Satis http basic auth - pass credentials

Question

I have set up satis private composer packet manager. Satis is running on "packages.asc.company", I protected the site by apache2 http basic authentication and can open it in browser by entering http basic auth credentials.

Now my question: How can I pass composer the credentials to access the satis site in the best and most secure manner when running e.g. "composer update"?

Currently I registered only one user with a password in apache .htpasswd file and need to pass its credentials somewhere to be able to connect from composer to satis.

There are two cases where I need to connect from:

1) From the project during development

2) From jenkins during continuous integration process.

---

3) Edit: SSL

I am trying to use openssl now to secure the credentials when logging in. On my linux, where the apache runs, I created a private key and a .crt file (see: Apache SSL . On my linux, I can now open the satis packages page with https, and I even redirect http to https, all working (Im using my own certificate generating with openssl because its an internal application and I don't need a trusted ca).

Now, when I switch to my Windows from my Linux vm (here I am coding), and I try to run composer update, I get the following error message: (hosts file is configured correct)

[Composer\Downloader\TransportException] The "https://packages.asc.company/packages.json" file could not be downloaded: SSL operation failed with code 1. OpenSSL Error messages: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Failed to enable crypto failed to open stream: operation failed

What did I miss? I'm pretty new to ssl, but read the whole day now information about it and can't get it to work.

From getcomposer satis site, I have this information but don't know how to use it.

{
 "repositories": [
    {
        "type": "composer",
        "url": "https://example.org",
        "options": {
            "ssl": {
                "local_cert": "/home/composer/.ssl/composer.pem"
            }
        }
    }
 ]
}

Regards.

Answer 1

There is a documentation page for this.

Composer will work with adding user names into the Satis URL. Works for me, I just wanted to get around the useless default passworded server in the local network. There's a read only account, and I used it.

Additionally: Every developer in the company has an account on the repository server, and there isn't much use in protecting downloaded ZIP files with even more security. Composer itself currently doesn't support any code signing methods or hash comparison, so there is no way to know if a package has been tampered with either where stored or during transmission.

According to the docs, not giving credentials in the URL will make Composer ask for them, or you can add them to auth.json. On the other hand: Saving clear text passwords in a dedicated file doesn't sound like the best idea, and transmitting them without using HTTPS is even worse.

You have to define what kind of security you want to have. What is the goal or the threat scenario you want to protect against?