Ticket Navigation

Ticket #463 (closed Feature Request: fixed)

Opened 8 months ago

Last modified 3 months ago

Reported by:	wichert@wiggy.net	Assigned to:
Priority:	low	Milestone:	Not yet assigned to a Milestone
Component:	Gateway	Keywords:
Cc:

The gateway status page is readable for everyone at the moment. This has several downsides for me:

it includes all information needed to disconnect a user using the manual disconnect feature I'm implementing. That makes it a security problem.

I use wifidog in a highly commercial environment and do not want everyone to be able to see how many people are connecting and which IPs/MACs they have. That has both security issues (MAC addresses reveal a lot about the type of machine someone uses for example) and bussiness reasons (the usage figures are confidential).

I have implemented this in the form of three patches:

restore the authentication functionality which was removed from LibHTTPD in r252
add authentication configuration logic to the gateway
protect the status page

0001-Restore-auth-support-in-libhttpd-which-was-removed-r.patch (2.1 kB) - added by wichert@wiggy.net on 04/28/08 06:47:24.
0002-Add-authentication-related-settings-to-the-configura.patch (3.6 kB) - added by wichert@wiggy.net on 04/28/08 06:47:38.
0003-Protect-the-status-page-with-authentication.patch (1.1 kB) - added by wichert@wiggy.net on 04/28/08 06:47:55.