[NOT a Bug]: create equal access rights for /etc/wireguard as /etc/openvpn about raspap-webgui HOT 6 CLOSED

fixed by using "sudo"

from raspap-webgui.

same for ddnsclient config:

tch@raspberrypi:/etc $ ls -al |grep ddclient.conf 
-rw-------   1 root     root       199 Jan 27 17:19 ddclient.conf

from raspap-webgui.

Thanks for providing insider access btw!

just a question not related to this issue: how do i list the connected clients in bash? i can list DHCP leases, but i have tried anything in the php files without any luck.

the only method i can come up with is:

flowchart TD
    A["cat /var/log/dnsmasq.log | grep DHCPACK"] -->|"where time is less then leasetime"| B(Active clients)

but this is not a list of active clients, but a list of active leases...

from raspap-webgui.

Thanks for providing insider access btw!

@NL-TCH you betcha :)

Good question re: active leases. Check out the related discussions in #538 and #302

Instead of using dnsmasq leases, I'm leaning towards using iw station dump to collect MAC addresses, then cross referencing them with wlan0's arp table. Then some more awk/sed/grep magic to get the relevant data.

from raspap-webgui.

/tmp/hostapd.log cannot be accessed by a normal user (and API) as well

from raspap-webgui.

/etc/wireguard is privileged, so the API cannot read the configs without privilege (which is not ideal).

I might be wrong, but modifying wg permissions likely opens some big security holes. Defaults are:

700 for the /etc/wireguard directory
600 for the contents of /etc/wireguard

$ ls -ld /etc/wireguard
drwx------ 2 root root 4096 Sep 19  2022 /etc/wireguard

/etc/ddclient.conf also contains passwords.

Exposing these to an API is an open invitation to 'security researchers' looking for their first CVE.

from raspap-webgui.