Security: Domain-Server WebUI is unsecure by default

[JulianGro]

The Domain-Servers WebUI does not ask you to set a password and gives you no indication that it is open to everyone on the internet. It should not allow you to continue without a password unless you really know what you are doing. (closed the port to the outside) In theory we could also check to see that the port is closed to the Internet.

[two-one-five]

The proper place to handle this would be in the wizard, however we should also add to the docs a short tutorial on how to force a password reset (even if that means deleting your server settings/content) in the event that you forgot your password or set the wrong one by mistake.

Edit: it appears the docs does have password reset information in it.

[daleglass]

My suggestion is that on the first startup, the server should generate a random password, store it somewhere (like a file) and require the user to get it from there. This way there's never a moment where the access is open to all.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale]

Hello! Is this still an issue?

[digisomni]

This does not get solved by #1429 but it's a start.

[digisomni]

Whoops, I misread (thinking SSL vs password.)