Yellow-Bike-Database-Mirror/examples/secure-terminals.txt

How to protect the password for YBDB in a public environment.

PROTECTING A DIRECTORY UNDER A WEBSERVER (apache 2.4)

A. The htpasswd command is found in the apache2-utils package.

B. htpasswd  -Bc -C 10 htpasswd test  (note that bcrypt is used)

C.  chown www-data:www-data /var/htpasswd; chmod 0400 /var/htpasswd; \

D.   <Directory /var/www/html>
            Authtype        Basic
            Authname        "Amazing Community Bike Shop Login"
            Require         user someuser
            AuthUserFile    /var/htpasswd
     </Directory>


SSL (do not settle for anything less)

Under Debian:
A.  openssl req -new -x509 -nodes -out ssl-cert-snakeoil.pem -days 36500 -keyout ssl-cert-snakeoil.key (100 year certificate)
B.  cp ssl-cert-snakeoil.key /etc/ssl/private/
    cp ssl-cert-snakeoil.pem /etc/ssl/certs/
C.  a2enmod ssl;
    a2ensite default-ssl.conf; (standard on debian-based distributions .. add <Directory> stanza above)
    a2dissite 000-default.conf; 
   

TERMINAL AUTOMATION AND SECURITY

Firefox (IceWeasel):
1. Download KeePass v2 zip - http://keepass.info/download.html
2. Unzip in ~/KeePass
3. sudo chown root:root ~/KeePass; sudo chmod 0755 ~/KeePass;
4. cd ~/KeePass; mkdir plugins
5. run .. mono KeePass.exe, create database and a key file in ~/KeePass
6. mv KeePass.config.xml KeePass.config.enforced.xml
7. sudo chown root:root KeePass.config.enforced.xml (and database/key file)
8. sudo chmod 0444 KeePass.config.enforced.xml
9.	Most importantly in KeePass.config.enforced.xml between <Security> change true to 
	<Policy><UnhidePasswords>false</UnhidePasswords></Policy> so that passwords cannot be seen.
10. In Debian/Ubuntu:  apt-get install mono-runtime mono-devel
11. Install KeeFox extension from https://addons.mozilla.org/en-us/firefox/addon/keefox/
12. KeeFox will tell you where to copy KeePassRPC.plgx from into the plugins directory
   Usually somewhere under  ~/.mozilla/firefox/*default/extensions/keefox*
13. When setting up password database for KeePass use only a key file.
14. Add the url along with username and password in the database.
15. Once the login is working properly for the htpasswd setup for apache, 
   the whole process can be completely automated in KeeFox options.
16. In Firefox (IceWeasel) Preferences -> General use "When IceWeasel starts: Show my windows and tabs from the last time"
17. Afterwards, you can sudo chown -R root:root ~/KeePass/*
	 You may need to make adjustments for plugins.

Chrome:
1. Download KeePass zip - http://keepass.info/download.html
2. Unzip in ~/KeePass
3. sudo chown root:root ~/KeePass; sudo chmod 0755 ~/KeePass;
4. run .. mono KeePass.exe, create database and a key file in ~/KeePass
5. mv KeePass.config.xml KeePass.config.enforced.xml
6. sudo chown root:root KeePass.config.enforced.xml (and database/key file)
7. sudo chmod 0444 KeePass.config.enforced.xml
8.	Most importantly in KeePass.config.enforced.xml between <Security> change true to 
	<Policy><UnhidePasswords>false</UnhidePasswords></Policy> so that passwords cannot be seen.
9. When setting up password database for KeePass use only a key file.
10. Add the url along with username and password in the database.
11. In Debian/Ubuntu:  apt-get install mono-runtime mono-devel
12. Install extension chromeIPass
13. Install keepasshttp as explained at https://github.com/pfn/keepasshttp/ (put KeePassHttp.plgx in ~/KeePass)
14. Follow the directions chromeIPass gives you, creating an identifier
15. Good idea to restart chrome.
16. In Chrome Settings "On Startup Continue where you left off"
17. Afterwards, you can sudo chown -R root:root ~/KeePass/*
	 You may need to make adjustments for plugins.


DESKTOP STARTUP

1.  LXDE - put a file with this format in ~/.config/auto with name of *desktop, e.g. keepass.desktop:

[Desktop Entry]
Type=Application
Exec=/usr/bin/mono /home/ps/KeePass/KeePass.exe

2.  Gnome based Window manager, e.g. Mate - open gnome-session-properties from commandline, 
	 and add startup application.

SUSPENDING COMPUTER

Example commands that bring up the gui setting tool:
1. xfce4-power-manager-settings (eg., used by wattos for LXDE)
2. mate-power-manager-settings or mate-power-preferences

SUMMARY

There are other things that can be done within the terminal to prevent tampering, e.g., read-only environment, 
an expect or curl script, etc. rather than KeePass, but what is above protects the password from hacking, eavesdropping, 
and from regular users in the shop, basically, only the sysadmin and bookkeeper should have remote access via the password. 
So while YBDB is on the internet, it will only be available to the terminal(s) you allow it to be on, and
the Point of Sale will be at the proper location which is usually the front of the Community Bike Shop where people
walk-in/walk-out.

Word of wisdom:  It is always good practice to occasionally change the password.