Allow restricting Tahoe-LAFS gateway to one user by supporting Unix sockets #1535

New Issue

tahoe-lafs · 2011-09-14T17:10:06Z

LoneTech commented

2011-09-14 17:10:06 +00:00

It's fairly easy to limit the node interface, by setting something like:
web.port = unix:/home/$USER/.tahoe/websocket:mode=600

The problem is, web browsers can't connect to it. That much is expected, but neither can the tahoe CLI. It refuses any node.url that does not begin with http or https, and I found no way to make it connect to a UNIX socket.

The downside with a TCP socket is it lets all local users use the filesystem, even if they can't find your files in it without the caps.

It's fairly easy to limit the node interface, by setting something like: web.port = unix:/home/$USER/.tahoe/websocket:mode=600 The problem is, web browsers can't connect to it. That much is expected, but neither can the tahoe CLI. It refuses any node.url that does not begin with http or https, and I found no way to make it connect to a UNIX socket. The downside with a TCP socket is it lets all local users use the filesystem, even if they can't find your files in it without the caps.

tahoe-lafs added the

labels 2011-09-14 17:10:06 +00:00

tahoe-lafs added this to the undecided milestone 2011-09-14 17:10:06 +00:00

tahoe-lafs added

major

and removed

minor

labels 2011-09-14 22:39:36 +00:00

tahoe-lafs modified the milestone from undecided to soon

2011-09-14 22:39:36 +00:00

tahoe-lafs changed title from ~~Allow restricting Tahoe-LAFS gateway to one user~~ to Allow restricting Tahoe-LAFS gateway to one user by supporting Unix sockets

2011-09-14 22:39:36 +00:00

tahoe-lafs modified the milestone from soon to eventually

2014-01-21 20:43:15 +00:00

tahoe-lafs added

normal

and removed

major

labels 2014-01-21 20:43:30 +00:00

Sign in to join this conversation.