Allowed/en - Versionsgeschichte

Ph1959de: Korrektur: mit SEITENTITEL kann nur die SCHREIBWEISE des Seitennamens geändert werden

2018-03-15T08:00:27Z

Korrektur: mit SEITENTITEL kann nur die SCHREIBWEISE des Seitennamens geändert werden

← Nächstältere Version		Version vom 15. März 2018, 10:00 Uhr
Zeile 1:		Zeile 1:
	{{SEITENTITEL:allowed}} <!-- da richtige Schreibweise kleinen Anfangsbuchstaben hat -->		{{SEITENTITEL:allowed/en}} <!-- da richtige Schreibweise kleinen Anfangsbuchstaben hat -->
	{{Infobox Modul		{{Infobox Modul
	\|ModPurpose=Securing the FHEM server components		\|ModPurpose=Securing the FHEM server components
Zeile 8:		Zeile 8:
	\|ModOwner=rudolfkoenig / [http://forum.fhem.de/index.php?action=profile;u=8 rudolfkoenig]		\|ModOwner=rudolfkoenig / [http://forum.fhem.de/index.php?action=profile;u=8 rudolfkoenig]
	}}		}}
	[[allowed]] is a helper module to secure and restrict access to the services (FHEM web server and telnet) provided by fhem.pl.		[[allowed/en\|allowed]] is a helper module to secure and restrict access to the services (FHEM web server and telnet) provided by fhem.pl.

ChristophMorrison am 14. März 2018 um 21:58 Uhr

2018-03-14T21:58:14Z

← Nächstältere Version		Version vom 14. März 2018, 23:58 Uhr
Zeile 8:		Zeile 8:
	\|ModOwner=rudolfkoenig / [http://forum.fhem.de/index.php?action=profile;u=8 rudolfkoenig]		\|ModOwner=rudolfkoenig / [http://forum.fhem.de/index.php?action=profile;u=8 rudolfkoenig]
	}}		}}
	[[allowed]] is a ~~Helper~~ module to secure and restrict access to the ~~server~~ services (FHEM web server and telnet) provided by fhem.pl.		[[allowed]] is a helper module to secure and restrict access to the services (FHEM web server and telnet) provided by fhem.pl.


	==Introduction==		==Introduction==
	By default, every device connected to the same network the FHEM server is part of <ref>For example, if all of the devices connected to you home network use addresses from the range 192.168.178.x, a device using address 192.168.178.3 has access to FHEM, whereas 192.168.'''179'''.3 would be rejected</ref> can connect to and control FHEM without transport-encryption or authentication. This is why FHEM shows a security warning.		By default, every device connected to the same network the FHEM server is also part of <ref>For example, if all of the devices connected to you home network use addresses from the range 192.168.178.x, a device using address 192.168.178.3 has access to FHEM, whereas 192.168.'''179'''.3 would be rejected</ref> can connect to and control FHEM without transport-encryption or authentication. This is why FHEM shows a security warning.

	To secure FHEM, defining an ''allowed''-device is one of the available options.		To secure FHEM, defining an '''allowed''' device is one of the available options.

	Most likely you want to make use of '''allowed''' to		Most likely you want to make use of '''allowed''' to
Zeile 21:		Zeile 21:

	== Syntax ==		== Syntax ==
	To define an ''allowed''-device for one or more [[FHEMWEB]]- or telnet-instances use		To define an '''allowed'''-device for one or more [[FHEMWEB]] or telnet instances use

	define <name> allowed <deviceList>		define <name> allowed <deviceList>

	==Additional Remarks==		==Additional Remarks==
	If you plan to make FHEM accessible from outside your local network, it is highly recommended to not just use '''allowed''' but to also apply additional security measures. Possible options ~~could be~~ the use of VPN ~~technologies~~ (Virtual Private Network) and/or the installation of a reverse-proxy-server ~~like~~ [[Apache_Authentication_Proxy\|Apache]] or [[HTTPS-Absicherung_%26_Authentifizierung_via_nginx_Webserver\|nginx]].		If you plan to make FHEM accessible from outside your local network, it is highly recommended to not just use '''allowed''' but also apply additional security measures. Possible options include the use of a VPN (Virtual Private Network) and/or the installation of a reverse proxy server, for example [[Apache_Authentication_Proxy\|Apache]] or [[HTTPS-Absicherung_%26_Authentifizierung_via_nginx_Webserver\|nginx]].
	For the web server interfaces provided with FHEMWEB it is as well highly recommended to use the attribute {{Link2CmdRef\|Anker=HTTPS\|Lang=en\|Label=HTTPS}} to activate ~~HTTPS~~ encryption. For telnet (being more or less also a TCP/IP port) please use the {{Link2CmdRef\|Anker=SSL\|Lang=en\|Label=SSL}}-attribute.		For the web server interfaces provided with FHEMWEB it is as well highly recommended to use the attribute {{Link2CmdRef\|Anker=HTTPS\|Lang=en\|Label=HTTPS}} to activate transport layer encryption. For telnet (being more or less also a TCP/IP port) please use the {{Link2CmdRef\|Anker=SSL\|Lang=en\|Label=SSL}} attribute.

	<!--		<!--

Ph1959de: der Apostroph musste weg

2018-03-14T13:02:51Z

der Apostroph musste weg

← Nächstältere Version		Version vom 14. März 2018, 15:02 Uhr
Zeile 12:		Zeile 12:

	==Introduction==		==Introduction==
	By default, every device connected to the same network the FHEM server is part of <ref>For example, if all of the devices connected to you home network use addresses from the range 192.168.178.x, a device using address 192.168.178.3 has access to FHEM, whereas 192.168.'''179'''.3 would be rejected</ref> can connect to and control FHEM without transport-encryption or authentication. This is why FHEM ~~show's~~ a security warning.		By default, every device connected to the same network the FHEM server is part of <ref>For example, if all of the devices connected to you home network use addresses from the range 192.168.178.x, a device using address 192.168.178.3 has access to FHEM, whereas 192.168.'''179'''.3 would be rejected</ref> can connect to and control FHEM without transport-encryption or authentication. This is why FHEM shows a security warning.

	To secure FHEM, defining an ''allowed''-device is one of the available options.		To secure FHEM, defining an ''allowed''-device is one of the available options.

Drhirn am 14. März 2018 um 12:03 Uhr

2018-03-14T12:03:31Z

← Nächstältere Version		Version vom 14. März 2018, 14:03 Uhr
Zeile 8:		Zeile 8:
	\|ModOwner=rudolfkoenig / [http://forum.fhem.de/index.php?action=profile;u=8 rudolfkoenig]		\|ModOwner=rudolfkoenig / [http://forum.fhem.de/index.php?action=profile;u=8 rudolfkoenig]
	}}		}}
			[[allowed]] is a Helper module to secure and restrict access to the server services (FHEM web server and telnet) provided by fhem.pl.

	~~[[allowed]] is a Helper module to secure and restrict access to the server services (FHEM web server and telnet) provided by fhem.pl.~~

	==Introduction==		==Introduction==
	By default every device connected to the same network<ref>For example, if all of the devices connected to you home network use addresses from the range 192.168.178.x, a device using address 192.168.178.3 has access to FHEM, whereas 192.168.'''179'''.3 would be rejected</ref> ~~the FHEM server is part of could~~ connect and ~~steer~~ FHEM without encryption or ~~need for user or password data~~. FHEM ~~will therefore present~~ a security warning.		By default, every device connected to the same network the FHEM server is part of <ref>For example, if all of the devices connected to you home network use addresses from the range 192.168.178.x, a device using address 192.168.178.3 has access to FHEM, whereas 192.168.'''179'''.3 would be rejected</ref> can connect to and control FHEM without transport-encryption or authentication. This is why FHEM show's a security warning.
	~~Defining~~ an allowed device is one of the available options ~~to set~~.
			To secure FHEM, defining an ''allowed''-device is one of the available options.

	Most likely you want to make use of '''allowed''' to		Most likely you want to make use of '''allowed''' to
	* allow access to FHEM ~~coming out of~~ other networks and/or		* allow access to FHEM from other networks and/or
	* restrict the possibility to access FHEM (or at least ~~get~~ not full control over all of your devices and ~~configuration~~) ~~for members of the same network~~.		* restrict the possibility to access FHEM for members of the same network (or at least to not getting them full control over all of your devices and configurations).

	== Syntax ==		== Syntax ==
	To define an allowed device for one or more FHEMWEB or telnet-~~Interfaces~~ use		To define an ''allowed''-device for one or more [[FHEMWEB]]- or telnet-instances use

	define <name> allowed <deviceList>		define <name> allowed <deviceList>

	==Additional Remarks==		==Additional Remarks==
	If you plan to make FHEM accessible ~~not only~~ from a local ~~net~~, it is highly recommended to not just use '''allowed''' but to apply ~~also~~ additional security measures. Possible options could be the use of VPN technologies (Virtual Private Network) and/or the installation of a ~~Reverse~~-~~Proxy~~-~~Server~~ like [[Apache_Authentication_Proxy\|Apache]] or [[HTTPS-Absicherung_%26_Authentifizierung_via_nginx_Webserver\|nginx]].		If you plan to make FHEM accessible from outside your local network, it is highly recommended to not just use '''allowed''' but to also apply additional security measures. Possible options could be the use of VPN technologies (Virtual Private Network) and/or the installation of a reverse-proxy-server like [[Apache_Authentication_Proxy\|Apache]] or [[HTTPS-Absicherung_%26_Authentifizierung_via_nginx_Webserver\|nginx]].
	For the web server interfaces provided with FHEMWEB it is ~~also~~ highly recommended to use the attribute {{Link2CmdRef\|Anker=HTTPS\|Lang=en\|Label=HTTPS}} to activate HTTPS ~~enchryption on communication~~. For telnet (being more or less also a TCP/IP ~~Port~~) please use {{Link2CmdRef\|Anker=SSL\|Lang=en\|Label=SSL}} ~~als an~~ attribute.		For the web server interfaces provided with FHEMWEB it is as well highly recommended to use the attribute {{Link2CmdRef\|Anker=HTTPS\|Lang=en\|Label=HTTPS}} to activate HTTPS encryption. For telnet (being more or less also a TCP/IP port) please use the {{Link2CmdRef\|Anker=SSL\|Lang=en\|Label=SSL}}-attribute.

	<!--		<!--
Zeile 32:		Zeile 33:
	-->		-->
	== Examples ==		== Examples ==
	~~Introduce~~ authentification with ~~user~~ and password for ~~common~~ FHEMWEB ~~entity~~:		Configure authentification with username and password for a FHEMWEB-device:
	define allowedWEB allowed		define allowedWEB allowed
	attr allowedWEB validFor WEB,WEBphone,WEBtablet		attr allowedWEB validFor WEB,WEBphone,WEBtablet
	attr allowedWEB basicAuth { "$user:$password" eq "admin:secret" }		attr allowedWEB basicAuth { "$user:$password" eq "admin:secret" }
	attr allowedWEB allowedCommands set,get		attr allowedWEB allowedCommands set,get

	Same for telnet:		Same for telnet:
	define allowedTelnet allowed		define allowedTelnet allowed

Beta-User am 14. März 2018 um 11:21 Uhr

2018-03-14T11:21:23Z

← Nächstältere Version		Version vom 14. März 2018, 13:21 Uhr
Zeile 1:		Zeile 1:
	{{SEITENTITEL:allowed ~~(engl.version)~~}} <!-- da richtige Schreibweise kleinen Anfangsbuchstaben hat -->		{{SEITENTITEL:allowed}} <!-- da richtige Schreibweise kleinen Anfangsbuchstaben hat -->
	{{Infobox Modul		{{Infobox Modul
	\|ModPurpose=Securing the FHEM server components		\|ModPurpose=Securing the FHEM server components

Beta-User: Seitentitel

2018-03-14T11:20:47Z

Seitentitel

← Nächstältere Version		Version vom 14. März 2018, 13:20 Uhr
Zeile 1:		Zeile 1:
	{{SEITENTITEL:allowed}} <!-- da richtige Schreibweise kleinen Anfangsbuchstaben hat -->		{{SEITENTITEL:allowed (engl.version)}} <!-- da richtige Schreibweise kleinen Anfangsbuchstaben hat -->
	{{Infobox Modul		{{Infobox Modul
	\|ModPurpose=Securing the FHEM server components		\|ModPurpose=Securing the FHEM server components

Beta-User: First english version

2018-03-14T11:17:20Z

First english version

Neue Seite

{{SEITENTITEL:allowed}} 
{{Infobox Modul
|ModPurpose=Securing the FHEM server components
|ModType=h
|ModCmdRef=allowed
|ModForumArea=Automatisierung
|ModTechName=96_allowed.pm
|ModOwner=rudolfkoenig / [http://forum.fhem.de/index.php?action=profile;u=8 rudolfkoenig]
}}

[[allowed]] is a Helper module to secure and restrict access to the server services (FHEM web server and telnet) provided by fhem.pl.

==Introduction==
By default every device connected to the same network<ref>For example, if all of the devices connected to you home network use addresses from the range 192.168.178.x, a device using address 192.168.178.3 has access to FHEM, whereas 192.168.'''179'''.3 would be rejected</ref> the FHEM server is part of could connect and steer FHEM without encryption or need for user or password data. FHEM will therefore present a security warning.
Defining an allowed device is one of the available options to set.

Most likely you want to make use of '''allowed''' to
* allow access to FHEM coming out of other networks and/or
* restrict the possibility to access FHEM (or at least get not full control over all of your devices and configuration) for members of the same network.

== Syntax ==
To define an allowed device for one or more FHEMWEB or telnet-Interfaces use

define <name> allowed <deviceList>

==Additional Remarks==
If you plan to make FHEM accessible not only from a local net, it is highly recommended to not just use '''allowed''' but to apply also additional security measures. Possible options could be the use of VPN technologies (Virtual Private Network) and/or the installation of a Reverse-Proxy-Server like [[Apache_Authentication_Proxy|Apache]] or [[HTTPS-Absicherung_%26_Authentifizierung_via_nginx_Webserver|nginx]].
For the web server interfaces provided with FHEMWEB it is also highly recommended to use the attribute {{Link2CmdRef|Anker=HTTPS|Lang=en|Label=HTTPS}} to activate HTTPS enchryption on communication. For telnet (being more or less also a TCP/IP Port) please use {{Link2CmdRef|Anker=SSL|Lang=en|Label=SSL}} als an attribute.


== Examples ==
Introduce authentification with user and password for common FHEMWEB entity:
define allowedWEB allowed
attr allowedWEB validFor WEB,WEBphone,WEBtablet
attr allowedWEB basicAuth { "$user:$password" eq "admin:secret" }
attr allowedWEB allowedCommands set,get
Same for telnet:
define allowedTelnet allowed
attr allowedTelnet validFor telnetPort
attr allowedTelnet password secret