Re: lighttpd with empty password

Hi Erich;
On Di, 2018-02-13 at 13:31 +0000, Erich Titl wrote:
> Hi
> 
> Here a possible solution for the distribution of webconf with an
> empty
> passsword.
> 
> leaftester# more .htpasswd
> admin:2Dp46HA3ULDxA
> 
> This password has been created using
> 
> pwcrypt ""
> 

Been there done that, it doesn't work.

The previous behaviour with mini_httpd was with an empty password it
does not show anything unless you add a password after login as admin -
it always pointed to passwd.cgi regradless what link you wanted to open
in webconf.
Though everyone able to connect was able to login and change the
password and get acccess to the router.

This is in reality an illusion of security.

With lighttpd a really empty password in .htpasswd does not allow any
login.

The approach above allows to login with an empty password, but as you
have a password, even an empty one, you have full access. Worse than
before - and no better than having an open router without any
protection.

Commercial routers often uses a default password, like "1234" for a
device I've installed recently in modem-mode before the LEAF router and
you shall change it, but it works also without any changes. 

I think we can do better.

We should get rid of any mimic to allow access from anywhere without a
proper password choosen by the user.

So the "problems" seen with the change to lighttpd are a benefit in
hindsight.

I tend to go the way:

- no access to webconf without a real password as default
- it should be possible to change the web login password from the
webpage


During first a fresh install of LEAF Bering-uClibc the user is asked to
set a root password, we shall enhance that to add this password for web
login as well.

If a user chooses to go without any password, so it will be empty for
console, ssh and webconf access - I'm not sorry for those who go that
way.


In step 2 we should force to use https instead of http to access the
router.

kp



------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot