{"action":"closed","issue":{"url":"https://api.github.com/repos/pi-hole/AdminLTE/issues/39","repository_url":"https://api.github.com/repos/pi-hole/AdminLTE","labels_url":"https://api.github.com/repos/pi-hole/AdminLTE/issues/39/labels{/name}","comments_url":"https://api.github.com/repos/pi-hole/AdminLTE/issues/39/comments","events_url":"https://api.github.com/repos/pi-hole/AdminLTE/issues/39/events","html_url":"https://github.com/pi-hole/AdminLTE/issues/39","id":134906441,"number":39,"title":"Possible Future Security Breach Warning","user":{"login":"Fedora-Core","id":17313562,"avatar_url":"https://avatars.githubusercontent.com/u/17313562?v=3","gravatar_id":"","url":"https://api.github.com/users/Fedora-Core","html_url":"https://github.com/Fedora-Core","followers_url":"https://api.github.com/users/Fedora-Core/followers","following_url":"https://api.github.com/users/Fedora-Core/following{/other_user}","gists_url":"https://api.github.com/users/Fedora-Core/gists{/gist_id}","starred_url":"https://api.github.com/users/Fedora-Core/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Fedora-Core/subscriptions","organizations_url":"https://api.github.com/users/Fedora-Core/orgs","repos_url":"https://api.github.com/users/Fedora-Core/repos","events_url":"https://api.github.com/users/Fedora-Core/events{/privacy}","received_events_url":"https://api.github.com/users/Fedora-Core/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/pi-hole/AdminLTE/labels/Bug","name":"Bug","color":"fc2929"},{"url":"https://api.github.com/repos/pi-hole/AdminLTE/labels/Discussion","name":"Discussion","color":"d4c5f9"},{"url":"https://api.github.com/repos/pi-hole/AdminLTE/labels/Enhancement","name":"Enhancement","color":"84b6eb"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":45,"created_at":"2016-02-19T16:23:56Z","updated_at":"2016-03-02T21:08:23Z","closed_at":"2016-03-02T21:08:23Z","body":"The _future_ maintenance functions of the /admin/ website can be reached **from the outside** !\r\n\r\n**[PANIC SWITCH]** ---------- **[ON]**\r\n\r\nThe IT-gurus, employed by the multi-million-dollar advertising industry (that we sabotage), can - _in the future_ - '**whitelist**' their domains with something like the following : \r\n`<img src=\"http://adserver.com/admin/php/add.php?list=white&domain=adserver.com\">`\r\n\r\nPi-Hole is Open-Source, \r\nand the GitHib _development_ branch is visible by everyone, \r\nincluding by these IT-gurus of the advertising industry.\r\n\r\n\r\n**----------** Request =>  Please '**harden**' the Pi-Hole admin webserver.\r\n\r\n\r\n2 Possible solutions => One for Short-Term, and One for Long-Term.\r\n\r\n\r\n**Solution 1° - Short-Term**\r\n{ Add username / password Authetication. }\r\n\r\nFrom the github / pi-hole / wiki =\r\nhttps://github.com/pi-hole/pi-hole/wiki/Nginx-configuration-instead-of-the-default-lighttpd-and-php-cgi-option\r\n\r\nFrom the jacob salmela blog =\r\nhttp://jacobsalmela.com/password-protect-a-lighttpd-web-server-on-a-raspberry-pi-using-mod-auth/\r\n\r\n\r\n**Solution 2° - Long-Term**\r\n{ Run each of the Pi-Hole-appliance's services on _individual_ Static IP-addresses. }\r\n\r\nA) Give the RaspberryPi's 'main' interface a Static IP-address for SSH and other softwares.\r\nBonus: this main Static IP-address remains free for other appliances (cloud, web, streaming,...)\r\nNote : we have seen this requirement on several fora by people who want to run other stuff too.\r\n\r\nB) Give the Pi-Hole-appliance's DNS server _another_ Static IP-address for the DNS resolution.\r\nBonus: this is the only Static IP address that the user's router must know.\r\n\r\nC) Give the Pi-Hole-appliance's 'adblock' Webserver - and future miniDLNAserver - yet _another_ Static IP-address, and adapt the gravity script accordingly. (No more dynamic-searching for the IP).\r\nBonus: the user of the Pi-Hole-appliance can run other webservers on the main interface Static IP-address - see A).\r\nOptional Bonus: a full-fledged webserver, crippled with Rewrite-Rules, is no longer required. \r\nA simple webserver in Perl, or in Python2, or in Python3, or even in command-line PHP, can simply reply with the HTTP header '204 No Content'.\r\n° This new Static IP-address must not be known by anybody but: the gravity script that feeds the DNS server's configuration file.\r\n \r\n\r\nD) Give the Pi-Hole-appliance's 'admin' webserver yet _another_ Static IP-address.\r\nBonus: Cutting-off the outside world. **Problem solved.**\r\nBonus: No need for /admin/ in the URL. It can be the document-root for this webserver. \r\nBonus: No need for yet another username / password to remember. (But may be optional.)\r\n° This new Static IP-address must be known _only_ by the 'administrator' of the Pi-Hole-appliance.\r\n\r\nOptional =>\r\nE) Disable (not un-install) the dhcp-client-daemon(s), the assumption being that we run a 'server'.\r\nF) Use the '/etc/network/interfaces' again to declare the _multiple_ Static IP-addresses, this time by using the 'ip' utility from the 'route2' package. \r\nRaspbian Jessie already includes the statement 'source-directory /etc/network/interfaces.d'\r\n\r\n\r\n**Conclusion: Yes, We Can**.\r\n\r\n**[PANIC SWITCH]** ---------- **[OFF]**\r\n\r\nNote: why I used the term 'Pi-Hole-appliance' =>\r\nQuote from the githib / AdminLTE / New admin features (idea) #24\r\n> jacobsalmela commented 3 days ago\r\nIf we ever want to commercialize anything, ....\r\n\r\n\r\nGreetings, F.C.\r\n"}}