55 replies to this topic

[rs2580]

2nd option.

Password doesn't work for Webif, just for FTP.

Webif is not working with Openpli4 and VUsoloSE, ( only local network is ok )

Anyone is able to watch own STB channels in the world via VUsoloSE and Webif?

[WanWizard]

Yes. Everyone else? (Although most people are smart enough not to do it. due to the security risk).

[rs2580]

Right. Anyone else?

WanWizard - you think that strong password is not insufficient to secure own streaming?

[WanWizard]

No.

 

The problem is not the credential (I don't think a brute force attack is the problem). The problem is that the box doesn't run a hardend dedicated webserver like apache or nginx, but a python socket connection, which for all you know might have 1000 vulnerabilities. And once one is exploited, the entire box is open, since there is no chroot environment or even user based security on the box, everything runs as root.

 

Hence the statement "it is not a security device". You should not put an STB on the internet, just as you shouldn't do that with a webcam, a smart TV, a fridge or a doorbell.

[rs2580]

If i wont to watch my channels anyway, can you write how to set up password for Webif (which is working from "the world"?)

[WanWizard]

Exactly like you did.

 

There is only one user on the box, "root", and that has only one password. And that username and password is used for everything,from telnet and SSH to ftp and the webif.

[WanWizard]

To make it clear:

 

My box config:

 1_0_19_1B1D_802_2_11A0000_0_0_0.jpg   96.89KB   25 downloads

 

My router port forwarding:

 Screenshot from 2018-01-07 19-02-28.png   32.55KB   16 downloads

 

In the browser:

 Screenshot from 2018-01-07 19-03-37.png   39.12KB   20 downloads

 

It prompts for username and password. In enter "root" and the password of my box, and it lets me in without any problems.

[WanWizard]

What doesn't work in this setup is to start a stream using the icons in the WebIf.

 

And that is because the Webif generates this URL:

http://-sid:86abe8cf31f5bb37012ff011262c0550@wanwizard.xxxxxx.xxxx:8001/1:0:19:1B1D:802:2:11A0000:0:0:0:

and that is obviously not a link that is available publicly, as I haven't defined a port redirection for port 8001. If I do that:

 Screenshot from 2018-01-07 19-08-46.png   33.21KB   14 downloads

then VLC also works using my public IP.

[skippie]

I got that problem too now, can't login on chrome with Openwebif.  Don't know what the problem is.

VU+ Ultimo 4k saying connection is not private.

Edited by skippie, 25 August 2021 - 22:20.

[WanWizard]

Typical shitty Chome.

 

Google has decided that all http is bad and should be blocked, and only https should be allowed. While the added security of SSL isn't that much.

[skippie]

Typical shitty Chome.

 

Google has decided that all http is bad and should be blocked, and only https should be allowed. While the added security of SSL isn't that much.

Doesn't work with 2 other browsers either.  When I used Openvix it worked without problems in Chrome.

Edited by skippie, 25 August 2021 - 23:50.

[betacentauri]

Are you in the same LAN or do you try to access the box via internet?

[skippie]

I try to reach the box via my browser, which always worked before.  I still can reach the VU+ with my file manager, no problem there.

Edited by skippie, 26 August 2021 - 07:14.

[Pr2]

did you enable the https in your OpenWebif?  if so the problem is that it uses a self-signed certifcates and Chrome probably doesn't like that.

 

I am using chrome to connect to all my boxes but HTTPS is not enabled here since I use them purely internally.

 

Give it a try disable HTTPS and test.

[skippie]

did you enable the https in your OpenWebif?  if so the problem is that it uses a self-signed certifcates and Chrome probably doesn't like that.

 

I am using chrome to connect to all my boxes but HTTPS is not enabled here since I use them purely internally.

 

Give it a try disable HTTPS and test.

I enabled it and didn't work.  It worked with Chrome and Openvix, never had a problem connecting.

[skippie]

Ah, used https:// and it worked now, had a popup from my Firewall to enable the connection.