0

I am running a Seafile Open Source Cloud server (v 4.0.6) on my Raspberry Pi 2. Currently it is set up to simply run without HTTPS or even a domain name on [myIP]:8000. I am also running an Apache web server on the RPI2 with HTTPS. I wanted to know what are the security risks of running and allowing users to access and sign up for this Seafile cloud server without the safety of HTTPS.

1

Basically, a man-in-the-middle attack could occur.

If someone were to listen in on your users when they submit their username and password, that person would be able to retrieve their login credentials.

Any decent network password sniffer could easily pull this off.

  • From the information I gathered from ServerFault and IS, MITM attacks are more common on wireless networks and improperly configured Local networks, hubs, switches or routers. So, if all my users connect from a wired connection with properly set up routers and firewall wouldn't the risk be negligible? – Joseph Mar 13 '15 at 3:02
  • 1
    Hi. Decided that the security was well worth the trouble. Implemented Seafile behind Apache using FastCGI and HTTPS. Thanks for the answer though. (pavinjoseph.com) – Joseph Mar 13 '15 at 11:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.