Going back to basic authentication for console/shell commands

This does not affect security because:
- it is going to localhost only
- only users who have already access to the pw hash can do this
- no clear text pw is transmitted because that is not stored anywhere
The switch to basic is required because these commands are required
in the context of hosting on root servers and docker containers
where a password change must be done. But the password shell command
was not working without password which made the concept unusable.
This deficit made it virtually impossible for root server operators
to use YaCy because they had been unable to set up a proper password.

7 files changed, 17 insertions, 16 deletions

diff --git a/bin/apicall.sh b/bin/apicall.sh
index bfdcbc680..9f9ad70b5 100755
--- a/bin/apicall.sh
+++ b/bin/apicall.sh
@@ -21,10 +21,11 @@ port=$(grep ^port= "$YACY_DATA_PATH/SETTINGS/yacy.conf" |cut -d= -f2)
 admin=$(grep ^adminAccountUserName= "$YACY_DATA_PATH/SETTINGS/yacy.conf" |cut -d= -f2)
 adminAccountForLocalhost=$(grep ^adminAccountForLocalhost= "$YACY_DATA_PATH/SETTINGS/yacy.conf" | cut -d= -f2)
 
-if grep "<auth-method>BASIC</auth-method>" "$YACY_APP_PATH/defaults/web.xml" > /dev/null; then
-	# When authentication method is in basic mode, use directly the password hash from the configuration file 
-	YACY_ADMIN_PASSWORD=$(grep ^adminAccountBase64MD5= "$YACY_DATA_PATH/SETTINGS/yacy.conf" |cut -d= -f2)
-fi
+# Use directly the password hash from the configuration file. This is accepted as PW when the call comes from localhost.
+# This exception in authorization handling makes it possible that users with access to the YaCy configuration files can administrate
+# a peer without manual authentication input. This works only with Basic auth method.
+# This is not a huge security problem because the target address is always localhost.
+YACY_ADMIN_PASSWORD=$(grep ^adminAccountBase64MD5= "$YACY_DATA_PATH/SETTINGS/yacy.conf" |cut -d= -f2)
 
 if which curl > /dev/null; then
 	if [ "$adminAccountForLocalhost" = "true" ]; then
@@ -32,21 +33,21 @@ if which curl > /dev/null; then
 		curl -sSf "http://127.0.0.1:$port/$1"
 	elif [ -n "$YACY_ADMIN_PASSWORD" ]; then
 		# admin password is provided as environment variable : let's use it
-		curl -sSf --anyauth -u "$admin:$YACY_ADMIN_PASSWORD" "http://127.0.0.1:$port/$1"
+		curl -sSf --basic -u "$admin:$YACY_ADMIN_PASSWORD" "http://127.0.0.1:$port/$1"
 	else
 		# no password environment variable : it will be asked interactively
-		curl -sSf --anyauth -u "$admin" "http://127.0.0.1:$port/$1"
+		curl -sSf --basic -u "$admin" "http://127.0.0.1:$port/$1"
 	fi
 elif which wget > /dev/null; then
 	if [ "$adminAccountForLocalhost" = "true" ]; then
 		# localhost access as administrator without authentication is enabled
-		wget -nv -t 1 --timeout=120 "http://127.0.0.1:$port/$1" -O -
+		wget -nv --auth-no-challenge -t 1 --timeout=120 "http://127.0.0.1:$port/$1" -O -
 	elif [ -n "$YACY_ADMIN_PASSWORD" ]; then
 		# admin password is provided as environment variable : let's use it
-		wget -nv -t 1 --timeout=120 --http-user "$admin" --http-password "$YACY_ADMIN_PASSWORD" "http://127.0.0.1:$port/$1" -O -
+		wget -nv --auth-no-challenge -t 1 --timeout=120 --http-user "$admin" --http-password "$YACY_ADMIN_PASSWORD" "http://127.0.0.1:$port/$1" -O -
 	else
 		# no password environment variable : it will be asked interactively
-		wget -nv -t 1 --timeout=120 --http-user "$admin" --ask-password "http://127.0.0.1:$port/$1" -O -
+		wget -nv --auth-no-challenge -t 1 --timeout=120 --http-user "$admin" --ask-password "http://127.0.0.1:$port/$1" -O -
 	fi
 else
 	echo "Please install curl or wget" > /dev/stderr
diff --git a/bin/clearall.sh b/bin/clearall.sh
index 885379c9c..2f157f6a9 100755
--- a/bin/clearall.sh
+++ b/bin/clearall.sh
@@ -1,3 +1,3 @@
 #!/usr/bin/env sh
 cd "`dirname $0`"
-./protectedPostApiCall.sh "IndexControlURLs_p.html" "deletecomplete=&deleteIndex=on&deleteSolr=on&deleteCrawlQueues=on&deleteRobots=on&deleteSearchFl=on&deleteCache=on"
\ No newline at end of file
+./apicall.sh "IndexControlURLs_p.html" "deletecomplete=&deleteIndex=on&deleteSolr=on&deleteCrawlQueues=on&deleteRobots=on&deleteSearchFl=on&deleteCache=on" > /dev/null
diff --git a/bin/clearcache.sh b/bin/clearcache.sh
index 926d70e78..97de5f40e 100755
--- a/bin/clearcache.sh
+++ b/bin/clearcache.sh
@@ -1,3 +1,3 @@
 #!/usr/bin/env sh
 cd "`dirname $0`"
-./protectedPostApiCall.sh "IndexControlURLs_p.html" "deleteIndex=off&deleteSolr=off&deleteCache=on&deleteCrawlQueues=off&deleteRobots=on&deleteSearchFl=on&deletecomplete="
+./apicall.sh "IndexControlURLs_p.html" "deleteIndex=off&deleteSolr=off&deleteCache=on&deleteCrawlQueues=off&deleteRobots=on&deleteSearchFl=on&deletecomplete=" > /dev/null
diff --git a/bin/clearindex.sh b/bin/clearindex.sh
index 9c78bb997..773bb824b 100755
--- a/bin/clearindex.sh
+++ b/bin/clearindex.sh
@@ -1,3 +1,3 @@
 #!/usr/bin/env sh
 cd "`dirname $0`"
-./protectedPostApiCall.sh "IndexControlURLs_p.html" "deletecomplete=&deleteIndex=on&deleteSolr=on&deleteCrawlQueues=on&deleteRobots=on&deleteSearchFl=on&deleteCache=off"
+./apicall.sh "IndexControlURLs_p.html" "deletecomplete=&deleteIndex=on&deleteSolr=on&deleteCrawlQueues=on&deleteRobots=on&deleteSearchFl=on&deleteCache=off" > /dev/null
diff --git a/bin/deleteurl.sh b/bin/deleteurl.sh
index 94aefcfb3..e5cb00da3 100755
--- a/bin/deleteurl.sh
+++ b/bin/deleteurl.sh
@@ -1,3 +1,3 @@
 #!/usr/bin/env sh
 cd "`dirname $0`"
-./protectedPostApiCall.sh "IndexControlURLs_p.html" "urlhashdeleteall=&urlstring=$1"
+./apicall.sh "IndexControlURLs_p.html" "urlhashdeleteall=&urlstring=$1" > /dev/null
diff --git a/bin/importmediawiki.sh b/bin/importmediawiki.sh
index df1b4c7ae..7f5e829f8 100755
--- a/bin/importmediawiki.sh
+++ b/bin/importmediawiki.sh
@@ -1,3 +1,3 @@
 #!/usr/bin/env sh
 cd "`dirname $0`"
-./protectedPostApiCall.sh "IndexImportMediawiki_p.html" "file=$1"
+./apicall.sh "IndexImportMediawiki_p.html" "file=$1" > /dev/null
diff --git a/bin/passwd.sh b/bin/passwd.sh
index b858929a1..770429b18 100755
--- a/bin/passwd.sh
+++ b/bin/passwd.sh
@@ -38,7 +38,7 @@ if [ -f "$YACY_DATA_PATH/yacy.running" ]; then
 	echo "YaCy server appears to be running. Calling the ConfigAccounts_p API..." 
 	# When the server is running we can not directly modify the yacy.conf file so we use the ConfigAccounts_p API.
 	# Otherwise the new password provided here could be overwritten by the server when it saves its in-memory configuration to the yacy.conf file 
-	(./protectedPostApiCall.sh "ConfigAccounts_p.html" "setAdmin=&adminuser=$YACY_ADMIN_USER_NAME&adminpw1=$YACY_ADMIN_PASSWORD&adminpw2=$YACY_ADMIN_PASSWORD&access=" && \
+	(./apicall.sh "ConfigAccounts_p.html" "setAdmin=&adminuser=$YACY_ADMIN_USER_NAME&adminpw1=$YACY_ADMIN_PASSWORD&adminpw2=$YACY_ADMIN_PASSWORD&access=" && \
 	echo "Password successfully changed for User Name '$YACY_ADMIN_USER_NAME'.") || \
 	(echo "Password setting failed." && exit 1)
 else
@@ -54,4 +54,4 @@ else
 	 mv "$YACY_CONF_FILE".tmp "$YACY_CONF_FILE" && \
 	echo "Password successfully changed for User Name '$YACY_ADMIN_USER_NAME'.") || \
 	(echo "Password setting failed." && exit 1)
-fi
\ No newline at end of file
+fi