Arduino Yun and REST call security

Question

I'm not expert about web development but very excited of doing some rest call using the yun as server (with a minimal python or node.js server inside the openwrt machine in the yun) and expose sensors and actuators to the cloud.

I'm also worried about security. I don't want the super-shellproof system but just don't want that accidental visitors reads my home temperature or make my garden light switch on when I'm out.

For instance I have a central unit yun with some logic inside it and few arduino yun that makes reads from sensors and runs actuators around my home. The communication between the central yun and the slaves is happening via REST calls. I'm using curl for testing it, for instance. Here two questions:

1. Arduino Yun provide a simple user/password account when arduinoname.local/arduino is called. How is it implemented?

2. Let's say I'm using node.js to make a super simple web-server, what is the best way to protect the communication central-yun and slave-yun? and to protect central-gun and internet communication?

Best way in term of computation (the yun machine is not very powerful and I'm going to use battery in some cases) and in term of "easy to implement".

Answer 1

Password protection of the REST API is done with Basic Authentication. This, coupled with HTTPS, makes API calls more secure. Since the SSL certificate is self-generated, you'll need to run curl with -k parameter.

As Annonomus Penguin suggested, before going into securing the Yuns, you should secure the network they are using (e.g.: home WiFi should use a strong password).