Security features in bukuserver

[rthorntn]

Thanks for creating and maintaining this project.

A bukuserver on the web seems to make sense for me, I would put it on a public IP address, so I could add bookmarks to it from all my devices, is there a way to secure it though, to stop some random person from altering my bookmarks?

I have an Android phone, iPad tablet, Linux, Mac and Windows PC's, I want to be able to access my bookmarks on any of them from anywhere.

Some thoughts I had on security:

• Perhaps I could install a reverse proxy in front of bukuserver.

• I want to stay away from VPN's.

• Encryption would be nice but I'm not really worried about people seeing my bookmarks.

• My main concern is somebody messing with my bookmarks.

[jarun]

@rachmadaniHaryono please take a look.

[rachmadaniHaryono]

there is plan to add login feature, but i am busy irl. so until it is implemented, it is recommended to run it on trusted local environment

[jarun]

I am adding an item in the ToDo list for this and closing the defect.

[ckolumbus]

you might want to check out Shaarli for production ready solution for publicly hosted internet service.
I actually have both services running, buku and Shaarli, for different usage scenarios

[rthorntn]

Thanks Chris, could you help me out with the reasons for using both, can you share the bookmark data between Baku & Shaarli?

…

On Thu., 13 Dec. 2018, 23:05 Chris Drexler ***@***.*** wrote: you might want to check out Shaarli <https://github.com/shaarli/Shaarli> for production ready solution for publicly hosted internet service. I actually have both services running, buku and Shaarli, for different usage scenarios — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#309 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AMKvwd2hIA0OtrP0Z50oRPVR7yb3-o3Cks5u4s85gaJpZM4WFEkP> .

[jarun]

@rachmadaniHaryono would it be possible to expose the DB file encrypt and decrpy feature? That should block unauthorized access to the database till you can come up with a password-based locking mechanism.

[rachmadaniHaryono]

2 way to do this

1. put an interface for user to input password on encrypted database
2. put a password prompt every time user start with an encrypted database

2 is the easiest with minimum change to html/routing etc

1 need more planning. i assume there should be a way so user can decrypt once on a single session until the server shutdown or user log out

[jarun]

I am fine with the easiest option as long as the security aspect remains the same.

[ckolumbus]

@rthorntn

Thanks Chris, could you help me out with the reasons for using both, can you share the bookmark data between Baku & Shaarli?

Regarding sharing: you could, but it's not implementd on either side. and i'm not sure whether this is necessary, at least in my case(see reason below)

Regarding my reasons for using both:

Shaarli has a very good integration with other systems: you have firefox add ins, an android app, it can integrate with wallabag, and much more. This is all very nice for my private needs where my bookmarks are hosted on an hosted linux and have global protected r/w access from anywhere.

For use within my professional environment I cannot store internal addresses on outside systems, but I also cannot host an internal service. So Buku helps me here to store company internal bookmarks in an efficient way with "enough" integration. The biggest benefit: it's browser independent as I'm using 3-4 browsers regularly.

I'm currently developing plugins for buku and Shaarli to call bookmarks directly from Keypirinha. Buku is already working, shaarli integration is givining me some troubles. This allows me to call up any bookmark quite quickly and efficiently. Together with BrowserSelect I can define how to open each of these bookmarks then.

At the end I do have all my bookmarks at my fingertips but can keep my company information isolated.

Maybe you can get some ideas on how to improve your bookmarks workflow :-)

[jarun]

@rachmadaniHaryono @ckolumbus could any of you pick this up?

[ckolumbus]

@jarun I'm quite busy at the moment but i'll try to get a little design proposal done for review so that the security aspects are considered appropriately

[jarun]

Thanks!

[jarun]

This defect is linked in the ToDo list. Closing the defect.

[RyanRLong]

I can have a look, but I'm confused if this issue is closed or not.

[jarun]

It's not closed. Feel free to pitch in!

[RyanRLong]

@jarun Can I use Flask issued plug-ins with pip?

[jarun]

@rachmadaniHaryono please confirm.

[rachmadaniHaryono]

i think it is fine

[tom-i]

Hi guys, is there any possibility how to secure bukuserver from internet?