Comments (12)
I support/want it.
from rpi-monitor.
Currently there is not server side scripting involved in web interface. It is just javascript. I don't think this is doable just with JavaScript. We may want to use python at least. And it should be lightweight. Since python is built-in package it would be easy.
from rpi-monitor.
I'm using lighttpd server on my Raspberry Pi. Unfortunately, failed to set the RPi-Monitor's protection.
from rpi-monitor.
Currently I haven't exposed that to public network. I just use SSH tunneling to access it.
from rpi-monitor.
The purpose of RPi-Monitor is to... monitor. I did decided to not add any authentication for different reason (security, time...).
But, if somebody want to add such a feature to RPi-Monitor, why not. If the code is well written, will merge such a pull request.
In my opinion, the authentication that could be integrated to RPi-Monitor should not have the aim to be as secure as Fort Knox but should be here to not expose to the public the data managed by RPi-Monitor (which could be private). Remind that RPi-Monitor is not using HTTPS.
This authentication should be optionnal and activable by configuration (to keep the existing behaviour of RPi-Monitor.)
If I had to develop such a feature (you understood that, for the moment, I'll not), I would do like this:
- If a unauthenticated request is coming from a client, the server will send an authentication page.
- When authentication is submited, RPI-Monitor will check the login credential and send a token (randomly generated).
- The client will add this token to every request (token should be stored into LocalStorage in client side).
- If the token is wrong or is missing, user in not authenticated, RPi-Monitor will send the login page.
- The token will be removed from RPi-Monitor memory "n" secondes after last request (n will be configurable).
To implement such a feature, it will be required to update rpimonitord to read the login and password (stored encrypted), generate the token and manage the token validity.
It will be required to modify the javascripts links to add the token value as a parameter the each request.
What is your opinion about the proposed algorithm? Do you have feedback about this algorithm?
Is there a volunteer to develop such a feature?
(If yes, I'll create a branch dedicated to this feature which will be use during the development)
from rpi-monitor.
I'll start developing this feature.
Do you have any suggestion on technologies?
from rpi-monitor.
Nice news :-)
For an easy integration, you should continue to use the technologies I used until now.
Perl for RPi-Monitor. There is a classe Server managing the request from web server. The function do_Get should be updated. The object Configuration is designed to read data from configuration files into hashtable, rpimonitord -s will show how to configuration file are loaded.
A dedicated page should be created in HTML, you will notice that I used bootstrap and jquery.
For the request sent from the client, it could be a little bit more tricky, I'll let you propose some solutions.
If you have question about the design of RPi-Monitor, feel free to ask...
from rpi-monitor.
I did create a branch devel-auth. I'll ask you to use this branch for development. When we will have a working version of this feature, I'll merge it in main branch.
This branch is desgined for development so don't hesitate to do pull requests on it I'll merge them immediatly. I'll also merge my update to let you have an up to date version of code.
from rpi-monitor.
Thank you! I'll start developing.
from rpi-monitor.
How is this one going? Just asking.
If there's auth, one could use stunnel and be happy/secure without having to configure a reverse proxy.
Other programs have login only (like transmission-daemon), and the easy way to secure them is to enable auth and have the daemon listen on localhost only, then stunnel it. and stunnel is really easy to set.
from rpi-monitor.
there will be many scripts or webmin addons available to put authentication on a particular port 8888. Need to search for that
from rpi-monitor.
A solution exists with nginx
configuration explained here : http://rpi-experiences.blogspot.fr/2013/05/rpi-monitor-security-and-authentication.html
from rpi-monitor.
Related Issues (20)
- "undefined" entries in the Graph topic drop down box HOT 4
- Storage template does not work for 4TB SSD HOT 3
- Feature Request if it does not already exist - line continuation for .conf files
- I host my website with apache2 and want rpi monitor on subdomain
- 'http://giteduberger.fr rpimonitor/ Release' no longer has a Release file HOT 3
- question about config HOT 1
- Service Status via Labels and Bages, not being updated when service is brought down HOT 3
- 'Warning: unable to close filehandle FEED properly.' message repeats in log.
- Err:5 http://www.giteduberger.fr rpimonitor/ InRelease HOT 4
- Updating time Website HOT 1
- Suggestion: optimize .png images
- Perl issue appear in the log HOT 2
- unable to update RPi-Monitor to version 2.13 HOT 4
- RPi with HAT HOT 1
- RRD file is corrupt
- Services.conf issue. Netstat command not available running in docker container
- Date/Time in statistic charts are incorrect HOT 1
- Key is stored in legacy trusted.gpg keyring HOT 1
- Top3 addon not showing anything.
- Unable to correct problems, you have held broken packages. HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from rpi-monitor.