60 replies to this topic

[daveraver]

it doesnt work, I have all packages updated, I dont know if its my openwebif version. Has anybody test it?? I have disabled root user on openwebif plugin configuration and it still works.

Edited by daveraver, 16 February 2017 - 13:49.

[WanWizard]

OpenWebIf is third-party development. You can find their issue tracker here: https://github.com/E...penWebif/issues

[daveraver]

is there any solution?
https://github.com/E...ebif/issues/577

[Erik Slagter]

Streaming and webif access are two completely separate things. I still don't understand what it is you're after.

[daveraver]

Ive created a new user on putty ssh.

adduser username

and after that I put on openwebif option disable root acces 'yes'
I can acces to streams with root and with new username from external network, openwebif dont block root user...or...what does the OWIF option do? disable root access...it is denny root user acces...I think so. but in the owif git they say it is handled by pli image...have you read the reply of my issue on owif git? the second and last reply says that pli images handled this feature of root access outside local network. that is what I have understood...havent you?

[Erik Slagter]

Streaming and webif access are two completely separate things. I still don't understand what it is you're after.

[daveraver]

I will not enter in code of enigma2, it is known openwebif configures options to streaming, and enigma has its own. I am an user, not coder as you. You will find where it fails if you want. I only change user interface menu parameters. my question is simple and clear. are you joking me?

Edited by daveraver, 17 February 2017 - 14:55.

[WanWizard]

@Erik, in https://github.com/E...ebif/issues/577 Schimmel... blames you.

[Erik Slagter]

Yes I know. Just as usual. The thing is, "daveraver" has a gripe about streaming (apparently, I assume) and goes complaining to the OWIF guys, which don't have anything to do with it. Maybe you can explain it to him.

[WanWizard]

I referred him to the OWIF guys, didn't have a clue what he was trying to do.  So this is about streamproxy not honouring the OWIF config regarding streaming auth?

[daveraver]

trying to block user root to login on streaming, and use other custom username. machines exposed to the internet used to disable root user access from external network as you know, it is the usual user to try hack, ddos attack, on machines as vps...and in this case machine exposed to the internet to give streaming service would be an enimga2 box. I think it is very common configuration, disable root user acces from external network, I have wrote this several times in this thread. I think it is understood now. I think so. Well, the login disable of root user is permament, local and external network, in all cases, I think so, but owif git discusion 577 says that on local network it is not disabled by owif the root user acces. I think the issue is simple.

Edited by daveraver, 17 February 2017 - 20:21.

[WanWizard]

Without a complete redesign of the entire system, this is quite pointless, as everything runs as root, there is no security present in the box. It is not a server Linux OS.

 

It is the main reason the box should NEVER be connected to the internet, it is not secure. The user you use to login is irrelevant in this discussion.

[SpaceRat]

Sadly I have to agree with WanWizard, at least partly.
The preferred way to access the OWIF and streaming/transcoding from outside would be a VPN.

Disabling root access has very limited effect (but this effect is to what extent i have to disagree with WanWizard): Attackers can not abuse the Webif to probe/brute-force the root password.

The part where I have to agree: If there any holes in OWIF an attacker can exploit them, no matter which user account he used to login. As the OWIF runs inside E2, which runs as root, any exploit against OWIF would result in root rights.
And btw: OWIF has a package manager inside, there isn't even an exploit needed. Once you have OWIF access, you can install any ipk, for example a special VPN.

Gesendet von meinem Siemens C25 mit Tapatalk

[daveraver]

ok, ritght. but look at this owif option I am sure you know it...so there is the possibility to denny remote access to root user. well, now its not possible...perhaps in the future. thank you.

[daveraver]

ok Spacerat, I didnt know not to use root user dont take effect to protect and owif plugin by itself has security holes and the user to login doesnt matter...thank you

[SpaceRat]

The option DOES work, but PLi streaming does not auth through OWIF, so this option does not influence streaming/transcoding on OpenPLi and also not on other images when they are forced to use PLi-like streaming because there is no separate transcoding.

Gesendet von meinem Siemens C25 mit Tapatalk

[WanWizard]

Disabling root access has very limited effect (but this effect is to what extent i have to disagree with WanWizard): Attackers can not abuse the Webif to probe/brute-force the root password.

 

True, I overlooked this point.

[littlesat]

And still add the end.... You should use vpn and never open a streaming or owif port to the www!

[Erik Slagter]

BTW if you stream through the streamproxy (yes that is possible), it WILL check this option. Just make sure you make the "right" request to the streamproxy...

[daveraver]

BTW if you stream through the streamproxy (yes that is possible), it WILL check this option. Just make sure you make the "right" request to the streamproxy...

ok thank you, streamproxy let to create streams with other parameters than owif. I hope transcode will be activated if possible with f1 on pli, new drivers let it, I just want it to test, not to make intensive use. thanks.

Edited by daveraver, 20 February 2017 - 21:37.