Re: lighttpd with empty password

Hi KP

Am 13.02.2018 um 18:10 schrieb KP Kirchdoerfer via leaf-devel:
> Hi Erich;
> On Di, 2018-02-13 at 13:31 +0000, Erich Titl wrote:
>> Hi
>>
>> Here a possible solution for the distribution of webconf with an
>> empty
>> passsword.
>>
>> leaftester# more .htpasswd
>> admin:2Dp46HA3ULDxA
>>
>> This password has been created using
>>
>> pwcrypt ""
>>
> 
> Been there done that, it doesn't work.

It does work, please state your observation.

> 
> The previous behaviour with mini_httpd was with an empty password it
> does not show anything unless you add a password after login as admin -
> it always pointed to passwd.cgi regradless what link you wanted to open
> in webconf.
> Though everyone able to connect was able to login and change the
> password and get acccess to the router.
> 
> This is in reality an illusion of security.

This is not an illusion of security, this is no security, but
this is the way you can login with lighttpd and admin without knowing a
password, as this is just the empty password.

- You _cannot_ login using lighttpd _and_ a missing .htpasswd right now.
- You _cannot_ login using lighttpd _and_ an empty password field in
.htpasswd right now.

So user access is broken, this method gives you a chance to login and
_change_ the password to your own discretion. You will not be able to do
that with the current empty password field.

> 
> With lighttpd a really empty password in .htpasswd does not allow any
> login.

Yes it does not, but with a encrypted empty password it does.

> 
> The approach above allows to login with an empty password, but as you
> have a password, even an empty one, you have full access. Worse than
> before - and no better than having an open router without any
> protection.

I don't get your idea. This enables the user to do _something_ just like
before. With the current setttings the user is left alone.

> 
> Commercial routers often uses a default password, like "1234" for a
> device I've installed recently in modem-mode before the LEAF router and
> you shall change it, but it works also without any changes. 
> 
> I think we can do better.

Commercial routers do exactly that and I agree it is bad. Now with
lighttpd being a bit more restrictive than mhttpd(s) when it comes to
.htpasswd we are in a small impasse.

> 
> We should get rid of any mimic to allow access from anywhere without a
> proper password choosen by the user.
Do it with a script when starting a newly installed LEAF, that is fine.
Do it with a post_install script in upgrade.

But what about users choosing to manually upgrade like Timothy?

> 
> So the "problems" seen with the change to lighttpd are a benefit in
> hindsight.

??????

> 
> I tend to go the way:
> 
> - no access to webconf without a real password as default

Choose one, then publish it like the commercial vendors :-) Nothing
really new and not secure at all.

> - it should be possible to change the web login password from the
> webpage

This is a hen-egg problem with lighttpd. If you find another solution
which is _secure_, welcome to the club.

> 
> 
> During first a fresh install of LEAF Bering-uClibc the user is asked to
> set a root password, we shall enhancethat to add this password for web
> login as well.

As already said, I have no clue how many users do a fresh install at
all. I guess it is a minority.

> 
> If a user chooses to go without any password, so it will be empty for
> console, ssh and webconf access - I'm not sorry for those who go that
> way.

Well....

Here is my idea of securing the system

- If someone gets near the console the system is compromised anyway. No
security.
- I do not allow ssh with passwords, only ssh keys.
- I only allow https access and that typically only from the local zone,
maybe even restrict it to single ip addresses.
- I _never_ allow web access without a password.

The problem with the current lighttpd config stems from the observation
that the current method does not work, neither an empty password field
nor a missing .htpasswd. So the router cannot be reached using the web
interface with the current settings. The proposed change allows access
with no security, just like your suggested interface would.

> 
> 
> In step 2 we should force to use https instead of http to access the
> router.

This is easy but requires a certificate. Do you want to provide one? Any
certificate is better than none.

cheers

ET

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot


_______________________________________________
leaf-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/leaf-devel