Domoticz

• Certificate Authority: I use XCA for managing my CA easy without a bunch of CLI commands: http://sourceforge.net/projects/xca/
• Never email/dropbox/etc your device a client certificate, plug your phones/tablets into the computer running your CA and transfer them directly.
• WPA-EAP-TLS: I use these same certificates to authenticate these devices with there own WiFi network/vlan, When domoticz detects these devices are on the network (ping) it can be confident the device is who its supposed to be.
• EgiGeoZone for Android supports x509 GeoFencing.
• Run a local firewall so the only external ports exposed are: SSH/HTTP/HTTPS, and then do a remote portscan just to make sure nothing else is exposed externally.
• For Apple iOS Devices you'll probably want to use iPhone Configuration Utility to bundle your device certs with.
• If you have remote domo servers either tunnel over SSH or configure firewall to allow only domo servers to talk directly to domo.
• Same for remote json calls that cant hang with x509, use a SSH tunnel to domoticz over loopback device.
• Configure SSH for key login only and install fail2ban for good measure.
• Use a host OS that can apply nginx/ssh/openssl security updates automatically, quickly and safely (cough, debian)

nayr wrote:Managed to get x509 SSO working within Domoticz, here is the patch: https://github.com/domoticz/domoticz/pull/344

This feature should work on version 2.4182+

Here is how you use it, when you create your client certificates you set the commonName (CN) to the username. Then in Domoticz User Manager (Setup -> More Options -> Edit Users) you create a User with a Username thats identical to what you put in the CN field on your cert, for the password input the emailAddress you set in your certificate.. Its all case sensitive so make sure they match or it will fail to auth.

Then in Setup -> Settings, set Authentication: Basic-Auth

If you go through the proxy domoticz will sign-on based upon the certificate provided, full user level permissions are active.. if you bypass the proxy and go straight to the domoticz port (8080) you use the Basic-Auth scheme.

If no matching user is found you'll get an offline error message.

Now to update the Wiki Page then start getting more people using this, then I think we can convince the Mobile App devs its worth supporting.

• Why we can't use form based authentication if the user has no certifcate
• Could this be build in to the Domoticz HTTPS server?

nayr wrote:Thanks to @proohu01 a few errors have been corrected in the Wiki, other than my editorial mistakes, how's it working out for you?

Enter PEM pass phrase:
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server key exchange (12):
* SSLv3, TLS handshake, Request CERT (13):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS handshake, CERT verify (15):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS alert, Server hello (2):
* error:14094417:SSL routines:SSL3_READ_BYTES:sslv3 alert illegal parameter
* Closing connection 0

nayr wrote:try using XCA, I am suspecting there is something wrong with the OpenSSL commands.. I will have to investigate further.. those commands were already in the wiki and I tried to adopt them, foolishly.