miguelfreitas
Public server mode
To test it, launch the daemon with the following option: -public_server_mode=1
Requires its Core counterpart (miguelfreitas/twister-core#183).
Don't allow all IPs to access your server yet. API calls are restricted in this mode, but I don't know much about network security. If you plan running a public server, wait for the experienced developers to verify if it is really safe to run openly.
hmm in public mode we need to remove stop twisters button, start/stop mining
Removing buttons wouldn't be effective, because attacker could still issue the command to the server manually. Instead, I've blocked all these calls in the core (in public server mode). The server returns an error message saying the function is forbidden.
So even if an attacker gets onto the network page, he cannot do any harm, because the server just won't accept any of those calls. Try it for yourself - remove the network page redirect and try stopping the daemon. Nothing happens. As long as twisterd is running in public server mode, there is no way to access these RPC calls.
What the attacker could do, as Miguel pointed out, is to take one of the safe calls that are allowed, and overload the server by flooding it with requests. We still have to implement a protection against that.
@digital-dreamer thanks for answer, how can i stop daemon if it in public mode? kill/killall ? I think, that it would be better if someone press exit button or list wallet in webui user see that action is forbidden
Exactly, you would have to SSH to your machine and kill the process manually.
It is easy to display the "action is forbidden" message, we can do it, but normal users will never see it. Nothing in the public server mode interface leads to network.html, and if you enter its URL, it will redirect to the "this is a read-only server" page. Only a person intentionally trying to break it could get to the "action is forbidden" message. But yes, it is easy to add this alert, in the case when RPC command returns an error message with error code -23 (meaning "forbidden on public server").
There is not really a "list wallet" function in the UI, the RPC call "listwalletusers" is used in login.html to display a list of available usernames you can log in as. In public mode, the drop down menu would simply be empty, but it would just confuse people if we direct them to the login page and then tell them logging in is forbidden, so instead the login leads you to instructions how to download Twister on the project website.