当无法选择 HTTPS 时，通过 HTTP 进行安全数据传输
我想编写一个应用程序来管理数百台远程 PC 上的文件、目录和进程。这些机器上运行着测量程序，目前使用 TightVNC / RealVNC 手动管理。由于机器数量很大（并且还在增加），因此需要自动管理。我们的计划是，我们的操作员将获得一个可编写脚本的客户端应用程序，他们可以通过该应用程序向每台远程 PC 上运行的服务器应用程序发送查询和命令。
对于通信，我想使用基于 TCP 的自定义协议，但它在管理上很复杂，并且需要很长时间才能在每个防火墙上打开针孔。幸运的是，有一个程序内置了基于 TinyWeb 的自定义 Web 服务器，在每台远程 PC 上运行，并且每个防火墙都打开了端口 80。这些 Web 服务器通过启动 CGI 程序来服务来自中央服务器的请求，该程序加载并发送回测量程序的部分日志文件。
因此计划编写一个CGI 程序，并通过HTTP（使用GET 和POST）与客户端进行通信。尽管（大多数）远程 PC 位于公司内网内，但它们分散在全国各地，我希望确保通信安全。以纯文本形式发送操作文件和进程的命令是不明智的。 不幸的是，包含Web服务器的程序无法被触及，所以我不能简单地将其准备为HTTPS。我只能在客户端和CGI程序中实现安全层。我应该做什么？
我已阅读 SO 中的所有类似问题，但我仍然不确定在这种特定情况下该怎么做。感谢您的帮助。
I would like to write an application to manage files, directories and processes on hundreds of remote PCs. There are measurement programs running on these machines, which are currently managed manually using TightVNC / RealVNC. Since the number of machines is large (and increasing) there is a need for automatic management. The plan is that our operators would get a scriptable client application, from which they could send queries and commands to server applications running on each remote PC.
For the communication, I would like to use a TCP-based custom protocol, but it is administratively complicated and would take very long to open pinholes in every firewall in the way. Fortunately, there is a program with a built-in TinyWeb-based custom web server running on every remote PC, and port 80 is opened in every firewall. These web servers serve requests coming from a central server, by starting a CGI program, which loads and sends back parts of the log files of measurement programs.
So the plan is to write a CGI program, and communicate with it from the clients through HTTP (using GET and POST). Although (most of) the remote PCs are inside the corporate intranet, they are scattered all over the country, I would like to secure the communication. It would not be wise to send commands, which manipulate files and processes, in plain text. Unfortunately the program which contains the web server cannot be touched, so I cannot simply prepare it for HTTPS. I can only implement the security layer in the client and in the CGI program. What should I do?
I have read all similar questions in SO, but I am still not sure what to do in this specific situation. Thank you for your help.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
有几个 webshell，但据我所知（ http://www- Personal.umich.edu/~mressl/webshell/features.html ）它们运行在现有 SSL/TLS 层的顶部。
还有S-HTTP。
有多种方法可以在不使用 SSL 的情况下以受保护的方式对服务器进行身份验证（用户名/密码）。 http://www.switchonthecode.com/tutorials/secure-authentication -without-ssl-using-javascript 。但这些解决方案仅专注于向服务器发送用户名/密码。
There are several webshells but as far as I can see ( http://www-personal.umich.edu/~mressl/webshell/features.html ) they run on the top of an existing SSL/TLS layer.
There is also S-HTTP.
There are several ways of authenticating to an server (username/passwort) in a protected way, without SSL. http://www.switchonthecode.com/tutorials/secure-authentication-without-ssl-using-javascript . But these solutions are focused only on sending a username/password to the server.
是否有可能在 SOAP/WS-Security 中实现消息级安全性之类的东西？我意识到这可能有点繁重并且实现起来很复杂，但至少它是
Would it be possible to implement something like message-level security in SOAP/WS-Security? I realise this might be a bit heavy duty and complicated to implement, but at least it is