You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
139 lines
6.5 KiB
139 lines
6.5 KiB
How to protect the password for YBDB in a public environment.
|
|
|
|
PROTECTING A DIRECTORY UNDER A WEBSERVER (apache 2.4)
|
|
|
|
A. The htpasswd command is found in the apache2-utils package.
|
|
|
|
B. htpasswd -Bc -C 10 htpasswd test (note that bcrypt is used)
|
|
|
|
C. chown www-data:www-data /var/htpasswd; chmod 0400 /var/htpasswd; \
|
|
|
|
D. <Directory /var/www/html>
|
|
Authtype Basic
|
|
Authname "Amazing Community Bike Shop Login"
|
|
Require user someuser
|
|
AuthUserFile /var/htpasswd
|
|
</Directory>
|
|
|
|
SSL (do not settle for anything less)
|
|
|
|
Under Debian:
|
|
A. openssl req -new -x509 -nodes -out ssl-cert-snakeoil.pem -days 36500 -keyout ssl-cert-snakeoil.key (100 year certificate)
|
|
B. cp ssl-cert-snakeoil.key /etc/ssl/private/
|
|
cp ssl-cert-snakeoil.pem /etc/ssl/certs/
|
|
C. a2enmod ssl;
|
|
a2ensite default-ssl.conf; (standard on debian-based distributions .. add <Directory> stanza above)
|
|
a2dissite 000-default.conf;
|
|
|
|
An alternative would be to use letsencrypt. If you are using a reverse proxy, usually nginx-proxy,
|
|
make certain that HTTP_X_FORWARDED_FOR is used for identifying the originating IP address,
|
|
because YBDB shops keep track of their unique ip.
|
|
|
|
TERMINAL AUTOMATION AND SECURITY
|
|
|
|
Firefox (IceWeasel):
|
|
1. Download KeePass v2 zip - http://keepass.info/download.html
|
|
2. Unzip in ~/KeePass
|
|
3. sudo chown root:root ~/KeePass; sudo chmod 0755 ~/KeePass;
|
|
4. cd ~/KeePass; mkdir plugins
|
|
5. run .. mono KeePass.exe, create database and a key file in ~/KeePass
|
|
6. mv KeePass.config.xml KeePass.config.enforced.xml
|
|
7. sudo chown root:root KeePass.config.enforced.xml (and database/key file)
|
|
8. sudo chmod 0444 KeePass.config.enforced.xml
|
|
9. Most importantly in KeePass.config.enforced.xml between <Security> change true to
|
|
<Policy><UnhidePasswords>false</UnhidePasswords></Policy> so that passwords cannot be seen.
|
|
10. In Debian/Ubuntu: apt-get install mono-runtime mono-devel
|
|
11. Install KeeFox extension from https://addons.mozilla.org/en-us/firefox/addon/keefox/
|
|
12. KeeFox will tell you where to copy KeePassRPC.plgx from into the plugins directory
|
|
Usually somewhere under ~/.mozilla/firefox/*default/extensions/keefox*
|
|
13. When setting up password database for KeePass use only a key file.
|
|
14. Add the url along with username and password in the database.
|
|
15. Once the login is working properly for the htpasswd setup for apache,
|
|
the whole process can be completely automated in KeeFox options.
|
|
16. In Firefox (IceWeasel) Preferences -> General use "When IceWeasel starts: Show my windows and tabs from the last time"
|
|
17. Afterwards, you can sudo chown -R root:root ~/KeePass/*
|
|
sudo chmod 0400 ~/KeePass/*
|
|
You may need to make adjustments for plugins.
|
|
Then run with sudo, see "Chrome (visudo)" to learn how to do this.
|
|
|
|
Chrome:
|
|
1. Install keepass2: sudo apt-get install keepass2
|
|
2. cd /usr/lib/keepass2; \
|
|
sudo mv KeePass.config.xml KeePass.config.enforced.xml
|
|
|
|
edit file and add between <Configuration></Configuration>
|
|
|
|
<Security>
|
|
<Policy><UnhidePasswords>false</UnhidePasswords></Policy>
|
|
</Security>
|
|
|
|
sudo chmod 0400 KeePass.config.enforced.xml
|
|
|
|
[doc: https://keepass.info/help/base/configuration.htm]
|
|
|
|
3. Install libsecret-tools: sudo apt-get install libsecret-tools
|
|
secret-tool store --label="PositiveSpin" keepass pos (remember password)
|
|
|
|
4. run keepass2;
|
|
create new password database in ~/keepass
|
|
assign password created with secret-tool to Master password
|
|
create key file in ~/keepass
|
|
In the password datatase, add the url for YBDB, username and password (created with htpasswd)
|
|
close keepass2
|
|
sudo chown -R root:root ~/keepass
|
|
sudo chmod -R 0400 ~/keepass (change to 0600 if you want to change password, then back to 0400 when done)
|
|
|
|
5. Install chrome extension chromeIPass
|
|
|
|
6. Install keepasshttp from https://github.com/pfn/keepasshttp/ by putting KeePassHttp.plgx in /usr/lib/keepass2;
|
|
sudo chmod 0644 /usr/lib/keepass2/KeePassHttp.plgx
|
|
sudo apt-get install libmono-system-xml-linq4.0-cil libmono-system-data-datasetextensions4.0-cil \
|
|
libmono-system-runtime-serialization4.0-cil mono-mcs
|
|
|
|
7. Follow the directions chromeIPass gives you, creating an identifier
|
|
https://github.com/pfn/passifox/blob/master/documentation/chromeIPass.md goes into more detail
|
|
|
|
8. sudo su; visudo
|
|
after: %sudo ALL=(ALL:ALL) ALL
|
|
add: pos ALL=(ALL) NOPASSWD: /usr/bin/keepass2 (note pos is an example user account being used for X11)
|
|
|
|
9. In Chrome Settings "On Startup Continue where you left off" or
|
|
"Open a specific page or set of pages" and add the YBDB POS url as one of those specific pages
|
|
|
|
10. Add to desktop startup (see below). Test changes by logging out, and logging back into the WM.
|
|
|
|
DESKTOP STARTUP
|
|
|
|
1. LXDE - put a file with this format in ~/.config/autostart with name of *desktop, e.g. keepass.desktop:
|
|
|
|
[Desktop Entry]
|
|
Type=Application
|
|
Exec=bash -c "secret-tool lookup keepass pos | sudo keepass2 /home/pos/keepass/PositiveSpin.kdbx -pw-stdin -keyfile:/home/pos/keepass/PositiveSpin.key
|
|
|
|
2. Gnome based Window manager, e.g. Mate - open gnome-session-properties from commandline,
|
|
and add startup application.
|
|
|
|
SPECIAL NOTES
|
|
|
|
With the combination of keepass2 and httpasswd, it is possible to fine tune access. For instance, there could be a
|
|
sign-in computer allowing access only to shop_log.php, shop_welcome.php, contact_add_edit_select.php, and
|
|
contact_add_edit.php, and another computer for volunteer staff allowing access to almost everything,
|
|
including transaction_log.php, perhaps with the exclusion of certain reports that should only be available
|
|
to the volunteer coordinator.
|
|
|
|
SUSPENDING COMPUTER
|
|
|
|
Example commands that bring up the gui setting tool:
|
|
1. xfce4-power-manager-settings (eg., used by wattos for LXDE)
|
|
2. mate-power-manager-settings or mate-power-preferences
|
|
|
|
SUMMARY
|
|
|
|
There are other things that can be done within the terminal to prevent tampering, e.g., read-only environment,
|
|
an expect or curl script, etc. rather than KeePass, but what is above protects the password from hacking, eavesdropping,
|
|
and from regular users in the shop, basically, only the sysadmin and bookkeeper should have remote access via the password.
|
|
So while YBDB is on the internet, it will only be available to the terminal(s) you allow it to be on, and
|
|
the Point of Sale will be at the proper location which is usually the front of the Community Bike Shop where people
|
|
walk-in/walk-out.
|
|
|
|
Word of wisdom: It is always good practice to occasionally change the password.
|
|
|