How to protect web GUI with a password ?

[Zigm4]

Hi there :)

I will start by congratulating you and thanking you for the work done here ^^
I'm looking for a way to protect access to the interface with a password (I would like to publish the site on the internet in a secure way). Is there something already available? If not, is it in your roadmap ?

Thanks !

[hanzov69]

@Zigm4 Moonraker doesn't provide any sort of web interface. For that, I think you'd want to look to Fluidd/Mainsail/whatever you're using.

[FrYakaTKoP]

since the frontend runs in the client, securing it with a password would not help at all. So OP was right to ask here.

[hanzov69]

I understand what you're saying, and perhaps I misunderstood OPs intent- they asked about protecting the web gui, which there isn't, hence my confusion.

The moonraker default [authorization] seems to have sane defaults to prevent people from exposing this on the edge. Thinking through this, you could probably stash moonraker behind an haproxy or nginx instance set up with basic auth. Then for whatever your GUI client is, make the websocket calls with the credentials inline on the url.

Looking at fluidd, looks like you can update the config.json endpoints with your credentialed proxy address. I have no way of knowing if this would work, and not bothered to try it.
Your guidance below is solid, but realistically this seems like a terrible thing to expose on the public side. But that's just me.

[FrYakaTKoP]

@hanzov69 what do you mean with: "realistically this seems like a terrible thing to expose on the public side"?

[hanzov69]

@hanzov69 what do you mean with: "realistically this seems like a terrible thing to expose on the public side"?

Exposing the control interface to the public internet, even behind a username/password auth scheme. To your point made elsewhere, something like utilizing a VPN is a far better idea. Keep that traffic internal-ish.

[FrYakaTKoP]

@Zigm4 no there is no direct way protecting the interface with a password. Also just adding a 'password' isn't enough, you would also need to harden your whole "image" (kernel and alot of installed software) if you expose it to the web.

My recommended way to access your printer from outside, is to use the VPN functionality built into your Router (the one which allows your phone or other devices to connect to your home network through a VPN tunnel not the other "privacy" VPNs advertised everywhere).
Check your router if it got this functionality

If not you could also use a tunnel service like ngrok, atleast it's "safer" then directly expose your raspberry to the web.

If you don't understand why i don't recommend to expose a pi to the web (especially if you are not a webserver admin which knows stuff). Go to a crawler site like shodan.io and lookup "octoprint" or similar. Scary how much of such systems show up and some are not updated for years (what is expected for normal users, but really bad if a "server" is open to the web). Btw. octoprint also don't recommend port forwarding your pi, but still people happly do it 🤷

this maybe also a good read:
https://octoprint.org/blog/2018/09/03/safe-remote-access/

[Arksine]

Lots of good answers in this thread. Simply put, user auth would be useful for securing local access (for example, kids or roommates that you don't want messing with the UI). It would not be useful for remote access.

I think that in the future we will look to add some clear documentation and/or provide some tools to help with remote access, but at the moment our focus is on improving stability of existing functionality and extending functionality.

[moghyukon]

I really wish there would be some access control also on the local network, hence you can control a fire hazard. Please implement something sooner.

[Arksine]

If you need something soon you could add basic auth to nginx. Just remember that your credentials are stored in the browser until you close it (all windows).

https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-http-basic-authentication/