Server: authentication at proxy with basic auth or mTLS

Ideas
1

moved over from Feature: server: http basic auth or mTLS · atuinsh/atuin · Discussion #2099 · GitHub

I´d like to make my server usable for friends, but I neither want to have them use VPN foo nor to have the server directly open to the internet.

I’m quite happy with mTLS at a central proxy and creating certificates for people, another idea would be to add a layer of http-basic-auth at the proxy.

Thanks for this lovely project!

2

Hey! Thanks for posting here :smiley:

I’d rather not add mtls or basic auth directly to the server, though the latter is preferable to the former. How would some sort of invite token work for you? Or perhaps allowlisting some usernames?

3

I would very much welcome a shared secret for the whole instance, that would solve the issue nicely.

And to put it over the top, having support for multiple shared secret with and without expiry date would complete the feature.

4

The token would also be a nice thing

What I’d like to achieve is to have something in front of the atuin server, that allows/denies access.
I might be a little paranoid, but with the layered access I don’t have to pay that much attention to version changes, security updates, etc. of everything that is behind the proxy.

Perhaps I’ll proxy from foo.tld/randomrandomrandom/ to the atuin server. Does the sync_address allow folders in the address combined with a rewrite in a proxy?

5

It does. see Setup an Apache reverse proxy (sublocation)

1 Like
6

@ellie I was asking myself the question: does Atuin Server do some sort of user-authentication. I’m aware that the data is encrypted in the database, so malicious actors only get cyphertext anyways. But is there some mechanism that prevents me from getting some else’s encrypted shell history? If not should there be? It would probably also help against DoS attacks and could probably done with the existing encryption keys of the users via some sort of callenge-response auth.

(Sorry if I’m hijacking this thread, I just didn’t find any other topic and didn’t think it was worth one)

7

It does! When you register you provide a username and password. That’s used for auth. The encryption key is randomly generated and managed by the user

1 Like
8

Sure, but I was asking about self-hosting the server. Sorry I didn’t mention that prominently.

9

Yeah they’re exactly the same

1 Like