Weekly edition	Kernel	Security	Distributions	Contact Us	Search
Archives	Calendar	Subscribe	Write for LWN	LWN.net FAQ	Sponsors

openwrt

Posted Mar 7, 2008 0:59 UTC (Fri) by afalko (subscriber, #37028)
In reply to: openwrt by tetromino
Parent article: Authentication bypass in routers

Correct me if I am wrong, but openwrt does come with an interface --- at least when I tried it
two years ago. The difference I guess is that openwrt authenticates via apache (also correct
me if I wrong; my memory from two years ago is probably butchered up by now) or you can make
it authenticate via apache :).

(Log in to post comments)

openwrt

Posted Mar 7, 2008 1:29 UTC (Fri) by tetromino (subscriber, #33846) [Link]

Openwrt never used apache. The historical "White Russian" versions of openwrt (all those released before spring 2007) included a web interface that was implemented in shell script. Frankly, I would be surprised if the thing had no security issues.

However, modern "Kamikaze" releases of openwrt have no web interface at all; you configure them by ssh'ing in and editing config files, just like on a normal Linux server.

openwrt

Posted Mar 7, 2008 13:48 UTC (Fri) by jengelh (subscriber, #33263) [Link]

There is X-Wrt/webif² built ontop of OpenWRT/Kamikaze  and it uses HTTP Authentication with
cookies. All good.