2

QGIS is the main GIS application used at my workplace. Access to the plugin repository has recently been removed due to a perceived security risk relating to the way QGIS stores proxy settings, including user passwords, as below (from the QGIS configuration page).

enter image description here

Is there a way to stop QGIS from saving and retaining records of these details, and instead requiring users to enter them each time they access plugin repositories?

3 Answers 3

5

In QGIS 2.14 an authentication system support for the plugin manager has been addded, maybe that's what you're looking for.

You can access the feature by going to Plugins > Manage and install plugins > Settings. When you select a repository you can use the edit button to open its settings, therunder you can find the new entry for authentication.

4
  • Thanks for your answer. I'm still not entirely sure how this works though. I gather that via the authentication settings you can now set a master password which isn't saved after the session ends. If you need to access repositories via an http proxy due to network setup though, are these settings still saved? Maybe I'm missing something obvious here! Mar 17, 2016 at 10:29
  • Unfortunately I also haven't worked with it before since it is a completely new feature of 2.14. Maybe there will be further information about it in the internet in the near future.
    – TobsenB
    Mar 17, 2016 at 10:36
  • with new qgis auth the only think saved in prj or registry is a unique id used to access credentials in the qgis-auth.db (that is protected by a master pwd). Mar 20, 2016 at 15:17
  • In this moment auth syustem is till not fully integrated with the base qgis network classes (QgsNetworkAccessManager) that can manage also proxy settings... this is a planned work. Mar 20, 2016 at 15:19
3

If this is the issue in qgis where it stores the users network details in text in the registry then yes it is a security issue but only if you are on a secure network like a council government or large developer. Not a problem for most of us though. Qgis really should encrypt this info as that is the basic for most apps. Other posts say they fixed this in 2.12 but that is not correct. Still does it in 2.14. Checked mine just now.

1
  • Yes, it's a secure network. It would be great if this could be addressed. Mar 17, 2016 at 19:47
1

if your proxy requires authentication and this is the case in most secure networks then you cannot access any internet resources via qgis as the program stores your username and password in plain text which anyone can access. as most secure networks use some form of passthrough authentication for internet access then this username and password will be the same one you probably log onto your work computer with. you might as well write your username and password on a note and stick it on the side of your screen. this has been raised before and there is no interest in providing basic encryption for password storage in qgis. see this post here for some more info on poor password security used by qgis. https://hub.qgis.org/issues/8180 http://lists.osgeo.org/pipermail/qgis-user/2012-February/015555.html

5
  • "Qgisguru": Are you from my IT department by any chance?? Mar 18, 2016 at 6:03
  • if your name is Anthony and you are my husband then yes I am your it department. I work for developers local governments and architects in Canada UK and some others but live in New Zealand. I don't have to worry about the problems you seem to have as my network is 2 computers and a printer. You know you can get your IT people to set up a plugin repository on your own network. Did that for some people here once with the same proxy password problem. it is not very hard and there are instructions on the forums. good luck
    – qgisguru
    Mar 18, 2016 at 7:30
  • This should be a comment on the other answer, not an answer in itself. Mar 18, 2016 at 7:36
  • It looks like you have created two accounts. Please merge this one (gis.stackexchange.com/users/69516/qgisguru), with gis.stackexchange.com/users/69466/qgisguru, using these instructions ASAP: gis.stackexchange.com/help/merging-accounts
    – PolyGeo
    Mar 18, 2016 at 7:56
  • Sorry, wrong person! Looks like a network repository is the only solution for now. Thanks for your input. Mar 18, 2016 at 7:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.