如何安全加固本地REST服务器？树莓派家居安防系统场景问询

Hey there! Let's break down how to secure your Raspberry Pi home security system's disarm feature—since it's way more sensitive than arming, you're right to prioritize hardening this part. Using ssl.wrap_socket with a self-signed certificate is a solid first step, but we'll need to layer on extra safeguards to meet the high security bar for disarm commands. Here's a step-by-step guide tailored to your setup:

1. Encrypt Traffic with SSL/TLS (Using ssl.wrap_socket) #

First, we need to stop sending disarm commands in plaintext—SSL/TLS will encrypt the data between your client (phone, computer) and the Pi's server, preventing eavesdropping.

Generate a Self-Signed Certificate & Key #

On your Raspberry Pi, run this OpenSSL command to create a 4096-bit RSA key and a self-signed certificate valid for 1 year:

openssl req -x509 -newkey rsa:4096 -keyout server.key -out server.crt -days 365 -nodes

• Fill in the prompts (you can leave most fields blank, but set a meaningful Common Name like "raspberrypi-security.local").
• Critical: Restrict access to the private key so only the server can read it:

  chmod 600 server.key
  

Modify Your Python Daemon to Use SSL #

Update your existing HTTP server code to wrap the socket with SSL. Here's an example using Python's standard http.server library (adjust to match your current handler):

import ssl
from http.server import HTTPServer, BaseHTTPRequestHandler

class SecurityRequestHandler(BaseHTTPRequestHandler):
    def do_POST(self):
        # Handle arm command (existing logic, lower security bar)
        if self.path == "/arm":
            self.send_response(200)
            self.end_headers()
            self.wfile.write(b"System armed")
            # Add your existing arming logic here

        # Handle disarm command (high security required)
        elif self.path == "/disarm":
            # First, validate authentication (we'll expand this next)
            auth_token = self.headers.get("Authorization")
            if not auth_token or auth_token != "Bearer YOUR_SUPER_SECRET_DISARM_TOKEN":
                self.send_response(403)
                self.end_headers()
                self.wfile.write(b"Unauthorized: Invalid token")
                return

            # If authenticated, run disarm logic
            self.send_response(200)
            self.end_headers()
            self.wfile.write(b"System disarmed")
            # Add your disarming logic here

if __name__ == "__main__":
    PORT = 443  # Standard HTTPS port (use 8443 if you don't want root access)
    server = HTTPServer(("", PORT), SecurityRequestHandler)
    
    # Wrap the server socket with SSL
    server.socket = ssl.wrap_socket(
        server.socket,
        server_side=True,
        certfile="./server.crt",
        keyfile="./server.key",
        ssl_version=ssl.PROTOCOL_TLS_SERVER
    )
    
    print(f"HTTPS security server running on port {PORT}")
    server.serve_forever()

2. Layer on Extra Authentication (Non-Negotiable for Disarm) #

SSL encrypts traffic, but it doesn't verify who's sending the command. For disarm, you need to add strong authentication—here are your best options:

Option 1: API Token Authentication #

• Generate a long, random token (use this command on the Pi: openssl rand -hex 32 to get a 64-character secure token).
• Include this token in the Authorization header of your disarm POST request (e.g., Authorization: Bearer abc123...).
• As shown in the code above, validate this token before executing any disarm logic.

Option 2: Client Certificate Authentication (Even More Secure) #

For an extra layer, require clients to present a trusted certificate to access the disarm endpoint:

1. Generate a client certificate signed by your server's CA (you can reuse the server's key/crt to sign it):

   openssl req -newkey rsa:4096 -keyout client.key -out client.csr -nodes
   openssl x509 -req -in client.csr -CA server.crt -CAkey server.key -CAcreateserial -out client.crt -days 365
   

2. Update the SSL wrapping code to require client certificates:

   server.socket = ssl.wrap_socket(
       server.socket,
       server_side=True,
       certfile="./server.crt",
       keyfile="./server.key",
       ssl_version=ssl.PROTOCOL_TLS_SERVER,
       cert_reqs=ssl.CERT_REQUIRED,  # Require client cert
       ca_certs="./server.crt"  # Trust certs signed by our server CA
   )
   

3. When sending the disarm request, your client (e.g., curl, mobile app) must present client.crt and client.key.

Option 3: IP Whitelisting #

If you only send disarm commands from a fixed IP (like your home Wi-Fi or phone's static IP), add a check in the disarm handler:

ALLOWED_IPS = ["192.168.1.100", "10.0.0.5"]
client_ip = self.client_address[0]
if client_ip not in ALLOWED_IPS:
    self.send_response(403)
    self.end_headers()
    self.wfile.write(b"Unauthorized: IP not allowed")
    return

3. Work Around Self-Signed Certificate Limitations #

Self-signed certificates aren't trusted by default by browsers/mobile apps—you'll see a "unsafe" warning. For a home system, this is acceptable, but you can fix the warning by:

• Importing server.crt into your phone/computer's trusted root certificate store (steps vary by OS, but search for "install root certificate" for your device).
• Using a local DNS name (like raspberrypi-security.local) that matches the Common Name you set when generating the certificate.

4. Harden the Python Daemon Itself #

• Run as a non-root user: Binding port 443 requires root, so either use a higher port (like 8443) or grant Python the ability to bind low ports without root:

  sudo setcap 'cap_net_bind_service=+ep' /usr/bin/python3
  

• Restrict file permissions: Ensure your server's code, certificate, and key files are only readable/writable by the user running the daemon.

内容的提问来源于stack exchange，提问作者kevdliu