From mboxrd@z Thu Jan 1 00:00:00 1970 From: Toke =?utf-8?Q?H=C3=B8iland-J=C3=B8rgensen?= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=toke.dk; s=20161023; t=1609101124; bh=WqgssFAmMMsnmF5daqEU0JR0Vb9pTmvj3TIUPW3ULi4=; h=From:To:Cc:Subject:In-Reply-To:References:Date:From; b=BHvwCDrmbTLDPaNe7nf2tpCmSlbbAQt0ZXg6rnwUsm8lv4mxnZFq1h+yplsvJlk1h v63B0Z15xKYp7Xo7NJn8x5CMCuhbz/Byy2TKQizaIzOFz6KjBivMI4zOYmUal36++I lt2dGmC812IZEEs++g6zUWVS3wEjQLOVJiUSUZ72mqbZdgOM+4pFWBwJN0dT80YrxX SoZBmN7NGoaayumhBc/YysnODyFpU1fDZCsjNuzMHhLRuthRi8nxDgVLTQBZJLmBFz ZmukHyPB/JO2cy0TViXm6Mprpiai7Qd54OS7TQ6ZRq7DS/gmGM+aqoEqj/TY5UqYah NjxOU4rEiBMoA== To: Juliusz Chroboczek , Cell In-Reply-To: <87y2hjt5fx.wl-jch@irif.fr> References: <1082cfcde178ddb72b51bcd03ee6770a@kn1ght.org> <87zh1zt6ip.wl-jch@irif.fr> <87y2hjt5fx.wl-jch@irif.fr> Date: Sun, 27 Dec 2020 21:32:03 +0100 X-Clacks-Overhead: GNU Terry Pratchett Message-ID: <87y2hjxa64.fsf@toke.dk> MIME-Version: 1.0 Content-Type: text/plain Message-ID-Hash: Q2I7CMPMZN45PWDKJCQPPH4HMUSEC2YH X-Message-ID-Hash: Q2I7CMPMZN45PWDKJCQPPH4HMUSEC2YH X-MailFrom: toke@toke.dk X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; suspicious-header CC: galene@lists.galene.org X-Mailman-Version: 3.3.2 Precedence: list Subject: [Galene] Re: coturn config List-Id: =?utf-8?q?Gal=C3=A8ne_videoconferencing_server_discussion_list?= Archived-At: List-Archive: List-Help: List-Post: List-Subscribe: List-Unsubscribe: Juliusz Chroboczek writes: >>> More about my context: I just put a coturn in place for my synapse >>> server and it's working. I would like to use the same one in place for >>> a future galene but I don't know if the secret for the API is in >>> conflict with the user/password needed for galene. > >> According to what Toke explained to me, Cell is referring to this protocol: > >> https://tools.ietf.org/html/draft-uberti-behave-turn-rest-00 > > I've now read this document a second time, and I still don't get it. > Could somebody please explain the purpose of this protocol? > > In normal TURN, there is a username/password key that must be known by the > WebRTC peers. That's well known to be insecure, but it only protects > access to the TURN server, so the only bad thing that could happen is that > the TURN server will be used by other services. > > With the REST API, we introduce an extra web server. The web server and > the TURN server somehow coordinate to generate ephemeral passwords (for > a very lax notion of ephemeral -- the draft recommends 86400 seconds) > which are communicated over HTTP to the WebRTC peers. > > The TURN credentials are now being rotated periodically, granted, but an > attacker can simply contact the web server to find out what they are. > We're adding an extra point of failure, but I don't see what we are gaining. > > What am I missing? Well presumably the REST web server will only respond to the WebRTC server (in coturn you specify an API key)? And the WebRTC server can limit which clients it will give the actual TURN credentials to? I suppose this is most useful in cases where users have to authenticate to use the WebRTC service; with this you can revoke access (after the key expires), whereas if you are using fixed TURN credentials any user that has used the WebRTC service at any point in the past can continue to access the TURN server indefinitely... So yeah, I agree, it's not exactly Fort Knox, but it does provide some additional access control as long as the WebRTC service itself is not available without authentication (which may or may not be the case for Galene deployments I suppose). -Toke