Tranquil IT Forum

Hello!
I've just finished a web interface for WAPT, which allows for room and user management.
It's possible to create groups of PCs called "rooms" and install packages on them.
Users can then access their assigned rooms and manage the packages within them.

Here's the GitHub link. The software hasn't been fully tested yet, so if you test it, I'd appreciate your feedback and any modifications you make.
https://github.com/jojojojojota/waptwebpanel

Have a good day/evening!

Hello Joey,

Calvibald wrote: ↑May 29, 2019 - 8:20 AM I just finished a web interface for WAPT, which allows for room and user management.
It's therefore possible to create groups of PCs called "rooms" and install packages on them.
The created users can access the rooms assigned to them and manage the packages.

Here's the GitHub link. The software hasn't been tested at scale yet, so if you test it, I would appreciate feedback and any modifications made.
https://github.com/jojojojojota/waptwebpanel

Thank you very much for this contribution and your enthusiasm. This is a way of working that could prove interesting for middle or high schools that don't require high levels of security. I have two comments, however:

First, the WAPT security model is based on asymmetric cryptography, with the private key protected by a password and stored on the admin's machine or on an external token. In your code, the key and its password are stored directly in plain text on the server. It's important to understand that accessing the decrypted code signing key is essentially the same as having local admin rights on all machines.

Secondly, the WAPT server is written in Python; it would be much more appropriate to use Python rather than PHP! And Python code is, in my opinion, much nicer than PHP code. )

Regarding my first point, it would be helpful to mention in your README.md the security implications of your proposed operating method. In your model, if the server is compromised, the entire network is compromised. This is true for most other deployment solutions, but not for WAPT when used according to the public WAPT documentation (WAPT has received CSPN security certification and qualification from ANSSI).

In the operating mode you're proposing, the server potentially becomes an attack vector. This isn't a problem for networks that don't require a high level of security, but the system administrator who will be using it still needs to be fully aware of this. Feel free to reuse part of this explanatory text in your README if you want!

Sincerely,

Denis

Thanks for the feedback! I'll add this to the readme since it's indeed important. As the system is more of a demo or alpha version, it's likely to change drastically. So I'll work on other solutions!

Have a good rest of the day!