'; } // no Mysql as a backend. not enough RAM. // if you embed images (that means don't embed images) or other stuff, make sure you tell it to use //, not //http:// or https:// I'll force HTTPS on the webserver // We will be releasing this as open source, and I'll get a git repo setup and stuff once you get some //workingish code stuck together. // basically what I need for each function of the site is this: // User submits a request. // script recognizes request as some function. // (define a function or smth for a request) // script executes function, in which it will output some kind of text (like a login page or a link to a //key, handled by a separate script that checks the user's POST data, or the admin part's functions) and //STORES IT IN A VARIABLE. // script THEN takes genHtml($body);'s output, where $body is whatever the function's output was // and prints the return of that. // I'd like it all to be in one script, but if you don't like that, sure split it. // Make the genHtml(); function available in a config script or something. // Here's our conversation from IRC, just so it's written and saved somewhere we don't have to sift through logs in // <&DJ_Arghlex> so I was thinking I A) //<&DJ_Arghlex> have a set of functions that sha256 (or something) the user and pass together //<&DJ_Arghlex> and use that as a GET login token //<%ReimuHakurei> are you using user/pass //<%ReimuHakurei> or keys //<%ReimuHakurei> are you having one salt or two //<&DJ_Arghlex> user/pass so that people can download their keys //<%ReimuHakurei> ohh //<%ReimuHakurei> DJ_Arghlex, don't just use one token //<%ReimuHakurei> i'd do something like //<%ReimuHakurei> have some salts in a config file //<%ReimuHakurei> so say //<&DJ_Arghlex> k just hold up //<&DJ_Arghlex> listen //<%ReimuHakurei> $SALT1 = "CHANGEME1" //<%ReimuHakurei> ...k //<&DJ_Arghlex> then present //<&DJ_Arghlex> so let's say a user connects //<&DJ_Arghlex> er //<&DJ_Arghlex> registers to the webserver thing //<&DJ_Arghlex> they use a username like client-uno and a pass like testpass //<&DJ_Arghlex> the keys and stuff are stored outside the webserver's directory //<&DJ_Arghlex> now I login //<&DJ_Arghlex> and the script says "hey! you've got new registered users! give them a key? y/n" //<&DJ_Arghlex> s/a key/keys //<%ReimuHakurei> not automatic? //<&DJ_Arghlex> hell no //<%ReimuHakurei> are they payign for it? //<&DJ_Arghlex> I want to make sure I'm not giving an attacker a VPN key //<%ReimuHakurei> oh //<%ReimuHakurei> lol //<&DJ_Arghlex> anyways I give them a key using a script I have setup already, or just have a separate RSA directory that rsyncs them or something //<&DJ_Arghlex> easy-rsa* //<&DJ_Arghlex> or I deny them a key //<%ReimuHakurei> DJ_Arghlex, give em a whole config //<&DJ_Arghlex> yes //<&DJ_Arghlex> I know //<%ReimuHakurei> you can embed keys in a config file //<&DJ_Arghlex> that shit's handled //<%ReimuHakurei> also why not just have php gen the key? //<%ReimuHakurei> why manually do it //<%ReimuHakurei> php gens the key and just marks the account awaiting approval //<&DJ_Arghlex> anyway the denied user's account locked //<&DJ_Arghlex> and they can't login or grab keys, but they're kept in the database //<&DJ_Arghlex> because if we just delete the account they'll just go grab another //<%ReimuHakurei> locked //<%ReimuHakurei> as in banned? //<&DJ_Arghlex> yes //<&DJ_Arghlex> essentially //<%ReimuHakurei> will there be payment integrated into the site? //<&DJ_Arghlex> no //<%ReimuHakurei> how often will keys expire? //<&DJ_Arghlex> but I would like to setup invite codes //<%ReimuHakurei> for an invite link //<&DJ_Arghlex> no //<%ReimuHakurei> or code //<%ReimuHakurei> i'd go ahead and have uh //<&DJ_Arghlex> like as you register you input a key I email you //<%ReimuHakurei> ohh //<%ReimuHakurei> who will this portal be for? //<&DJ_Arghlex> us //<&DJ_Arghlex> StormBit's VPN service //<%ReimuHakurei> ah //<%ReimuHakurei> oh //<&DJ_Arghlex> I've been working on the under-the-hood stuff loads //<%ReimuHakurei> what do you have of that? //<&DJ_Arghlex> the user generation and revocation of keys //<&DJ_Arghlex> server configs //<&DJ_Arghlex> routing //<%ReimuHakurei> ah //<%ReimuHakurei> what does the panel need to do //<%ReimuHakurei> and in what way will it interface with the other stuff //<&DJ_Arghlex> exec() plus sanitization //<%ReimuHakurei> that's easy enough //* %ReimuHakurei mkdir stormvpn //<&DJ_Arghlex> and as a template //* &DJ_Arghlex puush ?>