Skip to content

Commit

Permalink
Document that --auth is not secure.
Browse files Browse the repository at this point in the history 
Suggested-by: SUSE Security Team <security@suse.de>
  • Loading branch information
@emikulic
emikulic committed Jan 17, 2024
1 parent f477619 commit 2b33982
Showing 1 changed file with 3 additions and 1 deletion.
4 changes: 3 additions & 1 deletion darkhttpd.c
View file
Expand Up @@ -941,7 +941,9 @@ static void usage(const char *argv0) {
"\t\tit will be closed. Set to zero to disable timeouts.\n\n",
timeout_secs);
printf("\t--auth username:password\n"
"\t\tEnable basic authentication.\n\n");
"\t\tEnable basic authentication. This is *INSECURE*: passwords\n"
"\t\tare sent unencrypted over HTTP, plus the password is visible\n"
"\t\tin ps(1) to other users on the system.\n\n");
printf("\t--forward-https\n"
"\t\tIf the client requested HTTP, forward to HTTPS.\n"
"\t\tThis is useful if darkhttpd is behind a reverse proxy\n"
Expand Down

4 comments on commit 2b33982

@Smattr
Copy link

@Smattr Smattr commented on 2b33982 Jan 24, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Arrived here from an advisory on oss-sec. You might want to consider wiping the relevant argv string on startup to prevent it being visible in ps. There’s an inherent race condition in this, so it’s not a perfect defence, but some software like MySQL believe it is worthwhile.

@emikulic
Copy link
Owner Author

@emikulic emikulic commented on 2b33982 Feb 16, 2024 •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's kinda neat. That specific approach appears to leak the length...

@Smattr
Copy link

@Smattr Smattr commented on 2b33982 Feb 16, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Doesn’t it only leak a 1-bit signal of whether your password was 0-length or not? The last line of the selected section terminates the overwritten string early. And if your password is the empty string, I think you have bigger problems than it being visible in ps.

@emikulic
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point, I should have read it closer.

Please sign in to comment.