[tahoe-lafs-trac-stream] [tahoe-lafs] #2142: How to enhance WebUI default security against capability eavesdropping?

[tahoe-lafs]

#2142: How to enhance WebUI default security against capability eavesdropping?
-------------------------+-------------------------------------------------
     Reporter:           |      Owner:  amontero
  amontero               |     Status:  new
         Type:           |  Milestone:  undecided
  enhancement            |    Version:  1.10.0
     Priority:  normal   |   Keywords:  websec confidentiality privacy wui
    Component:  code-    |  webapi docs
  frontend-web           |
   Resolution:           |
Launchpad Bug:           |
-------------------------+-------------------------------------------------

Comment (by daira):

 Replying to [comment:7 amontero]:
 > Replying to [comment:5 zooko]:
 > > So, do the docs referenced in comment:4 answer your questions,
 amontero? If so, then I guess the next-step is to arrange things so that
 the next user finds the necessary docs.
 >
 > I was aware of the SSL enabling syntax for [node].web.port setting, it's
 nicely documented as it is now. What I would like to know is if the
 already present "node.pem" file can be used as a webport SSL certificate
 (I didn't succeeded at it).

 I don't know whether that can be made to work but it's probably not a good
 idea, anyway. Use a separate private key generated by openssl:
 {{{
 openssl genrsa -out mykey.pem 4096
 openssl rsa -pubout -in mykey.pem -out publickey.pem
 }}}
 (and then get a certificate on {{{publickey.pem}}}), or, for a self-signed
 cert with 100-year validity:
 {{{
 openssl req -x509 -newkey rsa:4096 -keyout mykey.pem -out cert.pem -days
 36526
 }}}

-- 
Ticket URL: <https://tahoe-lafs.org/trac/tahoe-lafs/ticket/2142#comment:8>
tahoe-lafs <https://tahoe-lafs.org>
secure decentralized storage