0000955: add option to specify listening address for amuleweb

Notes
(0003534) bugmi (reporter) 2011-01-29 17:47	Nothing yet? it would be really useful.

(0003702) uqbar (reporter) 2017-05-30 08:10 edited on: 2017-05-30 08:49	This is actually a major bug to be addressed asap. It's a real bug as the amule.conf file has an ECAddress setting to limit the "external connections" address, but amuleweb is happily ignoring it and is not able to connect unless it's unset! And it's a security bug as well. The web UI has no encryption (aka SSL) and opening a web UI over any network without encryption is a security nightmare. Now, besides adding encryption, there's an easy solution: fix just this bug. Let amuleweb listen on loopback only at any address from 127.0.0.1 to 127.255.255.254. Then open an SSH TCP port forward/SOCKSv5 proxy from remote client to the amuleweb host. This should add very strong encryption to amuleweb with just a tiny fix. Maybe the offendig code is here: file:src/sebserver/WebServer.cpp, line 285 amuleIPV4Address addr; addr.AnyAddress(); addr.Service(webInterface->m_WebserverPort); it looks like it's setting the listening address to 0.0.0.0 . What's hard to find to me (so far) is where it's connecting to for amuled.

Relationships