Encrypted Config file API Service

This project implements a secure, encrypted API service using CherryPy and Python. The API allows clients to securely interact with config files. It supports reading, writing and modifying content. Complete files or sections / topics from the files. The service supports creating backup copies before every modifying action. The service employs JWE (JSON Web Encryption) tokens for authentication, along with ECC (Elliptic Curve Cryptography) for key exchange and AES for encrypting request and response bodies.

I strongly recomend running this behind reverse proxy (like nginx) that provides TLS communication between the server and client.

Features

JWE Token Authentication: The service uses encrypted JWE tokens for authentication and key exchange.
ECC for Key Exchange: The client encrypts a symmetric key using the server’s ECC public key, which is used for AES encryption/decryption.
AES Encryption: Both request and response bodies are encrypted using AES with a single use symmetric key, ensuring data confidentiality.
Config File Handling: Supports reading, writing, and updating config files. Initially designed for WireGuard configs but easily extendable to any config format.
POST-Only API: The API only accepts POST requests for all interactions.
Single API Endpoint: The entire service operates through a single endpoint, keeping the API interface minimal and clean.

Requirements

Python 3.11+
CherryPy
cryptography
requests

Some controllers (file handlers) may have other dependencies.

Config

config.toml

The config.toml file is used to configure the server, logging, and the paths to the config files. Here’s a sample configuration:

[server]
host = "0.0.0.0"
port = 8000
base_url = '/'

[logging]
log_file = "service.log"
debug = true

[files]
wireguard_wg0 = ["/etc/wireguard/wg0.conf", backup=true]

[client_keys]
public_key = """
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA.....
-----END PUBLIC KEY-----
"""

server: Defines the host, port and the url where the service will run.
logging: Configures the log file location and debug mode.
files: Key/[value] list of config files and their settings.
client_keys.public_key: The client’s ECC public key (used for verifying signatures and decrypting data).

Ensure the config.toml is in the same directory as your application.

Sending Requests

All API requests must be sent as POST requests with an encrypted body. The encryption key is exchanged using the ECC-based JWE token provided in the Authorization header.

Headers:

Authorization: Must contain the JWE token in the format Bearer <token>.

Request Body:

The body of the request must be encrypted using AES, with the symmetric key 
provided inside the JWE token.

Reading a config file:

{
  "action": "read_file",
  "file": "wireguard_wg0"
}

Writing to a config file:

{
  "action": "write_file",
  "file": "wireguard_wg0",
  "data": {
    [Interface]
    PrivateKey = PrivateKey123=
    Address = 10.10.200.1/32
    ListenPort = 51820

    [Peer]
    PublicKey = PublicKey123=
    AllowedIPs = 10.10.200.2/32
    }
  }
}

Response Structure Details

Response is json document like:

{
  "data": "<encrypted_data>",
  "signature": "<base64-encoded signature>"
}

The decrypted data could look like this:

{
  "status": 200,
  "timestamp": "2024-10-22T10:30:00Z",
  "message": "File written successfully"
}

Error Handling

400 Bad Request: Returned if the request is malformed or the token is invalid.
401 Unauthorized: If the Authorization header or the JWE token is missing or invalid.
403 Forbidden: If the signature validation fails.
500 Internal Server Error: For unexpected errors in processing the request.

4.0 KiB Raw Permalink Blame History Unescape Escape