CUPS listening on a localhost port and asking you to authenticate with your username and actual password has long bothered me. (I know it’s a privileged port, I just don’t like the idea of ever typing my local password into any browser, ever.)
I haven’t seen this proposal yet in this thread: instead of convincing browser vendors to support connecting to Unix domain sockets, contrive a tiny adapter which listens on a localhost port and expects http with basic auth (and either generates a random username and password or accepts them by environment variables), prints out a url with the password like
Hi! To connect to your service at /tmp/whatever-service.unix, tell your browser to go to
http://fwahjiddbjko:derhhkiytdfbkifdx@localhost:45678/
and then the adapter accepts connections, checks the auth, and then proxies the connection to the unix socket.
You could do this with nginx really easily but you’d have to keep track of a config file for each service.
Comments
CUPS listening on a localhost port and asking you to authenticate with your username and actual password has long bothered me. (I know it’s a privileged port, I just don’t like the idea of ever typing my local password into any browser, ever.)
I haven’t seen this proposal yet in this thread: instead of convincing browser vendors to support connecting to Unix domain sockets, contrive a tiny adapter which listens on a localhost port and expects http with basic auth (and either generates a random username and password or accepts them by environment variables), prints out a url with the password like
and then the adapter accepts connections, checks the auth, and then proxies the connection to the unix socket.You could do this with nginx really easily but you’d have to keep track of a config file for each service.
See https://stackoverflow.com/questions/17701420/bypassing-http-... for a similar idea (but that is about stripping auth, not adding it)
Especially that nowadays password authentication may fade away soon.
Windows already supports password-less authentication quite well. It's just a matter of time until there are good solutions for Linux too.
I have already some systems set up in a way that they ask for a TOTP when doing username/password login via SSH: https://github.com/google/google-authenticator-libpam