2

I have a Raspberry Pi that hosts a website and it going to host an email server. I am looking for tool that is a web interface, just like a cPanel. The reason why I need this is because I constantly work on the server and I have set up extra security precautions, and it takes a long time logging in and modifying things, so I am thinking that a web interface server manager would be perfect.

To sum up, my questions are...

  • is a web interfaced cPanel software safer to run?
  • can you give me any recommendations for a really good software for these needs? (Free only, open source softwares are better)
  • any drawbacks to this?

Thanks for your time, any suggestions and any help are warmly welcomed.

Sid.

  • You spent time improving the security and have identified the usability tradeoff (log in time). Now you want to punch a giant hole in your security with a web application - any web app should have at least the same level of security if not more (since it is exposed to the internet) than the rest of the system. As a result, a web interface should take just as long to log into as the existing method. – Steve Robillard Apr 16 '17 at 18:16
2

Typically adding a web application to a server will make it considerably less safe.

There are two main reasons for this. One is just that a web application itself has a much broader attack surface than an SSH server. A web application must process relatively (as compared to SSH) complex unauthenticated requests (to handle, say, login to the site) and there's a lot more and generally much more sloppily written software involved in that. (OpenSSH is just the one server and perhaps PAM until you complete authentication; even a simple login screen on a web site typically involves a web server such as Apache, a language interpreter such as PHP, a DBMS such as MySQL, and the code for the application itself, all of which communicate with each other in complex ways.)

The second reason is that proper configuration of web applications and their associated software is very much more complex than configuring an OpenSSH server. Just getting appropriate SSL certificates and making sure that the keys are secure is probably more error-prone than an entire OpenSSL configuration. Beyond that you also need to handle configuration for all the other software, editing configuration files and making sure that, e.g., MySQL isn't listening on a network interface to which attackers might have access, you've got the right PHP interpreter settings (improper PHP settings can destroy the security of an otherwise secure application), your Apache is doing only just what it needs and serving nothing else, and so on. And then you need to keep all this software up to date, which is not as easy as a simple apt-get update && apt-get dist-upgrade followed by a reboot.

I suggest you stick to administering your system through the command line only, accessed via SSH. Make sure you've configured OpenSSH to disable root logins and password logins (but make sure you've tested your key based login first!) and ensure that you've got a copy of your Pi's host key in your .ssh/known_hosts on the clients from which you access it. In the long run this is considerably simpler (because there's so much less software to set up) than using a web-based control panel as well as usually more secure.

  • I was debating that having a web interface that is accessible to all is not as safe but my laziness overtook, I guess I will be so much more better off sticking to ssh... thank you very much! – SidS Apr 16 '17 at 23:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.