Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Lock down the transfer method on wallet GRPC to have some kind of authentication. #4478

Closed
stringhandler opened this issue Aug 15, 2022 · 0 comments · Fixed by #4532
Closed

Lock down the transfer method on wallet GRPC to have some kind of authentication. #4478

stringhandler opened this issue Aug 15, 2022 · 0 comments · Fixed by #4532
Labels
P-high-risk Process - High risk

Comments

@stringhandler
Copy link
Collaborator

Lock down the transfer method on wallet GRPC to have some kind of authentication.

Currently, anybody on the local machine can send funds out of the wallet via GRPC
@stringhandler stringhandler added the P-high-risk Process - High risk label Aug 15, 2022
This was referenced Aug 18, 2022
Closed
Merged
stringhandler pushed a commit that referenced this issue Aug 25, 2022
@sdbondi
feat(console-wallet): adds basic grpc authentication (#4532)
2615c1b 
Description
---
- adds basic password auth interceptor to wallet grpc.
- disables grpc by default
- adds `hash-grpc-password` command that produces a salted hashed password that clients can use for authentication
- adds cli args to explicitly enable grpc
- adds `wallet.grpc_authentication` configuration
- allow grpc client to use basic auth if configured
- add `--enable-grpc` cli flag to wallet

Motivation and Context
---
Fixes #4478 
Secure GRPC calls with basic auth.
User should explicitly enable grpc when it is needed.

Usage:
- Set `grpc_authentication = { username: "foo", password: "bar" }`
- Call `tari_console_wallet hash-grpc-password` and copy the hash
- Use the username and hashed password in e.g. postman or any other grpc client

How Has This Been Tested?
---
Basic unit tests 
Manually (POSTman and running a miner with GRPC auth enabled)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
P-high-risk Process - High risk
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

feat(console-wallet): adds basic grpc authentication sdbondi/tari
1 participant
@stringhandler