 OfflineNewbie
Karma: 0
Posts: 20
|
 |
« on: August 15, 2011, 03:52:53 am » |
I would like that when i connect to my webserver i have
To enter a password before i can see the server.
Are There any examples on how to do that?
|
|
|
|
|
Logged
|
|
|
|
|
Seattle, WA
Offline
Newbie
Karma: 0
Posts: 36
|
|
« Reply #1 on: August 15, 2011, 01:15:53 pm » |
I think the easiest way might be to have your client send in a cookie that contains the username/password info and to have your web server refuse to respond unless the cookie clears verification ("session-based" auth). Principal-based authentication is not defined in the HTTP protocol (as far as I know), and usually such authentication is done through web pages. So short of using HTTP headers and cookies you will most likely have to extend the protocol to support these semantics yourself.
Just my 2 cents' worth of course.
|
|
|
|
|
Logged
|
|
|
|
|
Sydney, Australia
Offline
Full Member
Karma: 3
Posts: 230
Arduino rocks
|
|
« Reply #2 on: August 16, 2011, 12:15:57 am » |
You could do something cheap like using the password text as the page to redirect to... eg collect the password, append ".html" to it and try to redirect to it... eg user enters "fred", which is correct so you have a fred.html and your authentication page redirects to fred.html - otherwise the user will redirect to an unknown page and get a 404... depending on your requirements this might be enough... YMMV..
That's prolly only 1c worth.. ;-)
Cheers,
|
|
|
|
|
Logged
|
Is life really that serious...??!
|
|
|
|
Sussex UK / CT USA
Offline
Edison Member
Karma: 0
Posts: 1026
Forums forever
|
|
« Reply #3 on: August 17, 2011, 11:52:51 am » |
A question to those who know more than I do...
Not "rigorous", but suppose I had a little web server, and wanted only me to be able to make it do it's thing.
Suppose the webserver's URL was "MyWS.com"
It would be easy (well, relatively!) to program it to respond only to, say...
MyWS.com?pw=MyPassword123
What avenues would be available to Bad Guys who wanted to find out how to get the web server to do whatever it is programmed to do when accessed with the extra bit?
|
|
|
|
|
Logged
|
|
|
|
|
Sydney, Australia
Offline
Full Member
Karma: 3
Posts: 230
Arduino rocks
|
|
« Reply #4 on: August 17, 2011, 05:48:39 pm » |
"Bad Guys" typically exploit known bugs in particular server software (eg ISS) to get in. Because you're building a custom server it's going to be harder off the bat for them to exploit known bugs because they'll be working blind. You'd need to make sure your code handles buffer overruns (ie really parameters etc) as they are a nice avenue to exploit.
Also a lot of the "Bad Guys" are just script-kiddies following how-to's - and if the results deviate from what they expect they'll move on to an easier target.
Cheers,
|
|
|
|
|
Logged
|
Is life really that serious...??!
|
|
|
|
0
Offline
Newbie
Karma: 0
Posts: 24
Arduino rocks
|
|
« Reply #5 on: August 18, 2011, 03:50:00 am » |
|
|
|
|
|
Logged
|
|
|
|
|
Netherlands
Offline
Tesla Member
Karma: 86
Posts: 9360
In theory there is no difference between theory and practice, however in practice there are many...
|
|
« Reply #6 on: August 18, 2011, 04:20:12 am » |
"Bad guys" might also do a man in the middle attack and intercept the unencrypted password string  |
|
|
|
|
Logged
|
|
|
|
|
0
Offline
Newbie
Karma: 0
Posts: 24
Arduino rocks
|
|
« Reply #7 on: August 18, 2011, 04:55:51 am » |
It's true. Bad guys can do many things. Arudino is too poor to handle asymmetric crypto, but some sort of response-challenge algorithm could fit  |
|
|
|
« Last Edit: August 18, 2011, 05:00:38 am by arian »
|
Logged
|
|
|
|
|
Netherlands
Offline
Tesla Member
Karma: 86
Posts: 9360
In theory there is no difference between theory and practice, however in practice there are many...
|
|
« Reply #8 on: August 18, 2011, 05:08:00 am » |
but some sort of response-challenge algorithm could fit Definitely |
|
|
|
|
Logged
|
|
|
|
|
0
Offline
Tesla Member
Karma: 50
Posts: 6532
Arduino rocks
|
|
« Reply #9 on: August 18, 2011, 12:12:02 pm » |
One of the best ways to generally keep the bad guys away is to not publically post links to your server. If your server handles something sensitive, you probably need to go with a pc server with built in security features. What level of security do you need?
|
|
|
|
|
Logged
|
|
|
|
|
São Paulo/SP/Brazil
Offline
Sr. Member
Karma: 2
Posts: 293
Brazilian Arduino Team
|
|
« Reply #10 on: August 18, 2011, 03:28:01 pm » |
It's not difficult to implement "Basic Access Authentication". From wikipedia: Client request (no authentication):GET /private/index.html HTTP/1.1
Host: localhost
(followed by a new line, in the form of a carriage return followed by a line feed). Server response:HTTP/1.1 401 Authorization Required
Server: HTTPd/1.0
Date: Sat, 27 Nov 2004 10:18:15 GMT
WWW-Authenticate: Basic realm="Secure Area"
Content-Type: text/html
Content-Length: 311
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<HTML>
<HEAD>
<TITLE>Error</TITLE>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=ISO-8859-1">
</HEAD>
<BODY><H1>401 Unauthorized.</H1></BODY>
</HTML>
Client request (user name "Aladdin", password "open sesame"):GET /private/index.html HTTP/1.1
Host: localhost
Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==
You will need the https://github.com/adamvr/arduino-base64 library and to hack http://arduino.cc/en/Tutorial/WebServer to answer HTTP response 401, and wait for authentication data. Yes, it's not secure(base64 is easily encoded, decoded). A more secure way to do this is using "Digest Access Authentication" and you'll need a MD5 hash library. Need more hacks also but could be done on arduino. |
|
|
|
|
Logged
|
|
|
|
|
0
Offline
Newbie
Karma: 0
Posts: 24
Arduino rocks
|
|
« Reply #11 on: August 18, 2011, 03:50:53 pm » |
Sure, but it will not protect you against man in the middle attack. Simple form will do the same thing |
|
|
|
« Last Edit: August 18, 2011, 03:52:57 pm by arian »
|
Logged
|
|
|
|
|
Offline
Newbie
Karma: 0
Posts: 20
|
|
« Reply #12 on: August 18, 2011, 03:58:51 pm » |
I would like to control some home equipment connected to my
arduino on or off. High security wont be necessary.
I still have no idea how to implement the basic authenticiation in a sketch.
|
|
|
|
|
Logged
|
|
|
|
|
São Paulo/SP/Brazil
Offline
Sr. Member
Karma: 2
Posts: 293
Brazilian Arduino Team
|
|
« Reply #13 on: August 18, 2011, 04:07:12 pm » |
I'll try to implement this next week. I keep you informed!
|
|
|
|
|
Logged
|
|
|
|
|
Offline
Newbie
Karma: 0
Posts: 20
|
|
« Reply #14 on: August 18, 2011, 04:07:55 pm » |
cool |
|
|
|
|
Logged
|
|
|
|
|
|
| Arduino Forum :: Using Arduino :: Networking, Protocols, and Devices :: Password protect for arduino webserver?