Password storage/retrieval for local network server

Question

I have an application server, written in C++ and also uses REST API to serve requests. There is no database, just a simple service which returns if the content of request is valid.

Situation

The server is in a local network and only reachable there, has no internet connections, and only meant to serve request from the same local network.

Our solution

Now I want to secure the REST API with Basic Authentication, with one user only, and have no idea if this following method to store password is secure enough :

1. The password will be passed as parameter on deployment
2. The deployment will encrypt (with DES) the password with a key, store it in an environment variable, say PASSWORDENV, whereas the key will be hard-coded in the application code.
3. When request comes, the application should read the HTTP headers for id and password, encrypts the password, and compares with PASSWORDENV

Concerns

1. The encryption key is hardcoded, but I dont know any other way else to verify the password
2. Is there any security problem with our solution ?

Answer 1

Basic Authentication, will give you marginally more security than you already have:

Consider the vectors you are defending against: bad actor who gains access to the network or disgruntled employee with access to the network.

Bad Actor: If you are not using TLS, anyone on the network will see the entire request/responses (including the password), so TLS is required to prevent the first vector.

Disgruntled Employee: If you are using TLS, anyone on the network with the private keys, will be able to see the entire request/response (including the password), something more may be required to prevent all instances of the second vector.

Now you need to assess the risk associated with these vulnerabilities, which requires you to consider the probability of the vulnerability being exploited and the loss you would take if the vulnerability was exploited (financial, repetitional, etc.)

Side Note:

There are widely accepted forms of token based authentication that may help increase the security of authentication: OAuth or OpenID may work depending on your use case.

Answer 2

First of all, what's the point of encrypting the password? If you are using basic authentication you have the cleartext password, so the most basic precaution would be to hash it (e.g. using argon)

Second, if you want a to move out the authentication from your system, just pass that on to a different system, such as as RADIUS or LDAP server. This lets you expand tat even more than a single user, such as allowing a whole set of users from your central authentication to be able to query your service using their credentials, based on some group membership.

Answer 3

Of course there is a security concern, but at least you have identified the risk which is the first step. Now you need to analyze it and then mitigate it. You actually have two problems:

1. The password saved on disk in the application code
2. The password communicated in the network.

You do encrypt the password in the communication, so #2 would be fine. You may want to add TLS (HTTPS instead of HTTP).

The remaining problem is #1 (password saved on disk), but in order to avoid this you would have to go with a central "identity management" system (like Active Directory, LDAP, oAuth server etc.). If you don't have this, you have to mitigate the risk by other 'compensating' measures, that is strengthening your environment in general, so that 'bad guys' cannot get to the password.

Such 'compensating' measures can be: stricter access control (who accesses the code and can see the password), regular audits, network access control, limit the number of administrators etc.

Answer 4

and only reachable there

...

with one user only

And how are you going to ensure the situation stays like that?

The deployment will encrypt (with DES) the password with a key, store it in an environment variable, say PASSWORDENV, whereas the key will be hard-coded in the application code.

No. Its only fractionally better than just storing the password in clear text. Either use one way hashing or key pairs/quorum encryption. There are implenmentations available off the shelf.