0

I need to display some server info and allow access to some commands via a web interface. I was thinking a secure way of doing this would be to serve the site only over ssh.

I have seen examples of opening firefox running on the server via X forwarding over ssh so I could restrict the site to localhost. I was hoping I could somehow have firefox running locally but only serve over ssh.

Can you point me in the right direction? Is this even possible?

  • Why X11 forwarding and not a simple ssh port forward? – Zoredache Sep 3 '13 at 18:09
  • The hope is to allow non-technical people to do simple things like adding an ftp account, installing wordpress (via a script on the server) and such. They won't use a terminal and it is not in my power to change that. – zortacon Sep 3 '13 at 19:13
  • If you want secured access to a admin control panel, then you should e looking at a VPN probably. – Zoredache Sep 3 '13 at 19:59
  • A port forward is fine so long as they can use a browser on their pc. I wanted to know if it was possible to only server is the connection was over ssh. – zortacon Sep 4 '13 at 19:17
7

Running Firefox on a Server is a bad idea. Running X Forwarding of SSH is slow, klunky, and requires a X Server on the client. Using SSH to secure a web connection is kludgy and exceptionally difficult for typical end users.

TL;DR: Don't do any of this.

Use SSL to secure your traffic. Use account logins to restrict access. Use standard industry practices everything will work as expect, users will rejoice, and there will be world peace... or at least people wont turn violent when your application doesn't work.

0

It is possible!, but issuing OS commands through a webserver makes sense when done remotely and ssh not being an option for some reason. If you have SSH access maybe you can set the apropiate permission schema for each user and allow them to SSH.

If you want to do it though HTTP anyway you can use PHP to pipe OS commands this way:

<?php

$var1 = exec("find / -name 'foo'");
echo $var1 // echo out the result

?>

Of course whatever you pipe to the commandline can be retreived from a form. In any case you will still need to set the apropiate permissions on the php file to make sure only allowed users get to the form, if not you would be piping the OS commands under the security context of the Internet user which would not be a good idea at all.

  • What are you talking about??? – Chris S Sep 3 '13 at 16:50
  • I am responding to this "I need to display some server info and allow access to some commands via a web interface". Using an X server to issue commands is not very efficient. – Daniel J. Sep 3 '13 at 16:54
  • I can't make head or tail out of the second half of this answer. Are you proposing that they throw security completely out the window and allow people to hit a web page to run presumably-arbitrary commands? That's taking the original Bad Idea (using a webpage to run commands but restricting it to localhost-only) and making it worse (opening it up to the world). The Right Thing is to get rid of the web interface entirely. It's unnecessary and riddled with security problems... – voretaq7 Sep 3 '13 at 18:36
  • I didn't propose anything, I am just answering. I wrote my answer at the same time that you so I could not base my response in your almost inmediate previous answer. In any case you can tight up security in such scenario by setting user permissions, file permissions, by using a firewall and also by tunneling. By combinig them you can take security to the level you want. – Daniel J. Sep 3 '13 at 18:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.