#(4!EQV6sM04_W1ZF?onlSwFJ>Q_}ug
zVzL+<Mie8C03S*5^aKtYK@llh$ZRj!;NQ_LUtg2hbXEd2o^Hvcve_vN7P29jtOk2n
zM3w5Uh9tC-HQEPS$rm3;->gEoB1#5n&nKP2k7jMGTZc8COE~i`uUj#9LP~0N$>J43
z$WqkgPMS;BZtcU3?rvvqHyrGF)NYbbIkkagJUei;uciqXX4;k9>{VIuXwk0FMeUR!
z-#48e6r!ewbF|CNyBHt*R|HpnVVQ_S{w|~NdDqtj875jnr?RPq)Ts%pXMOy8F30s4
z?|#Y74Bb3-;%Lo+q*i0Kv&he(-a9s{F(d!Ylfttn96V~cvrPV_Ayh#IVXhe2VbRMz
z+V8Qq&1+Xh_KI9}*-ycrQ{q?f+g@Ek=g4}b;v6-4{WA-WAOq^lRv}VVD%Vbi3;qaD
z3+J6JQ8JLK4lWQ@J#a?rs|3mHUCShL?Ri~2*ph2f-F2w%qPUXbT(8qqGpuP?wPtZ!
zqIyGR+<N9Z<qenCI2z@Do_MuF<XYD=7f&fKzVEC!&`*)ngxil)G>@JVQ|cw5H-xmv
z8ir<!ju5@Ps-M+I+#5Ijgj<`s+SP3#J>ZEj%PEUIJ8MVV?fXb>vRG4rmtYBp!eXqf
zF{GH&iYjdayL7I)^7}SiSXJIwENd{vh&PvHTIAF*b}L6-UQZ{zsU*X1dR%0GVFwBK
zHGo3NNMSOirS=)}CyIXcDv;T<<a<B#2SlgnZ3|x1HhnIsqj-?^tj@rcA*atv-kdo#
zr=7MkiHmKTz*RQbM$aoRU)LEj>tB3sHLa9JuAM4PF14y3z9Viwj@Wm^@9w;SaSE^Z
zuGv3to*Z^e>Jo?1`=`-jv(jU8EuYGRjW1h<M@W;JA%59mZy%C&`J|etb5l|X`_sQ|
zN#D=vy+$%|``&y8{o+&h<@xYI-u#CU|LTvdkE5SU9@gIGTdZ$Cvn}Fgr0N*M4BvXm
zN0e)Ocgbod!Jpjkxv%`pz=23?cS5?$wC-=EHN7Qu)+ZAqGP@&hOGeQPmBTs4B>K6u
z1)%~{VMk~4V=S(#c6aBzv0=2wQhMGY%NYUE=vbSj93a;A#_H<$nvT=*dANWc8eVSc
z?JL#7%9qJy$JfT4uNYLvhOid>9GHRUIn_@LZV_L2Ucg9Vu0Io*92hc7Eahx93m4}K
zyG;U$f*h^yeeT?4q_Xxf^2puJbOLReu-Hmy^wxP)GIET_q6o@ov_uWqJxaOENt<fo
z#*xd5A2t>_Dy++FDV2KtDWYOfc=OPvbxXCJ6!wt)n>`u6H&Q$&N?yK;rst`kb1i~|
zAH+Ebzk~U6Oq$|3e8fA!;ZPa<7@lbEviNBWBSCE?Pi(VJk}a5hT4aZwY+m(lc*^>n
M?`ql}q#Ydi5C2@1&;S4c

delta 1328
zcmX}keK^wz8~|{?pUtp2P4iM1&Pa0I=5=Uct20swCm}Dj<t3T7P}GV_Pc)a*lF-ge
z>mhGFZRfc=t>mRRM+mp;$=TWA@px<UQn>H^bANpP{j78gP}yq%+L(l>KO*hBor*Bf
z>o;?ok-TQ)KPXTK7=Q&D00%UI7SINGKma=6E1(Ou03y%>TLB5^0|Q_PjKDUq9T)=>
zU<$~<444B8@HMam6kr9c!46;pb^=?l3)q2gz;5s@paL4Omo_5~fiLrLuN;6Qa01T2
z1<-*ja0BjO4`6`3zyo+naj(313&J=8OIP^(8B>#VHkF%_7=4Co&Py>*icU?<;H7Yc
zjqY9~p?S0yRyr?Xwhp7OdBR2k>oWCrci@c{LbCq74T0<B0r!O107~JLOk0DBJkQEi
z(#tVdlhq-WciIDwthKTw?b9*R=t5R8ky>@Opj4-Mo%)O~N+%Rwh@9q_WzdAzJ4Y5f
zgq_xVbAPhS-#khRRxL7%=mP=qIH8q@mCHYvh2t;XvfW@0PR$Y7h34eKlmjXmRcVOW
z^~y8oeQnJ(amnpj2Q(<GiGJl;U=zh#;H54L+3X&|OI7%$N5*e_y`_d1T69)>wEfP%
z>%@Lk)X(BqYE4g}sejJ6d_eOsC1w}pV^qfVnq$s|SvQAk?@r8g^~OepW!MMv-5$v^
z#dbvh4co##PxkTf_7~);a_*iLo70m+B?;w*$w!c<cD*W*rlo1e@!NE7g9S(1MZHj2
zbDL*n4cmSC1cKj}$XlY&yZT3XoVWyjTma2`zcuFbXYX<T5B5s#Npbf3=SESE@AV~m
z^IJO6Z1U&_aa}c6)U8ssR-@@*Lh+BRPkbts?m!ErdT40bUSnTd)<Lu|G<yt{6PxK8
zo#;FDknizvCgARR=p9GN+qKuSxx)m;6ZONmQrA;SqbJA-j()mlE7-zus?Prbf?(A!
zIjEW$OFEQ^yzlF;_**n4cgY)~C@tleCN3r(KSNtvuC(#_=;RyDkF)wiX@rleC3U(;
z+;ZPednKe<SI)7;hu*x%yWGf2zMs})Hx{%mv-30dA*%8@J)*y??)`RG<!?jZ9c7V|
zJ1%EBzdJ;-j2YdWc#KUmqNuF)NsCTWk~DTSlt>!%>Kb%*?v%XDw-{It`fRKvOLvMy
z^F#W^tK?kKeBpQef`@@Ur22zRI0bUvIbMA3moG2Kgt+1G`1mKf?3md4VC*yXsuH<E
zhnHHg7&W@l%PjV0G*Q-Kn02~?s!MZf!TM7*{Z(}hWnuh16)ww?^64A8lO4r5Dn40I
z-xaykBP{j#q;|2pJiPXNrrG`39P+u6#O<xwp@M@k3pISIb4PfTZ#}osEsP^L7N00q
z<oGa(oE)5Q*^h)wXd1k2;WTP9eoxw=X-Yd4aikPaoGh^Qw-{U~yKpZ%VkQkgGBBkj
z7c2yI^iIk~S1OpxzhVQQUOiS+L2x*il|8GKcBE}^HX^`Jam6NSA_zg-xBYA~)2A__
z-FrfIG&Umr@k+Y>od+6=rj`G+<44EewQezy%tyX?-gbqvt4;L%{0Eg*zJ$^eFBztW
zG>lXe51YGoO)0*-LYo#bQf64eVxJ-)xte(2zGTyh6}akFUbbJT^l#d_O=^H5{{rU!
BT#5hy

diff --git a/agents/MeshCmd64-signed.exe b/agents/MeshCmd64-signed.exe
index b6a5bd375e94554b1b1970c62eb2b99b94aee64b..1d47667da1b2d0f3dda49ef564cfb413b6e51932 100644
GIT binary patch
delta 1462
zcmZ9_dpy&79LI4#=CVTWxtmGuj7-)xO6kT)gk)HYi85Q8x!00g%1Y(*lXB^xj_g5^
z?R54Kl~PKJ63LFm@gSXCwqkL{`F8&3aUSQ7=U<=C<Mr;yUx4I=3()P8kV-7q=Ta{8
zlX3?yw+|}pgT7M+Q~(5^3aA0<fChjBRspL4O+X9K2G#&NfG(g1=mQ3TAz%co1&jd`
zz!We8%mE9)60ibLfHi;yY=CuuEwCQ21MC3@z!7i)oCST5%LYlI%BTzA3b+9nz#Z@a
zHUORg7VrW#0^R@)*d$OH#UGo4C3qqN=JXOYV6ljxvHB1tE+vT-OJ%0m!PljD3%JCC
zsA-Abm7GdRN{mB=2JS<BKPJW}#!^zKs5oj0H5OjOA{bsCA*}gdOasIy%)_kzl+1pV
z7)*K!J(iw?0v~J|H93U^Lw-b4cveC{|2t~(<CV>#GLtDZsvCpCVx`fUur7<B5B89-
z4hOFfC%+~b3VL1>>Iam&>)`YTVh(0FI)svuo*46@G{=gk6tnD5xv#5h!fk$zWbKwv
zOY1bFRb0EZYP;v|xADLDMKZkv4m@J1E{2IaZ!npNOP9?Cw|rEtC^fwimU2#X!dc)g
z*u>UsyKOI_XUT*PaqMW7`{zgH5%A|WVlJn%|4sSKp(66s!S25DEmvKp)?-zJZQ`C7
zg)@vuB?R?+YH#tueuh{i`Fzu2^s5lpSa13V??Qz&r!vP1^E?>ZU{5=<R<Y}Yufy`t
zQoCwUvs!^;=gQ)<-VoczgAJ6xn(4mZTgMK(wO4{Oi_%cxgV?F&nqOTqNM&aHE5RId
zC7Gzgvx_t`T|lh<*2%q$z7-%EpEwI!R|^r?wz7VUccDq#_*X^V6W@#z#LXq5hnz<?
zgjkdvIlMb7-d+7#AG)b#g@*q7>9lKt(-;M}Xy7_*+?0lhPMfddhdLP#S&kjQ?#md?
z4BLKns!oq8=jC}9_6EhC)@JXdDML;$qn$X<!Fu4Zm`IGT8q%>~XTgFNghaS|ATa(2
zn@5LBc050tz^zk^2eufQL++aw-k)90O4a^oa<i=ADL1T5R#y7HI=#!7h7@45egq&$
zRS9uQSqa5`wJxV0A#V|Hn|2>2yI80*NF9@w)cOL7^bOC#&$mIx5zU$Hzb6&mLA0<o
zDjKf|ql2|i{6)TNyG=tsQzhF=p<~xRgj)%GNw5tmuPUx$=*;5d<jrEcyPuc2bviOZ
zRKvCop9<+Gw$u2VcJt+v6_a%2*7Cza3eE-R?n{!AOIoQ*UA2QpML$at=1vW0Ql>+@
zv*jbbC*;xbOO5$G=Q!K_)eW8Z>PtFR_qwriqFi3kvdQMo$@TFXO&{2`e64Te?l|Zw
zV+J`oEtp4dJ#&1C{%!_I+RT0D6K?nbGdRgSR;gBki4<nOd``(bWqyBGKuqzyJzigv
zT6Cf&e*2R=-_x8FAT(gtFnu3C)SDC+Bjl$|@(dYP&uo-1cQ|1?&l&808Oay({Ud6n
z;>$<)Wkc3^O{QTzkr{aryY)lHHZET9#C=?vnR^|fkUmvHpVpPZr0Xl*YBw-^A@5nl
zj#SawGiGI)QlC#5p-(Csi(>X~H7UW8OJ}awzR1jI)oZES^0-AW3s+5N?pYvbiZA-+
zL@!4LjV9W&%wv?xwe8&4($Fu_!4DqQx~=3=D);7CVa50W+-=P-QFRAynO0P33-VQ^
zwSKi<1hWd$IfYy=AQ68tsr81d>k-+~KsIlL^eV<>eJe}QTqU2C)Q6K+P4E{7j{Bee
E2Z+j{NB{r;

delta 1304
zcmX}kZ8#GM8~|{e&CE6?lc~v+jWG<Xk?rVQnk0F==A3Ipjcg*lTxD#b&a)+|Rn`?z
zA*`HJU53mfmm(Zpp?icldFjPS)cx<vefWL-E#%H4nzH8+>P&?G;zM4c3=xPtSt;vA
z<aQ(eg9Q2j1<=3%V1OaO0waI}ct8NgzyuJ1DOdr_0123bmB0d!fhAZ4Rs#yK0&9RZ
zpaL7P7OVrdfClKm4%h<*Z~%^gS>KIta{oIQGwcMMfeT;(SKtQR0UN9b8vqA*08g;7
z9y9DEey0>V@Jy7AJzPUldRly{NRS*)6{k{D1Zio9#HqWL>YZLBB~{{uuAlAYYWk7w
zVx{^PFN=j={{C*-p-W-C5zQJ;qmW(Zo({o=S(63Llf|2-@7vlCFAp`CWnu7IRcR#J
zrPaS)P{liI$}*T*w3(+2{WP{dV1@AMkwZ}xK~EO_c<Z{B@}-Xogu*E8UiZe&o3xDs
z4`zP0U$9Zq8hJ8FJC%QYMNTnkr<Zou^kH8Y+J-6a>2aaU7SFs;wyT^&6LmysDqqGu
zF$=E6B}^g<=Wl<S`8-(lH8#3Ogz#0(&RLQ}6o+>)dTA4sd%o(9l7z^!X%~KV*q*{Z
zD<8{<7JF<m8Mk^qdLo7p)3dc;oA2(X&g>TUda6!pl=ne$b6m8}?z1=ZQ{b69%ocp{
zpZ-`~oKwiE$F0&ai)szlznJT>|2<Prqv(68S6h@j_0GJO{x(PLo)RY#=C4^zdp#qo
zE1+0&_=zH_-IqMe5DeRKU+O?~XZ*0`XsxR;ae_X6TVh3#?l_TrxH#k1K=p(bDa*JZ
zQP#@eOh(2eD{nUObP^WJ!<`+)@;1Oa<nVLm2?#98)eXg}*5mKVTxmZ++J>q+74fXH
z&h6MT<Ji_<%HB82V%@-^P8lk{pKE$i8{{J`iyBR25&jPl2(%tbiqzY?oZcm@FHf4{
zPMl2rYEd5~E2DiRb7X(1+DpBKs8GM~nS~w+af`LUiY|=yq4K#zQCo7!@q2ZlD3#_&
zI!d7v1yvyrUTYdLY3>Uy+Zi73#7I@VxnM)W@ea)P{W#Li=xa8zRm&-}eo1$nzcmOh
z64Apc5nc^#rk88x_7|!5l<P4ofAdT^wVOWOtPyAXZbMh?C>m=RNn3i^Kk&qz5g@si
zt~&oLzhFTycr>tdc*;KiX5G0}kuBZ&jmFoz%)Babo3i8Z`-a%Y6B{4Zh6x%X<X!mc
zE_I74X=OR#RbL#j<GoBk<0qaDyYisCt?<g${xg0~rxg{`^eSFTEV(3Q@v(CNE|YNQ
zAldp=>Bd36^|HwDrL+Fm7xU)#kEToN1Vc9td=!0SnBbHU`+Mz|?;5VXD5D&wjf_=Z
zH#-&I`s$grbVzO<qs>VE;J8?qfio4!@qQ1Jh*?>YCMf(>L#f3NVMl{FE{PS9Lox4)
z+%BDPu0b~=alLoHM1&}MO;l~^0$t~@Hr8J;mxpPw4ZUdC{?F^cbB)Qhlb17N_Si-$
z1i9Rh=M{tG&W!%0qPKm2@I&uaUfs?)FB$zMapXKBU@g-R%iv#8Vx4c{I~0tX)|x^U
qF2Txisw<qycIkgu;^RqO^l2l^y}uZL&Tcav!#ftpxnbpv7X1sJ6ikBv

diff --git a/agents/meshcmd.js b/agents/meshcmd.js
index 32930efb..58fe48f2 100644
--- a/agents/meshcmd.js
+++ b/agents/meshcmd.js
@@ -2034,7 +2034,13 @@ function OnServerWebSocket(msg, s, head) {
                         } else {
                             console.log("Login token required, use --token [token].");
                         }
-                    } else { console.log("Invalid username or password."); }
+                    } else if (command.msg == 'badtlscert') {
+                        console.log("Invalid TLS certificate detected.");
+                    } else if (command.msg == 'badargs') {
+                        console.log("Invalid protocol arguments.");
+                    } else {
+                        console.log("Invalid username/password.");
+                    }
                 } else { console.log("Server disconnected: " + command.msg); }
                 process.exit(1);
                 return;
diff --git a/webserver.js b/webserver.js
index 17881d8b..6798d005 100644
--- a/webserver.js
+++ b/webserver.js
@@ -6048,12 +6048,20 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
 
             switch (command.action) {
                 case 'serverAuth': { // This command is used to perform server "inner" authentication.
-                    if (obj.common.validateString(command.cnonce, 1, 256) == false) break; // Check the client nonce
-                    if (obj.common.validateString(command.tlshash, 1, 512) == false) break; // Check the TLS hash
+                    // Check the client nonce and TLS hash
+                    if ((obj.common.validateString(command.cnonce, 1, 256) == false) || (obj.common.validateString(command.tlshash, 1, 512) == false)) {
+                        try { ws.send(JSON.stringify({ action: 'close', cause: 'noauth', msg: 'badargs' })); } catch (ex) { }
+                        try { ws.close(); } catch (ex) { }
+                        break; 
+                    }
 
                     // Check that the TLS hash is an acceptable one.
                     var h = Buffer.from(command.tlshash, 'hex').toString('binary');
-                    if ((obj.webCertificateHashs[domain.id] != h) && (obj.webCertificateFullHashs[domain.id] != h) && (obj.defaultWebCertificateHash != h) && (obj.defaultWebCertificateFullHash != h)) { try { ws.close(); } catch (ex) { } return; }
+                    if ((obj.webCertificateHashs[domain.id] != h) && (obj.webCertificateFullHashs[domain.id] != h) && (obj.defaultWebCertificateHash != h) && (obj.defaultWebCertificateFullHash != h)) {
+                        try { ws.send(JSON.stringify({ action: 'close', cause: 'noauth', msg: 'badtlscert' })); } catch (ex) { }
+                        try { ws.close(); } catch (ex) { }
+                        return;
+                    }
 
                     // TLS hash check is a success, sign the request.
                     // Perform the hash signature using the server agent certificate
@@ -6069,89 +6077,94 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
                     // Check username and password authentication
                     if ((typeof command.username == 'string') && (typeof command.password == 'string')) {
                         obj.authenticate(Buffer.from(command.username, 'base64').toString(), Buffer.from(command.password, 'base64').toString(), domain, function (err, userid, passhint, loginOptions) {
-                            var user = obj.users[userid];
-                            if ((err == null) && (user)) {
-                                // Check if a 2nd factor is needed
-                                var emailcheck = ((domain.mailserver != null) && (obj.parent.certificates.CommonName != null) && (obj.parent.certificates.CommonName.indexOf('.') != -1) && (obj.args.lanonly != true) && (domain.auth != 'sspi') && (domain.auth != 'ldap'))
+                            if ((err != null) || (userid == null)) {
+                                // Invalid authentication
+                                try { ws.send(JSON.stringify({ action: 'close', cause: 'noauth', msg: 'noauth-2c' })); } catch (ex) { }
+                                try { ws.close(); } catch (ex) { }
+                            } else {
+                                var user = obj.users[userid];
+                                if ((err == null) && (user)) {
+                                    // Check if a 2nd factor is needed
+                                    var emailcheck = ((domain.mailserver != null) && (obj.parent.certificates.CommonName != null) && (obj.parent.certificates.CommonName.indexOf('.') != -1) && (obj.args.lanonly != true) && (domain.auth != 'sspi') && (domain.auth != 'ldap'))
 
-                                // See if we support two-factor trusted cookies
-                                var twoFactorCookieDays = 30;
-                                if (typeof domain.twofactorcookiedurationdays == 'number') { twoFactorCookieDays = domain.twofactorcookiedurationdays; }
+                                    // See if we support two-factor trusted cookies
+                                    var twoFactorCookieDays = 30;
+                                    if (typeof domain.twofactorcookiedurationdays == 'number') { twoFactorCookieDays = domain.twofactorcookiedurationdays; }
 
-                                if (checkUserOneTimePasswordRequired(domain, user, req, loginOptions) == true) {
-                                    // Figure out if email 2FA is allowed
-                                    var email2fa = (((typeof domain.passwordrequirements != 'object') || (domain.passwordrequirements.email2factor != false)) && (domain.mailserver != null) && (user.otpekey != null));
-                                    var sms2fa = (((typeof domain.passwordrequirements != 'object') || (domain.passwordrequirements.sms2factor != false)) && (parent.smsserver != null) && (user.phone != null));
-                                    //var push2fa = ((parent.firebase != null) && (user.otpdev != null));
-                                    if ((typeof command.token != 'string') || (command.token == '**email**') || (command.token == '**sms**')/* || (command.token == '**push**')*/) {
-                                        if ((command.token == '**email**') && (email2fa == true)) {
-                                            // Cause a token to be sent to the user's registered email
-                                            user.otpekey = { k: obj.common.zeroPad(getRandomEightDigitInteger(), 8), d: Date.now() };
-                                            obj.db.SetUser(user);
-                                            parent.debug('web', 'Sending 2FA email to: ' + user.email);
-                                            domain.mailserver.sendAccountLoginMail(domain, user.email, user.otpekey.k, obj.getLanguageCodes(req), req.query.key);
-                                            // Ask for a login token & confirm email was sent
-                                            try { ws.send(JSON.stringify({ action: 'close', cause: 'noauth', msg: 'tokenrequired', email2fa: email2fa, sms2fa: sms2fa, email2fasent: true, twoFactorCookieDays: twoFactorCookieDays })); ws.close(); } catch (e) { }
-                                        } else if ((command.token == '**sms**') && (sms2fa == true)) {
-                                            // Cause a token to be sent to the user's phone number
-                                            user.otpsms = { k: obj.common.zeroPad(getRandomSixDigitInteger(), 6), d: Date.now() };
-                                            obj.db.SetUser(user);
-                                            parent.debug('web', 'Sending 2FA SMS to: ' + user.phone);
-                                            parent.smsserver.sendToken(domain, user.phone, user.otpsms.k, obj.getLanguageCodes(req));
-                                            // Ask for a login token & confirm sms was sent
-                                            try { ws.send(JSON.stringify({ action: 'close', cause: 'noauth', msg: 'tokenrequired', email2fa: email2fa, sms2fa: sms2fa, sms2fasent: true, twoFactorCookieDays: twoFactorCookieDays })); ws.close(); } catch (e) { }
-                                            /*
-                                        } else if ((command.token == '**push**') && (push2fa == true)) {
-                                            // Cause push notification to device
-                                            const code = Buffer.from(obj.common.zeroPad(getRandomSixDigitInteger(), 6)).toString('base64');
-                                            const authCookie = parent.encodeCookie({ a: 'checkAuth', c: code, u: user._id, n: user.otpdev });
-                                            var payload = { notification: { title: "MeshCentral", body: user.name + " authentication" }, data: { url: '2fa://auth?code=' + code + '&c=' + authCookie } };
-                                            var options = { priority: 'High', timeToLive: 60 }; // TTL: 1 minute
-                                            parent.firebase.sendToDevice(user.otpdev, payload, options, function (id, err, errdesc) {
-                                                if (err == null) { parent.debug('email', 'Successfully auth check send push message to device'); } else { parent.debug('email', 'Failed auth check push message to device, error: ' + errdesc); }
-                                            });
-                                            */
-                                        } else {
-                                            // Ask for a login token
-                                            parent.debug('web', 'Asking for login token');
-                                            try { ws.send(JSON.stringify({ action: 'close', cause: 'noauth', msg: 'tokenrequired', email2fa: email2fa, sms2fa: sms2fa, twoFactorCookieDays: twoFactorCookieDays })); ws.close(); } catch (ex) { console.log(ex); }
-                                        }
-                                    } else {
-                                        checkUserOneTimePassword(req, domain, user, command.token, null, function (result) {
-                                            if (result == false) {
-                                                // Failed, ask for a login token again
-                                                parent.debug('web', 'Invalid login token, asking again');
-                                                try { ws.send(JSON.stringify({ action: 'close', cause: 'noauth', msg: 'tokenrequired', email2fa: email2fa, sms2fa: sms2fa, twoFactorCookieDays: twoFactorCookieDays })); ws.close(); } catch (e) { }
-                                            } else {
-                                                // We are authenticated with 2nd factor.
-                                                // Check email verification
-                                                if (emailcheck && (user.email != null) && (user.emailVerified !== true)) {
-                                                    parent.debug('web', 'Invalid login, asking for email validation');
-                                                    try { ws.send(JSON.stringify({ action: 'close', cause: 'emailvalidation', msg: 'emailvalidationrequired', email2fa: email2fa, sms2fa: sms2fa, email2fasent: true })); ws.close(); } catch (e) { }
-                                                } else {
-                                                    // We are authenticated
-                                                    ws._socket.pause();
-                                                    ws.removeAllListeners(['message', 'close', 'error']);
-                                                    func(ws, req, domain, user);
-                                                }
-                                            }
-                                        });
-                                    }
-                                } else {
-                                    // Check email verification
-                                    if (emailcheck && (user.email != null) && (user.emailVerified !== true)) {
-                                        parent.debug('web', 'Invalid login, asking for email validation');
+                                    if (checkUserOneTimePasswordRequired(domain, user, req, loginOptions) == true) {
+                                        // Figure out if email 2FA is allowed
                                         var email2fa = (((typeof domain.passwordrequirements != 'object') || (domain.passwordrequirements.email2factor != false)) && (domain.mailserver != null) && (user.otpekey != null));
                                         var sms2fa = (((typeof domain.passwordrequirements != 'object') || (domain.passwordrequirements.sms2factor != false)) && (parent.smsserver != null) && (user.phone != null));
-                                        try { ws.send(JSON.stringify({ action: 'close', cause: 'emailvalidation', msg: 'emailvalidationrequired', email2fa: email2fa, sms2fa: sms2fa, email2fasent: true })); ws.close(); } catch (e) { }
+                                        //var push2fa = ((parent.firebase != null) && (user.otpdev != null));
+                                        if ((typeof command.token != 'string') || (command.token == '**email**') || (command.token == '**sms**')/* || (command.token == '**push**')*/) {
+                                            if ((command.token == '**email**') && (email2fa == true)) {
+                                                // Cause a token to be sent to the user's registered email
+                                                user.otpekey = { k: obj.common.zeroPad(getRandomEightDigitInteger(), 8), d: Date.now() };
+                                                obj.db.SetUser(user);
+                                                parent.debug('web', 'Sending 2FA email to: ' + user.email);
+                                                domain.mailserver.sendAccountLoginMail(domain, user.email, user.otpekey.k, obj.getLanguageCodes(req), req.query.key);
+                                                // Ask for a login token & confirm email was sent
+                                                try { ws.send(JSON.stringify({ action: 'close', cause: 'noauth', msg: 'tokenrequired', email2fa: email2fa, sms2fa: sms2fa, email2fasent: true, twoFactorCookieDays: twoFactorCookieDays })); ws.close(); } catch (e) { }
+                                            } else if ((command.token == '**sms**') && (sms2fa == true)) {
+                                                // Cause a token to be sent to the user's phone number
+                                                user.otpsms = { k: obj.common.zeroPad(getRandomSixDigitInteger(), 6), d: Date.now() };
+                                                obj.db.SetUser(user);
+                                                parent.debug('web', 'Sending 2FA SMS to: ' + user.phone);
+                                                parent.smsserver.sendToken(domain, user.phone, user.otpsms.k, obj.getLanguageCodes(req));
+                                                // Ask for a login token & confirm sms was sent
+                                                try { ws.send(JSON.stringify({ action: 'close', cause: 'noauth', msg: 'tokenrequired', email2fa: email2fa, sms2fa: sms2fa, sms2fasent: true, twoFactorCookieDays: twoFactorCookieDays })); ws.close(); } catch (e) { }
+                                                /*
+                                            } else if ((command.token == '**push**') && (push2fa == true)) {
+                                                // Cause push notification to device
+                                                const code = Buffer.from(obj.common.zeroPad(getRandomSixDigitInteger(), 6)).toString('base64');
+                                                const authCookie = parent.encodeCookie({ a: 'checkAuth', c: code, u: user._id, n: user.otpdev });
+                                                var payload = { notification: { title: "MeshCentral", body: user.name + " authentication" }, data: { url: '2fa://auth?code=' + code + '&c=' + authCookie } };
+                                                var options = { priority: 'High', timeToLive: 60 }; // TTL: 1 minute
+                                                parent.firebase.sendToDevice(user.otpdev, payload, options, function (id, err, errdesc) {
+                                                    if (err == null) { parent.debug('email', 'Successfully auth check send push message to device'); } else { parent.debug('email', 'Failed auth check push message to device, error: ' + errdesc); }
+                                                });
+                                                */
+                                            } else {
+                                                // Ask for a login token
+                                                parent.debug('web', 'Asking for login token');
+                                                try { ws.send(JSON.stringify({ action: 'close', cause: 'noauth', msg: 'tokenrequired', email2fa: email2fa, sms2fa: sms2fa, twoFactorCookieDays: twoFactorCookieDays })); ws.close(); } catch (ex) { console.log(ex); }
+                                            }
+                                        } else {
+                                            checkUserOneTimePassword(req, domain, user, command.token, null, function (result) {
+                                                if (result == false) {
+                                                    // Failed, ask for a login token again
+                                                    parent.debug('web', 'Invalid login token, asking again');
+                                                    try { ws.send(JSON.stringify({ action: 'close', cause: 'noauth', msg: 'tokenrequired', email2fa: email2fa, sms2fa: sms2fa, twoFactorCookieDays: twoFactorCookieDays })); ws.close(); } catch (e) { }
+                                                } else {
+                                                    // We are authenticated with 2nd factor.
+                                                    // Check email verification
+                                                    if (emailcheck && (user.email != null) && (user.emailVerified !== true)) {
+                                                        parent.debug('web', 'Invalid login, asking for email validation');
+                                                        try { ws.send(JSON.stringify({ action: 'close', cause: 'emailvalidation', msg: 'emailvalidationrequired', email2fa: email2fa, sms2fa: sms2fa, email2fasent: true })); ws.close(); } catch (e) { }
+                                                    } else {
+                                                        // We are authenticated
+                                                        ws._socket.pause();
+                                                        ws.removeAllListeners(['message', 'close', 'error']);
+                                                        func(ws, req, domain, user);
+                                                    }
+                                                }
+                                            });
+                                        }
                                     } else {
-                                        // We are authenticated
-                                        ws._socket.pause();
-                                        ws.removeAllListeners(['message', 'close', 'error']);
-                                        func(ws, req, domain, user);
+                                        // Check email verification
+                                        if (emailcheck && (user.email != null) && (user.emailVerified !== true)) {
+                                            parent.debug('web', 'Invalid login, asking for email validation');
+                                            var email2fa = (((typeof domain.passwordrequirements != 'object') || (domain.passwordrequirements.email2factor != false)) && (domain.mailserver != null) && (user.otpekey != null));
+                                            var sms2fa = (((typeof domain.passwordrequirements != 'object') || (domain.passwordrequirements.sms2factor != false)) && (parent.smsserver != null) && (user.phone != null));
+                                            try { ws.send(JSON.stringify({ action: 'close', cause: 'emailvalidation', msg: 'emailvalidationrequired', email2fa: email2fa, sms2fa: sms2fa, email2fasent: true })); ws.close(); } catch (e) { }
+                                        } else {
+                                            // We are authenticated
+                                            ws._socket.pause();
+                                            ws.removeAllListeners(['message', 'close', 'error']);
+                                            func(ws, req, domain, user);
+                                        }
                                     }
                                 }
-
                             }
                         });
                     } else {