View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0001559 | unreal | ircd | public | 2004-02-18 14:14 | 2004-02-18 21:30 |
| Reporter | P | Assigned To | |||
| Priority | normal | Severity | feature | Reproducibility | N/A |
| Status | closed | Resolution | open | ||
| Summary | 0001559: Secure Remote Include | ||||
| Description | The comments for my initial preposal were "too hard to make", so here's an easier version to make. Instead of limiting which commands can remote include have, let's be sure it comes from the right person, I'd prepose a special password line in the begining of the remotely included file which has to match a password directive in the include (or secure-include) block. | ||||
| Additional Information | would any of the admins mind dropping the PHANTOm user? i want my nick back already :) | ||||
| 3rd party modules | |||||
|
|
Why not just use user:pass authorisation in urls? And if you can, use https! But it's a bit a pain to get it working with curl due to self-signed certificates ;). But if you get it working you got both encryption and secure authentication... unles... the box with the confs is hacked ;). |
|
|
That's the second layer of protection, the idia is to use that with my thingy. If I connect to a remote host i want to be sure it can be trusted, if _I_ give it a username and a password and don't expect any type of verification back from it I can't be sure I should trust the output. |
|
|
well... if you don't trust the remote host then putting a password in the configfile doesn't help either, if it's hacked then a hacker just looks at the pass etc... And if you think you might be talking to the wrong host somehow (hijacked or whatever), then again.. there's SSL for that.. if your certificates are correct and you validate them (default, that's why selfsigned certs fail on https) you can be sure who the "remote end" is. |
|
|
my point is there should be an easier (and cheaper i guess) way to verify the remote end |
|
|
perhaps, but this method is stupid :P. I've been thinking about stuff before, stuff like PGP (gpg) etc.. that's prolly the most secure way to do it but it requires an external program (afaik) and is not low-effort either... so not what you are looking for... on a sidenote, wasn't seriously considering that in the near feature |
|
|
As sysop said, what you described is _exactly_ why SSL (HTTPS and FTPS) was developed. I don't see 1.) Why SSL is hard, 2.) Why SSL isn't cheap. Libcurl lets you specify which CA's you trust (there is a directory under the /home/yourname/curl that holds the root certs). So you can, for example, add that you trust www.cacert.org and then you can get a free certificate. Also, the methods you propose do not introduce any real "trust" system, SSL does. Therefore I don't think we should introduce a false trust system as all that does is mislead people into thinking they are secure. |
|
|
that's a good point but ssl needs a server that will allow to install a specific cert and this is not commonly allowed. it's true what i suggested is not secure. do you think implementing blowfish for this would be hard? |
|
|
You're missing the point... We already provide the feature you seek! Even if implementing Blowfish encryption would take 2 minutes, it is still a waste to implement our own HTTP encryption protocol when one that is standardized and has been tested over the years already exists! |
|
|
We are really not planning to put all kinds of weird stuff in Unreal like this. |
|
|
right ;). |
|
|
alright alright, just stop flooding me with notice emails :) and yeah, unreal and rfc always went together...... :) |
|
|
it's not nice to loose eh ;). |
|
|
I will "close the stupid post"... |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2004-02-18 14:14 | P | New Issue | |
| 2004-02-18 14:18 | syzop | Note Added: 0005061 | |
| 2004-02-18 15:56 | P | Note Added: 0005063 | |
| 2004-02-18 16:07 | syzop | Note Added: 0005064 | |
| 2004-02-18 16:10 | P | Note Added: 0005065 | |
| 2004-02-18 16:21 | syzop | Note Added: 0005066 | |
| 2004-02-18 16:46 |
|
Note Added: 0005069 | |
| 2004-02-18 16:52 | P | Note Added: 0005070 | |
| 2004-02-18 17:02 |
|
Note Added: 0005072 | |
| 2004-02-18 17:04 | syzop | Note Added: 0005073 | |
| 2004-02-18 17:04 | syzop | Note Added: 0005074 | |
| 2004-02-18 17:06 | P | Note Added: 0005075 | |
| 2004-02-18 17:09 | syzop | Note Added: 0005077 | |
| 2004-02-18 21:30 | syzop | Status | new => closed |
| 2004-02-18 21:30 | syzop | Note Added: 0005082 |
