disable http & no password for "json.htm?type=command&param=getconfig"

[gbonny]

I have two questions regarding my installation of Domoticz 2020.2 on Ubuntu 18.04. I'm trying to get my domoticz more secure.

1. How can I completely disable HTTP ? I want to use HTTPS only.
I have searched the internet but couldn't find it.

2. I've set:
website security with a password in settings,
light switch protection with a password in settings
and security panel with a password in settings.
But I still can access https://domoticz/json.htm?type=command&param=getconfig without password.

Is this supposed to be? And isn't this a security issue?

Kind regards

[waaren]

1. How can I completely disable HTTP ? I want to use HTTPS only.

Did you try to change

Code: Select all

DAEMON_ARGS="$DAEMON_ARGS -www 8080" 

Code: Select all

DAEMON_ARGS="$DAEMON_ARGS -www 0"

in /etc/init.d/domoticz.sh and restart domoticz after changing this ?

2. I've set:
website security with a password in settings,
light switch protection with a password in settings
and security panel with a password in settings.
But I still can access https://domoticz/json.htm?type=command&param=getconfig without password.

If this is on your local network: what do see in settings page for "Local Networks (no username/password):"

[gbonny]

Code: Select all

DAEMON_ARGS="$DAEMON_ARGS -www 0"

Thanks for pointing that one out, waaren.

It seems that worked out.

Regarding the "local network (no network password)" that one is empty.
I'm accessing domoticz on my local network, yes.

To point it a little bit more out.
"I still can access https://domoticz/json.htm?type=command&param=getconfig without password."

While this URL requires a password https://domoticz/

So it's specifically json.htm?... that might have an issue?

[waaren]

So it's specifically json.htm?... that might have an issue?

No it is by design.
When you check other JSON's you will see some will work and some will return a 401 UNAUTHORIZED message based on the perceived risk/impact.

[gbonny]

So it's specifically json.htm?... that might have an issue?

No it is by design.
When you check other JSON's you will see some will work and some will return a 401 UNAUTHORIZED message based on the perceived risk/impact.

Maybe a stupid question, but why isn't just simply everything: 401 UNAUTHORIZED? That's at least no risk/impact at all.