I'm trying to create a security mechanism that only allows my application to upload files to my FTP (username and password login is not enough). To achieve this I was thinking of creating a key that is built in to the app, and before any file can be uploaded to the FTP this key has to be read and verified. If it's correct, then the file can be uploaded.
Is this something that is possible to do, and would this approach be preferred? Does anyone have any pointers on how to do this?
(note: i'm not asking for any code, just some pointers on where to start, since my searches aren't getting my anywhere)
Thanks.
if you are worried about unsecured wi-fi, etc, you can either use SFTP or tunneling over SSH e.g. with connectbot
the use of public key crypto will will make sniffing harder.
if this is too much work for the intended userbase, you could generate one time passes (like google authenticator) and upload your file with a POST form or something.
if you are afraid of the key itself getting stolen (compromised device), there is little you can do..
There's no point in reproducing an answer from another question verbatim, so I'll just post this link to it.
Related
I have password protected a folder using .htpasswd and .htaccess that contains digital assets that I want to control the downloading of using php.
I was planning on offering a download link using the mechanism:
http://username:password#www.website.com/directory/
However, I don't want people to have access to the username and password. In other words I want to make a php gateway file with a different url that decides to offer the download or not, based on information available in the database.
This is a security thing, so I'm not confident of where to start with this. I'm sure I could hash together some code but I'm not confident about it. How can I do this securely? Any help greatly appreciated.
If you have the technical possibility I would suggest you even store the assets outside of the web accessible folders so you don't need to rely on htaccess for protection. That way your PHP gateway script is the only way to access those files.
I won't go into details about writing the script itself, there are multitudes of ways to do that and it very much depends on your requirements what is best, so more information would be needed to give some advice to that. If your assets are very big then streaming them through your script might not work due to memory/time limitations, in that case you could symlink them from the safe location to a public location with a randomly hashed path/filename for a limited time and give that link out.
I have a web app (html5,javascript,css ..) with a connection page,
but in this page i only put the password in a JavaScript file to do the test, than i have figured out that any one who can open the google chrome console can see the password.
So i want to put the password in a distant secure file in my case webserver wamp how can i do it ?
I've read about cgi scripts but i don't know how to use it, please if you have any tutorials or an ideas like ssl or something else i'll be very thankful.
If you match a password with anything on the client side, then your application is NEVER going to be secure. You want the provided password to be matched against something which the user does not see.
Start from here to better understand differences. And then take a look here for an implementation. It uses a database backend. But you could easily replace that with file content matching. After that, most likely you'll need to work with a session to ensure authentication is enforced.
Although I do not recommend it, if you're in a hurry and don't need too much security, you can also take alook here.
Ok. I am a bit of a new developer and haven't done much work with networking (in general, not specifically obj-c). Basically, I need to record a file (I have code to do this), then upload it to a server. I've looked at code to upload to servers and it seems that all I need from the server side of things is a html upload page with a php script, which I have. Another option would be ftp/sftp, although this would be harder to implement. The problem is I need to have authentication for the upload, and preferably have a secure (https) upload, with a username and password. I cannot figure out how to do this. I would also need the server to send back a response to the app.
Also, are their any frameworks to make it easier to upload files? I know there was asihttprequest, but that was discontinued...
What would I need to make the server do to have authentication and authenticated uploads, and be able to return data back to the app? Sorry for such a n00by question, but if you could help that would be great.
Thanks
Check out AFNetworking. I really enjoy doing file downloads and uploads using AFNetworking. The FAQ even gives an example on how to upload a file and download a file. All you need server side is a PHP script to handle a POST file upload.
I have a file setup.php.
This file has the mysql username and password. Is there any method to make it unreadable or encrypt it so that even the admin can not read it, or can read it but still not know the password?
The short answer is that for practical purposes you can make it harder for them to access it but not impossible.
If someone has full access to a server filesystem (eg, with root permissions) then they can read any data off that filesystem, so they can read the code and any data files that you place on there. As the application running on that host needs to be able to use the credentials there's no effective way to prevent someone with full access to that server from reading them.
You could obfuscate them, to make it a bit harder. if you encrypt the credentials in the setup.php file and then placed a decryption algorithm and key in another php file, it would stop someone just opening the file and getting the creds, but it they could always reverse engineer that solution if they're determined enough.
Additionally if they've got full control of the server it would be possible to use a packet sniffing tool to get the credentials as they're used (unless you're encrypting them with something like SSL).
Ultimately if someone is running an application and controls the server you have to place a level of trust in them.
As an aside there's a stackexchange site at security.stackexchange.com that's a good place for questions like this.
Create a new user in MySQL and give some basic permissions for that user. Then you will have two users, your admin account and the user account with limit privileges.
You also can deny view a folder where your setup.php is located doing the same trick, create other user in your OS to limit restrictions to that folder
I have a website developed in PHP. There are 2 classes (in 2 seperate php files) that contain the siteadmin's gmail user id and password (in plain text) and database password (again in plain text). Though none of these classes are displayed on the browser ( like index.php). These files contain only php classes and no html code and the references to those plain text passwords is only through objects of those classes.
Off late, I have started to wonder if this is secure enough? I have tried my best (acting as a malicious person) to try and read the contents of the two said php files but was not able to do so. I am not very conversant with developing secure code, so not sure what should be my approach to make sure that these passwords never get exposed.
Could any one please suggest best practices to develop php code that can contain such sensitive information securely.
Put configurable items in a separate configuration file, above your public web directory
Make sure you have set correct file permissions to your files
Check your web application for local (and remote) file inclusion
Have your server up-to-date
Having your passwords at a safe spot is not the complete solution, you'll need to have your complete PHP application secure, and nobody unauthorized should be able to get root/administrator access to the server.
Firstly, I'd look at using OAuth for accessing GMail if at all possible - it means you don't have to store credentials at all, and provides some level of protection in case your server does get compromised.
I would also look at the answers to this question.
Finally, if your site is on the public internet, it's worth reading up on at least the basics of internet security, and especially securing web applications. There are all sorts of ways things can go wrong. I like the "hacking exposed" books.
Don't store passwords in files, because someone will eventually check that file into source control. Or someone will set a permission incorrectly.
Run the application with its own O/S user account
Put the passwords in an O/S environment variable for the application user (not a system environment variable)