Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a server running rstudio. This is basically a web application, and it is currently only accessible over the local network.

The web app takes your Linux username/password in order to log you in, and according to the docs "User credentials are encrypted using RSA as they travel over the network." (https://www.rstudio.com/ide/docs/server/getting_started)

Lets say I wanted to open the port to external requests, so that I could use this web app anywhere. What would be the security risk assuming I didn't use https?

share|improve this question

4 Answers 4

up vote 2 down vote accepted

It will be somewhat secure, but not nearly as secure as https, aside from the credentials all other data is unencrypted. If you plan on using it on public (open) networks, I would recommend setting up a proxy as described here. Even with a self signed certificate it will be a lot more secure.

share|improve this answer
    
I agree that the largest threat is from public networks. I think most other threats would exist for https connections as well. –  user35581 Apr 30 at 22:53
1  
"Even with a self signed certificate it will be a lot more secure." - if the attacker can only do passive sniffing then yes. But if the attacker can do this more active access is usually not far away (d.g. ARP spoofing etc) and in this case a self-signed cert does not protect against man-in-the-middle attacks. –  Steffen Ullrich Apr 30 at 23:08

My guess is that it has a serious vulnerability that could be exploited, but it all depends on the implementation. Saying it uses RSA tells very little about the effective security of the system. RSA will not be the weakest link.

  • Does it prevent replay attacks?
  • Does it provide Authenticated Encryption by using MACs?
  • Does the client verify the identity of the server at the other end before responding to challenges?
  • After your login could an attacker alter your remote commands to do malicious things?

You could try browsing the source code (ServerPAMAuth seems a good place to start) and try finding flaws, but honestly I wouldn't bother.

What I would do, is set up a reverse proxy that uses SSL. It just happens I wrote up a detailed guide for how to do that in nginx for a webcam the other day -- just replace webcam with RStudio server and you'll be fine, and note you can run the proxy and Rstudio on the same server (so replace references to 192.168.0.101 to localhost or 127.0.0.1 for best results). Then even if the authentication protocol is vulnerable, you'll still be protected (assuming you actually use a CA signed certificate, or get your browser/other application to trust your self-signed certificate).

EDIT: Actually, according to their instructions you'll need to add a proxy_redirect line for:

proxy_redirect http://localhost:8787/ $scheme://$host:$server_port/;

This says if you have a full URL in an HTTP header field (e.g., in a 302/304 HTTP redirect where the Location field is a URL telling where the resource moved) it will change http://localhost:8787/path/to/something to $scheme://$host:$server_port/path/to/something as necessary, where $scheme will be https.

share|improve this answer

The security services provided by the web app you are describing is different than what https provides. By sending the password over RSA, the password should be cryptographically secure assuming RSA is being properly used. However, the resulting connection will not be encrypted- the user's username and password are the only pieces of information that are protected. In https, all traffic is encrypted. Https uses RSA for the initial session key exchange, so in theory, the session is as secure as the rstudio session during initial setup. However, https can provide perfect forward secrecy for the user credential (if configured to do so) and will provide confidentiality and integrity for the rest of the session. In other words, in the RSA-only scheme the passwords are protected, but not as well, and the rest of the session is wide open to anyone who can listen.

share|improve this answer

As you write that it is basically a web application, this implies that the application itself is transfered via HTTP as well (if you do not cache it or install it as webapp).

In that case, an attacker could simply replace the real webapp with an app not performing encryption or additionally sending passwords back to a server controlled by the attacker. Thus, no matter how secure the RSA actually is, your application is not secure.

Additionally, as others have mentioned, your session's content is most likely transfered as plaintext and thus not protected against eavesdropping and - if no message authentification codes are used - tampering. Thus, I'd strongly discourage using that application without SSL (or a SSL-Proxy).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.