CGI SDK no longer functioning on 17r?

[suspectdevice]

Same issue here. The digest auth update breaks the integration with my Vera home automation system. The authentication mode should be a switchable user-setting in the management interface, in my opinion.

On a related note, anonymous access apparently does not work or apply to cgi calls, so I'm fully blocked by this issue and planning to return this just-purchased Amcrest to Amazon in exchange for something that works as it should, along with a very negative review. I was planning to buy a number of these for my properties. Guess someone else will be getting my $$.

[Melvin]

Hello all,

The basic authentication was removed because of security concerns.

[Gilley7997]

But it wasn't removed, the current version of the documentation still says both are supported.

Every version of the API documentation that was provided to me, still says both methods are supported.
From the API Documentation:

3.5 Authentication
Video products support either basic authentication or digest authentication.

This was never in any of the firmware notes that this was being removed. This is a pretty massive change that I would have expected to be documented.

On top of the fact that basic auth still does work, just inconsistantly at best.

Digest Authentication also does not work, as I tried to convert my scripts to that at one point as well, and the camera would respond with a basic auth response.

Melvin,

This answer is not acceptable and I don't believe to be correct. Please escalate this, or you will be receiving requests for many refunds for this camera as this is a standard protocol that many software products depend on.

[msplain5880]

I opened a new ticket with Amcrest support re: the July 11 comment. They confirmed that support for basic authentication has been removed from the recent firmware releases. From their perspective this isn't a bug, it is a new feature which enhances security. They were not able to comment on if/when the capability might be restored. The tone of the response lead me to conclude this won't happen soon, if ever.

I explained that this left me dead in the water since my application isn't able to use digest authentication. I was told they understand this will create difficulties for some customers. I asked about refunds and was told I could try to use the form at https://amcrest.com/rma to request them. I am not optimistic this will get me anywhere but I figured I would try it anyway.

I also explained that there was no mention of the feature being removed in the SDK documentation or firmware release notes. No explanation was provided.

Next stop will be amazon to post a review to educate future camera purchasers.

Time to find a new camera supplier. Too bad because until this change I was generally impressed with Amcrest equipment.

[heardcwayne]

Amcrest!

Please fix the problem of digest authentication only. Those of us building home automation systems need basic authentication brought back or we will be looking elsewhere for other products, like D-Link, Foscam etc.

[t0n3]

Does anyone have a working example of how to use digest authentication with an Amcrest camera? My attempts in curl, postman haven't worked. thanks!

[eagleco]

I'd also like to chime in that this is a dealbreaker for me buying any more amcrest cameras. Just upgraded one of mine without knowing about this issue until it broke all the integrations with my home automation system (ISY). Won't be upgrading the firmware on any others until/if this is resolved.

I understand the security implications but there should be an option in the UI to allow basic auth or not. Make it off by default but give us the option to turn it on please!

[t0n3]

Does anyone have a working example of how to use digest authentication with an Amcrest camera? My attempts in curl, postman haven't worked. thanks!

I figured this out, so here's my examples that will hopefully help other people trying to use DIGEST AUTH.
using command line curl to grab a jpg snapshot...

Code: Select all

 curl --digest -u myusername:mypassword http://mycamname.amcrestddns.com/cgi-bin/snapshot.cgi -o snapshop.jpg

and using php to grab a snapshot.

Code: Select all

    $url = "http://mycamname.amcrestddns.com/cgi-bin/snapshot.cgi"; //change this to your url!

    $ch = curl_init ($url);

    curl_setopt($ch, CURLOPT_HEADER, 0);

    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

    curl_setopt($ch, CURLOPT_BINARYTRANSFER,1);

    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); //this can be true if you use a real ssl cert

    curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_DIGEST);

    curl_setopt($ch, CURLOPT_USERPWD, "myusername:mypassword"); //change this to your credentials!



    $raw=curl_exec($ch);

    $rescode = curl_getinfo($ch, CURLINFO_HTTP_CODE);

    curl_close ($ch);

    if($rescode != "200"){

        echo $rescode;

    } else {

        header("Content-Type: image/jpeg");

        header("Cache-Control: no-store, no-cache, must-revalidate, max-age=0");

        header("Cache-Control: post-check=0, pre-check=0", false);

        header("Pragma: no-cache");

    	echo $raw;

    }

I completely agree that it's bad customer service to remove BASIC auth without warning or mention in any changelog, DIGEST auth does seem to be working reliably on both my IP2M-841W and IP4M-1028W.

[t0n3]

I'd also like to chime in that this is a dealbreaker for me buying any more amcrest cameras. Just upgraded one of mine without knowing about this issue until it broke all the integrations with my home automation system (ISY). Won't be upgrading the firmware on any others until/if this is resolved.

I understand the security implications but there should be an option in the UI to allow basic auth or not. Make it off by default but give us the option to turn it on please!

I agree that this should be a checkbox in the admin UI whether or not to allow BASIC auth.

As it is, even though I was able to get DIGEST working, it severely limits the ability to use the Amcrest camera stand-alone without using an intermediary server to do the digest authentication/proxy requests.

[jamestx10]

I figured this out, so here's my examples that will hopefully help other people trying to use DIGEST AUTH.
using command line curl to grab a jpg snapshot...

I am trying to get this working. I know nothing about PHP though so that does not help. I found an example that I can get working with a foscam. If I save the below code as cam.php and load it I get a snapshot in the browser.

Code: Select all

<?php

 error_reporting(E_ALL);

 $img="http://CAMIP:CAMPORT/CGIProxy.fcgi?cmd=snapPicture2&usr=USERNAME&pwd=PASSWORD&t="; 

 header ('content-type: image/jpeg');

 readfile($img); 

?> 

I am now trying to use your code to access the amcrest cam without luck so far. If I save the below code as cam.php and load it I get a blank page.

Code: Select all

<?php

$url = "http://10.10.10.35/cgi-bin/snapshot.cgi"; //change this to your url!

    $ch = curl_init ($url);

    curl_setopt($ch, CURLOPT_HEADER, 0);

    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

    curl_setopt($ch, CURLOPT_BINARYTRANSFER,1);

    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); //this can be true if you use a real ssl cert

    curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_DIGEST);

    curl_setopt($ch, CURLOPT_USERPWD, "CamUserName:CamPW"); //change this to your credentials!



    $raw=curl_exec($ch);

    $rescode = curl_getinfo($ch, CURLINFO_HTTP_CODE);

    curl_close ($ch);

    if($rescode != "200"){

        echo $rescode;

    } else {

        header("Content-Type: image/jpeg");

        header("Cache-Control: no-store, no-cache, must-revalidate, max-age=0");

        header("Cache-Control: post-check=0, pre-check=0", false);

        header("Pragma: no-cache");

       echo $raw;

    }

?>