Security Notes¶
Authentication¶
The License Key Server uses HTTP basic authentication via express-basic-auth. Every request — including the web UI — requires a valid username and password. The browser's native login dialog handles this.
Credentials are passed to the server as environment variables (AUTH_USER, AUTH_PASS) when PM2 starts the process. They are never stored in files on disk.
Important: Over plain HTTP (port 80), the username and password are transmitted in base64 — which is not encrypted. Anyone who can intercept network traffic between your browser and the server can read the credentials. Set up HTTPS (see Deployment — HTTPS) before accessing the server over the public internet.
Key encoding¶
Keys use a cyclic XOR cipher with a hardcoded secret (ViciCalibGuard2024), then base64-encode the result. This is not cryptographic — it is obfuscation, not encryption. The purpose is to prevent casual users from reading or guessing the validity window, not to resist a determined attacker who has access to the source code.
What this protects against: - Operators who receive a key and try to manually modify the dates - Simple brute-force attempts to guess a valid key string
What this does NOT protect against:
- Anyone with access to src/license.js or license-server/server.js (the secret is in plaintext in the source)
- Replay attacks — a key that was valid once remains valid for its full date range
The shared secret¶
The same secret is used in two places:
- calibration-guard/src/license.js (validation on the machine)
- license-server/server.js (generation in the server)
Both must use the same secret or keys won't validate. If you rotate the secret, you must redeploy both the guard (rebuild guard.exe and redistribute the VIA Onboard installer) and the server.
To rotate the secret: change the SECRET constant in both files, rebuild guard.exe, and redistribute.
Rotating the secret invalidates all outstanding keys
All previously issued keys will be rejected by the guard after a secret rotation. Customers with valid licenses will lose access until they are issued new keys.
EC2 security group¶
The EC2 security group should be as restrictive as possible:
| Rule | Recommended |
|---|---|
| SSH (port 22) | Your IP only — not 0.0.0.0/0 |
| HTTP (port 80) | ViciVision office IP range only, or VPN |
| HTTPS (port 443) | ViciVision office IP range only, or VPN |
Avoid exposing the server on 0.0.0.0/0 unless you have HTTPS and strong credentials in place.
Credential rotation¶
To change the server password:
pm2 stop calibguard
PORT=80 AUTH_USER=admin AUTH_PASS=newStrongPassword pm2 start server.js --name calibguard
pm2 save
Rotate credentials if: - A staff member with access leaves the organization - You suspect the credentials were exposed - As part of regular security hygiene (recommended every 6–12 months)
No key storage¶
The server generates keys on the fly and does not store them. There is no database, no audit log of generated keys, and no way to revoke a specific key without rotating the shared secret. Design your key distribution process with this in mind:
- Keep a manual log of who you issued keys to and for what date range.
- For high-security environments, prefer shorter date-range keys over permanent keys.
- If a key is compromised, rotate the secret and reissue keys to all legitimate holders.