Re: [PATCH] force transport encryption for WebUI logins

[Michael Tremer <michael.tremer@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 5341 bytes --]

Hi,

On Sat, 2017-09-23 at 15:18 -0400, Tom Rymes wrote:
> That makes sense to me. One step at a time!
> 
> > On Sep 23, 2017, at 2:19 PM, Peter Müller <peter.mueller(a)link38.eu> wrote:
> > 
> > Hello Matthias,
> > 
> > your described scenario does not appear on my machine. :-(
> > 
> > However, the "Require ssl" directive seems not to work with the
> > 2.2.x branch, here, we still need the old "SSLRequireSSL". (On
> > the other hand, it was intended to be used with the new version.)
> > 
> > Which version are you running?
> > 
> > I think the best solution for now is to disregard this patch.
> > After the Core Update with 2.4.27 version was released, I'll
> > give it another try.

Well, the update for Apache 2.4 is in next right now.

If there is any doubt on whether SSL is always enforced or not we should
investigate as soon as possible. I don't think that we should wait too much
longer with the entire update any ways, but this certainly delays it.

Best,
-Michael

> > 
> > @All: Anybody against or in favor?
> > 
> > Best regards,
> > Peter Müller
> > 
> > > Hello Matthias,
> > > 
> > > tanks for reporting this. I am trying to reproduce here...
> > > 
> > > Best regards,
> > > Peter Müller
> > > 
> > > > Hi Peter,
> > > > 
> > > > Please review this patch... (http://patchwork.ipfire.org/patch/1413/)
> > > > 
> > > > During testing I found that every machine in my GREEN net was suddenly
> > > > able to login through https://[IPFIRE_GREEN_ADDRESS]:[444].
> > > > 
> > > > No question for admin-username, no password authentification request,
> > > > nothing.
> > > > 
> > > > It seems as as if the Authentication Header is missing(?).
> > > > 
> > > > Only when I remove the "Require ssl" lines (I did this in both files), a
> > > > browser restart leads to the usual login procedure.
> > > > 
> > > > Best,
> > > > Matthias
> > > > 
> > > > > On 08.09.2017 19:19, Peter Müller wrote:  
> > > > > Force SSL/TLS for any WebUI directory which requires an
> > > > > authentication.
> > > > > This prevents credentials from being transmitted in plaintext, which
> > > > > is
> > > > > an information leak.
> > > > > 
> > > > > Scenario: A MITM attacker might block all encrypted traffic to the
> > > > > firewall's web interface, making the administrator using an
> > > > > unencrypted
> > > > > connection (i.e. via port 81). Username and password can be easily
> > > > > logged in transit then.
> > > > > 
> > > > > Signed-off-by: Peter Müller <peter.mueller(a)link38.eu>
> > > > > ---
> > > > > diff --git a/config/httpd/vhosts.d/ipfire-interface-ssl.conf
> > > > > b/config/httpd/vhosts.d/ipfire-interface-ssl.conf
> > > > > index 6f353962e..5ceaa1f32 100644
> > > > > --- a/config/httpd/vhosts.d/ipfire-interface-ssl.conf
> > > > > +++ b/config/httpd/vhosts.d/ipfire-interface-ssl.conf
> > > > > @@ -24,6 +26,7 @@
> > > > >         AuthType Basic
> > > > >         AuthUserFile /var/ipfire/auth/users
> > > > >         Require user admin
> > > > > +        Require ssl
> > > > >     </DirectoryMatch>
> > > > >     ScriptAlias /cgi-bin/ /srv/web/ipfire/cgi-bin/
> > > > >     <Directory /srv/web/ipfire/cgi-bin>
> > > > > @@ -33,6 +36,7 @@
> > > > >         AuthType Basic
> > > > >         AuthUserFile /var/ipfire/auth/users
> > > > >         Require user admin
> > > > > +        Require ssl
> > > > >         <Files chpasswd.cgi>
> > > > >             Require all granted
> > > > >         </Files>
> > > > > @@ -50,6 +54,7 @@
> > > > >         AuthType Basic
> > > > >         AuthUserFile /var/ipfire/auth/users
> > > > >         Require user dial admin
> > > > > +        Require ssl
> > > > >     </Directory>
> > > > >     <Files ~ "\.(cgi|shtml?)$">
> > > > >    SSLOptions +StdEnvVars
> > > > > @@ -86,5 +91,6 @@
> > > > >         AuthType Basic
> > > > >         AuthUserFile /var/ipfire/auth/users
> > > > >         Require user admin
> > > > > +        Require ssl
> > > > >     </Directory>
> > > > > </VirtualHost>
> > > > > diff --git a/config/httpd/vhosts.d/ipfire-interface.conf
> > > > > b/config/httpd/vhosts.d/ipfire-interface.conf
> > > > > index 619f90fcc..58d1b54cd 100644
> > > > > --- a/config/httpd/vhosts.d/ipfire-interface.conf
> > > > > +++ b/config/httpd/vhosts.d/ipfire-interface.conf
> > > > > @@ -16,6 +16,7 @@
> > > > >         AuthType Basic
> > > > >         AuthUserFile /var/ipfire/auth/users
> > > > >         Require user admin
> > > > > +        Require ssl
> > > > >     </DirectoryMatch>
> > > > >     ScriptAlias /cgi-bin/ /srv/web/ipfire/cgi-bin/
> > > > >     <Directory /srv/web/ipfire/cgi-bin>
> > > > > @@ -25,6 +26,7 @@
> > > > >         AuthType Basic
> > > > >         AuthUserFile /var/ipfire/auth/users
> > > > >         Require user admin
> > > > > +        Require ssl
> > > > >          <Files chpasswd.cgi>
> > > > >             Require all granted
> > > > >         </Files>
> > > > > @@ -42,6 +44,7 @@
> > > > >         AuthType Basic
> > > > >         AuthUserFile /var/ipfire/auth/users
> > > > >         Require user dial admin
> > > > > +        Require ssl
> > > > >     </Directory>
> > > > >     Alias /updatecache/ /var/updatecache/
> > > > >    <Directory /var/updatecache>
> > > > > 
> > 
> > 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]