Feature #1020
closed
Provide HTTP basic auth additional authentication option
Added by Martin Klein about 15 years ago.
Updated almost 10 years ago.
Description
edit: see cmb's 20101120 explanation. original submitter's follows.
It would be nice if the Web interface could offer http auth
instead of the login form as an option. It would be really great
if one could set the auth realm as well, so someone trying to log
in is not seeing what kind of software is listening on that ip.
I know this is security by obscurity, but never the less i would prefer
my users not knowing what kind of firewall im using.
- Status changed from New to Rejected
We just spent considerable time moving from that model to the model we are using in 2.0. Sorry but we are not going back to the old model.
PS: firewall off the port to the world and only allow from a management IP.
- Subject changed from Disable Form Based Authentication to Provide HTTP basic auth additional authentication option
- Status changed from Rejected to New
- Priority changed from Normal to Very Low
- Affected Version deleted (
2.0)
While not legit for reasons of obfuscating what you're running (almost every single commercial vendor does similar and fully identifies itself, that's why you strictly limit management access by IP with any device like this), it is a legit feature request and one I've thought of before. Though not to replace session authentication, it probably would be in addition to it.
Putting in HTTP basic auth at the web server level is beneficial for a couple security reasons. One, it could prevent the exploitation of a security hole in the web interface code. Two, it could prevent a future vulnerability in PHP itself from being exploited.
Restricting access to the web interface by IP is the answer here, as the mentioned scenarios are largely to entirely irrelevant with properly-restricted access.
Note I can't imagine this ever getting any consideration short of someone funding it or contributing the code.
- Status changed from New to Closed
time would be better spent on certificate auth instead.
Also available in: Atom
PDF
Updated by 
Updated by