Security

Web security

By default, mhttpd only accepts connections from the same machine, on port 8080, and does not ask for a password. This is deliberate: anyone who can reach mhttpd can control your experiment.

Accessing the web interface from other computers

There are several ways to use the web interface from other computers:

• Behind a web server (recommended). Run mhttpd behind a web server such as apache or nginx, which handles HTTPS and passwords, and forwards requests to mhttpd on the local port. See Running mhttpd behind a web server.
• SSH tunnel. For occasional access, forward the port over SSH, e.g. ssh -L 8080:localhost:8080 alice@daqhost, then browse to http://localhost:8080 on your own computer. Nothing needs to change on the experiment host.
• Insecure port. mhttpd can also listen on a second port (8081 by default) that accepts connections from other machines. Enable it with Enable insecure port in the /WebServer ODB directory. By default this port requires a password and only accepts connections from hosts in /WebServer/Host list. The traffic is not encrypted, so only use this on a trusted network.

Running mhttpd behind a web server

In this setup, a web server such as apache httpd or nginx accepts HTTPS connections from other computers. It asks for a username and password, then forwards the requests to mhttpd on its local port (8080 by default). mhttpd keeps its default settings, so it only accepts connections from the same machine. The same web server can also forward requests to other servers, such as an external elog.

For step-by-step instructions for apache on Ubuntu (including getting a certificate with certbot and creating the password file), see Install apache httpd proxy for midas and elog on the TRIUMF DAQ wiki.

The main part of the apache configuration goes in the <VirtualHost> section for HTTPS (port 443):

ProxyPass /elog/ http://localhost:8082/ retry=1
ProxyPass /      http://localhost:8080/ retry=1

<Location />
    SSLRequireSSL
    AuthType Basic
    AuthName "midas"
    AuthUserFile /etc/apache2/htpasswd
    Require valid-user
</Location>

• The /elog/ line is only needed if you run an external elog server (here on port 8082). Set /Elog/URL to https://<host>/elog/ so that the Elog menu entry goes through the web server
• Create the password file with htpasswd -c /etc/apache2/htpasswd <user>. Leave out -c to add more users to an existing file
• Apache needs the ssl, proxy and proxy_http modules (on Ubuntu, sudo a2enmod ssl proxy proxy_http)
• mhttpd can also be served under a sub-path, e.g. ProxyPass /midas/ http://localhost:8080/ retry=1, as its pages only use relative links. Include the trailing / in the address users open (https://<host>/midas/)

The web server password protects everything, including the JSON-RPC interface that the web pages use. Leave Enable insecure port in /WebServer set to n, so that the web server is the only way in from other computers.

Native SSL/https

mhttpd doesn't support HTTPS itself. Older versions of midas had an HTTPS port, but it has been removed. To encrypt the connections to the web interface, run mhttpd behind a web server that handles HTTPS.

ODB security

ODB passwords

You can require a password to connect to the experiment. Set it with the passwd command of odbedit, which stores it (encrypted) in /Experiment/Security/Password. Only the first 8 characters of the password are used. To remove the password, delete that key.

Once a password is set:

• programs ask for the password (Password:) in their terminal when they connect. A program started without a terminal (e.g. from the Programs page or a start script) can't answer, so it fails to connect
• the web interface shows an Enter password page before any other page. The browser remembers the password for 24 hours

To let some programs connect without the password, create a key (of any type) in one of these directories:

• /Experiment/Security/Allowed programs, named after the client name of the program (e.g. Logger for mlogger or ODBEdit for odbedit). A key named mhttpd also turns off the password for the web interface
• /Experiment/Security/Allowed hosts, named after the machine. Programs on the main machine use the name localhost, unless /Experiment/Security/Enable non-localhost RPC is y (they then use the name printed by hostname)

The passwd command creates an example key in each directory (host.sample.domain and mstat).

Read-only ODB keys

Each ODB key and directory has read, write and delete permissions. Removing the write permission from a key prevents accidental changes. It isn't access control, though: the permissions are the same for everyone, and anyone can change them back. You can also make keys read-only while a run is in progress. The ODB browser displays these permissions as R, W and D, plus X for exclusive mode and H for an active hotlink. H is a client-activity indicator rather than a permission bit. See Access control.

RPC security

Midas programs talk to each other over TCP connections, using midas's own remote procedure calls (RPC). For example, the program that starts a run connects to each program that has registered for run transitions. Programs on other machines connect to the experiment through mserver. See Running on multiple machines.

By default, /Experiment/Security/Enable non-localhost RPC is n, so programs and mserver only accept connections from the same machine. Set it to y to allow programs on other machines.

RPC ports

The ports used are:

• mserver listens on port 1175, or the port in /Experiment/Midas server port (see Changing the port number)
• each program listens on its own port, e.g. for run transitions and requests to stop. By default the operating system chooses a free port, which is shown in /System/Clients/<pid>/Server Port. To use a fixed port, set /Experiment/Security/RPC ports/<client name> before you start the program
• each program on another machine also opens three ports on its own machine when it connects. mserver connects back to these ports. They are always chosen by the operating system, so they can't be fixed

So if there is a firewall between the machines, the main machine must accept connections on the mserver port. Each other machine must accept connections from the main machine on any port.

RPC hosts

When Enable non-localhost RPC is y, programs and mserver only accept connections from the machines listed in /Experiment/Security/RPC hosts/Allowed hosts. Connections from the same machine are always allowed. Changes to the list take effect straight away.

The name of the connecting machine is looked up from its IP address, and must match an entry exactly. When a connection is rejected, midas writes a message such as rejecting connection from unallowed host 'daq2.lab.ca'. Add the name from the message to the list.

Programs on other machines check their incoming connections in the same way. So the list must include every machine that runs midas programs, including the main machine (e.g. so that frontends on other machines accept run transitions).

To accept connections from any machine, set /Experiment/Security/Disable RPC hosts check to y. Only do this on a trusted network.