5 ms·
How much of an added security risk does adding a web-based admin interface (to the usual ssh tunnel) represent?
by benevol 9y ago
How much of an added security risk does adding a web-based admin interface (to the usual ssh tunnel) represent?
- dthul 9y agoYou could bind the web service to the loopback interface of the server. This way it cannot be accessed directly from the internet. Then you can use SSH port forwarding to access it from the web browser on your local machine.
- smacktoward 9y agoHow much overlap is there between the users who know how to do that and the users who need a Web-based control panel, though?
- deleted 9y ago[deleted]
- number6 9y agoSSH has a lot of neat features that mitigate MITM, Eavesdropping, Bruteforcing etc. Where a Web-based Admin Interface should have SSL and maybe some protection against bruteforcing. Plus, you get all the vulns that come with the modern web
- ynniv 9y agoHopefully they're properly defending against XSS and not going to pull a Filet-o-Firewall [https://github.com/filetofirewall/fof https://github.com/filetofirewall/fof http://www.kb.cert.org/vuls/id/361684 http://www.kb.cert.org/vuls/id/361684]
- andyrj 9y agoAdd nginx/apache with client certificate authentication in front of this and most of those concerns go away. Plus this way you don't have to worry about exposing the port but you need to distribute your client keys before hand.