2

I'm hosting a website on a free hosting provider server that uses PHP for OTP-based authentication. Here’s how it works:

  1. If an unregistered IP address visits the site, it shows an "Unauthorized" message.

  2. For registered IPs, the site asks for an OTP, giving users three attempts to enter it correctly. The result is either "SUCCESS" or "FAIL" based on the input.

  3. An OTP is generated every 30 seconds using the PHPGangsta/GoogleAuthenticator library (GitHub link).

  4. The TOTP key is stored in an encrypted file on the server, and the PHP file decrypts it to generate OTPs.

  5. The server also shares a secret which is also stored as encrypted file if the authentication is successful.

  6. The PHP file also processes OTP and sends the relevant message to index html page.

  7. Both the PHP files (the one generating OTPs and the one containing the encrypted key) have file permissions set to 600.

  8. I have also set up .htaccess to block access to all IP addresses except for a few trusted ones.

  9. I was provided with FTP credentials (username and password) to access the server.

Given the file permissions and .htaccess restrictions, is my TOTP key safe on the server? Could the PHP files still be accessible from the internet if my FTP credentials remain secure? What other security concerns should I be aware of in this setup?

Improve this question
6
  • 2
    How are you encrypting the TOTP file? What encryption algorithm? Where are you storing the encryption key?
    – andycaine
    Commented Sep 27 at 20:14
  • openssl enc -aes-256-cbc -in plaintext.txt -out encrypted.dat -pass pass:YourPassword -pbkdf2. any more secure alternative?
    – Akhil Akkapelli
    Commented Sep 27 at 20:17
  • 1
    and where is the password stored? or it's hardcoded like that?
    – andycaine
    Commented Sep 27 at 20:18
  • the encrypted password file is stored in a file in htdocs folder. And denied for all in the .htaccess file
    – Akhil Akkapelli
    Commented Sep 27 at 20:20
  • 1
    did you need to persist a session here or is this a sort of one-time page? (In either case, I wouldn't bother with checking IP, it's not a good way to detect a user)
    – browsermator
    Commented Sep 27 at 20:44

2 Answers 2

Reset to default
8

is my TOTP key safe on the server?

From other users hitting (presumably) HTTPS? Maybe, largely depends on your code and if it can be exploited.

From the free hosting provider admin? No

From malicious users that may find a security hole in your free hosting providers services (ftp or otherwise)? No

Could the PHP files still be accessible from the internet if my FTP credentials remain secure?

Yes. Since you dont know how the server is setup, or how the services on the server are configured ... there is a non-zero chance that it could be vulnerable to a multitude of attacks that could render any security measures you put in your PHP moot.

What other security concerns should I be aware of in this setup?

  • Server admin with root access
  • Potential exploits in your code
  • Potential exploits in PHP itself
  • Potential exploits in the HTTP(s) server running PHP
  • Potential exploits in the FTP service
  • Potential exploits in services running on the server that you are not aware of
  • Third party services that this free hosting service might make use of
  • In proper decommissioning of the servers physical drives

TLDR: This is a terrible idea

Improve this answer
5
  • Can I share the code here for a vulnerability review? I'm new to hosting web servers, and the details of my website will remain undisclosed.
    – Akhil Akkapelli
    Commented Sep 27 at 20:24
  • 1
    codereview.stackexchange.com
    – CaffeineAddiction
    Commented Sep 27 at 20:25
  • Also: potential exploits in the user (process & file system) separation implemented by the hosting provider, assuming a shared server
    – Bergi
    Commented Sep 28 at 10:52
  • "TLDR: This is a terrible idea" - would this also apply to a paid hosting provider? Is the main issue with storing the TOTP key in the file system?
    – Bergi
    Commented Sep 28 at 10:54
  • 2
    Honestly its more to do w/ it being a shared hosting provider than free. Self owned Dedicated Hardware > Rented Dedicated Hardware > Shared Hardware with Hypervisor separation between clients (AWS EC2 nodes) > Shared Hardware w/ no Hypervisor separation (random box running webserver and ftp w/ the only separation being file permissions).
    – CaffeineAddiction
    Commented Sep 28 at 11:16
4

I would be very concerned if your authentication mechanism was protecting anything sensitive.

It sounds like you are storing secrets on the server (the password used to derive the encryption key) which is a bad idea. Secrets should generally be stored in some sort of secure vault.

The fact that this is (presumably) a shared server is also a problem. A vulnerability or misconfiguration anywhere on that server could result in someone being able to access your TOTP key.

It also sounds like you have 1 TOTP key? So all users are sharing the same key? So that's another avenue for compromise.

You should also think about brute force attacks. If TOTP is the only credential needed, assuming a 6-digit code, that wouldn't take too long to brute force.

Overall you might want to consider an authentication mechanism like OIDC with a trusted identity provider that can provide strong authentication.

Improve this answer
6
  • If the authentication is successful, I'll send the secret stored in php file to the user. I plan to explore storing passwords in a free vault for secure access. Only I can access the server via FTP. Would using unique TOTP keys for each user enhance the security of the program?
    – Akhil Akkapelli
    Commented Sep 27 at 20:43
  • 1
    @AkhilAkkapelli a shared TOTP key would mean that if one user leaked the key, an attacker could authenticate as any other user. In your case it sounds like that would mean being able to authenticate from any authorised IP, rather than just the one associated with that TOTP key
    – andycaine
    Commented Sep 27 at 21:02
  • Implementing a unique TOTP key (retrieved from the vault) for each user is a more secure and straightforward approach. I’ll move forward with that solution
    – Akhil Akkapelli
    Commented Sep 27 at 21:06
  • 2
    @AkhilAkkapelli you should also think about ability to brute force this, assuming no additional protection and a 6 digit TOTP that wouldn't take too long - edited answer to include this
    – andycaine
    Commented Sep 27 at 21:19
  • 2
    @AkhilAkkapelli You're misunderstanding what TOTP does. TOTP is designed to be used with a password. The password prevents brute-force attacks, the TOTP prevents interception ("replay") attacks. You've eliminated the password here which is wrong. If you want to do something like FIDO2 or certificate-based authentication, that's a different story.
    – user71659
    Commented Sep 28 at 19:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .