search

sandstorm-io / sandstorm

Sandstorm is a self-hostable web productivity suite. It's implemented as a security-hardened web app package manager.
https://sandstorm.io
Other
6.72k stars 707 forks source link

I have no idea what /admin/networking does #3232

Open ocdtrekkie opened 4 years ago

ocdtrekkie commented 4 years ago

I feel like we should explain this admin panel better. I know that my client PC and my Sandstorm server live on an IP range described here, as blocking server-side requests. And it works. And I don't know of/understand why I would need to modify this panel for any reason.

Also, it's listed as "Networking" in the admin panel page, but when I click on it, it's header says "Admin / Security", which suggests it was renamed in one or the other location, but not the other.

@zenhack says of it:

It's there to address a problem where users could potentially use a sandstorm box on an internal network to get access to that network. Hence why everything is private ip ranges by default. But yes, open issue about the usability of that page. See https://sandstorm.io/news/2017-03-02-security-review The section about server side request forgery.

ocdtrekkie commented 4 years ago

Ideally, the most important thing I think would be to explain some examples of why I might ever need to touch this configuration. (Kenton's blog post suggests that using your own in-house app market might be one.)

codecowboy commented 4 years ago

Agree that it's not very clear. Perhaps related - I tried changing the URL to 'https://192.168.0.0' in 'App Sources' which says it will change install URLs from the app market but that change had no effect. However, it did not warn me that installing from that URL is blocked. Is it currently allowed to install apps from outside the app market? It has no effect if I try an external URL (again it just saves the changes with no warning)

Also - https://github.com/sandstorm-io/sandstorm/issues/3029