[pbs-devel] [PATCH backup/proxmox-backup 0/4] fix #5463: add optional consent banner before login

[Dominik Csapak]

On 5/22/24 17:31, Thomas Lamprecht wrote:
> Am 22/05/2024 um 15:19 schrieb Gabriel Goller:
>> This has been requested many times already for all products. To keep
>> it simple as it's still quite a niche feature, works with a single file:
>> /etc/proxmox-backup/consent.txt. If the file exists and is not empty,
>> a consent banner will be shown in front of the login view.
>>
>> This is just a reference implementation for pbs to get some feedback
>> and check if my general approach is alright. The same implementation
>> will then be ported to pve and eventually pmg.
>>
>> Another disclaimer: IANAL (I am not a lawyer :) ), so the wording is
>> probably off.
> 
> A few general questions for you and/or the original requester of this
> feature:
> 
> This is currently still missing any actual barrier as it's all frontend,
> shouldn't there be a cookie that is checked on the backend side if a
> consent.txt exist? If this specific consent type (RMF AC-8 for US gov)
> doesn't need that, it might be worth to replace the generic text box
> with a type selection for that, we could always add a "custom" type
> that takes a generic text and extent that with an option about how
> strict it should be checked, if we get this now.

when checking https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-8/
(not the "official" document, but very close , the original can be downloaded
in docx form here: 
https://csrc.nist.rip/projects/risk-management/about-rmf/assess-step/assessment-cases-download-page) 
it does not seem to be necessary for any cookie handling
since it just wants the disclaimer to be displayed before login

> 
> And how should API calls made using API tokens get handled, should they
> have a header signalling consent or not? If, should there be a set of
> standard consents that one can explicitly consent too? As a blanket
> consent to an unknown text would not be of much use.


also it says that this is only for human interaction, so any api
access etc. is exempt IIUC

> 
> I'd in any way limit the length of the consent text to a relatively
> high boundary, like 10 KiB.
> 
> Did you think about interpreting and rendering this as Markdown?
> 
> Did you check if there already exist (FLOSS) proxies that implement
> this functionality by placing it between the user and any HTTP served
> page/tool/ui, as that would not require us to do anything at all
> (well, besides documenting it).
> 
> 
> _______________________________________________
> pbs-devel mailing list
> pbs-devel at lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel
> 
>