1 / 10

Web Server Design Week 10

Web Server Design Week 10. Old Dominion University Department of Computer Science CS 495/595 Spring 2010 Martin Klein <mklein@cs.odu.edu> 3/17/10. Authentication: Basic & Digest. Defined in RFC-2617 Basic very simple sends password in the clear (very bad)

olisa
Télécharger la présentation

Web Server Design Week 10

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Web Server DesignWeek 10 Old Dominion University Department of Computer Science CS 495/595 Spring 2010 Martin Klein <mklein@cs.odu.edu> 3/17/10

  2. Authentication: Basic & Digest • Defined in RFC-2617 • Basic • very simple • sends password in the clear (very bad) • suitable for personalization; not real security • Digest • uses cryptographic hashes; password not sent in the clear • stronger than Basic, but client support not as prevalent • does not encrypt content… • SSL, SHTTP or equivalent needed for that

  3. Authentication Structure • Both methods are structurally similar: • when the server receives a request for a protected resource, it responds with: • status code “401 Unauthorized” • “WWW-Authenticate:” response header • the client reissues the same request with the addition of: • “Authorization:” request header

  4. auth type auth type opaque string to differentiate auth files Base64(username:password) Basic • “WWW-Authenticate:” response header: • WWW-Authenticate: Basic realm=”St. Patrick’s Day" • “Authorization:” request header: Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==

  5. GET shamrock HTTP/1.1 200 OK Scenario client server 401 Unauthorized WWW-Authenticate: Basic realm=“Paddy’s Day” GET foo HTTP/1.1 Authorization: Basic St.Patrick:HolyTrinity scenario 2: the client could have sent the Authorization string with the initial request St.Patrick:HolyTrinity would be base64’d

  6. How Apache Does It…(Note: we’re not going to do it this way!) • In either <Directory> entries in the config file, or “.htaccess” files in directories: AuthType Basic AuthName "This is what RFC 2617 calls a Domain" AuthUserFile /usr/local/apache/passwd/passwords Require user St.Patrick • Many more options possible: • http://httpd.apache.org/docs/2.0/howto/auth.html

  7. Authentication Example (mln-web:~/public_html/restricted) mklein% ls -al total 12 drwxr-xr-x 2 mklein sshd 136 Mar 10 17:49 . drwxr-xr-x 7 mklein sshd 336 Mar 10 17:48 .. -rw-r--r-- 1 mklein sshd 125 Mar 10 17:48 .htaccess -rwxr-xr-x 1 mklein sshd 93 Mar 10 17:49 encode.pl -rw-r--r-- 1 mklein sshd 24 Mar 10 17:48 paddys.txt (mln-web:~/public_html/restricted) mklein% more .htaccess AuthType Basic AuthName "It's St.Patrick's Day, Lads - pwd required" AuthUserFile /home/mklein/cs595passwd Require user st.patrick (mln-web:~/public_html/restricted) mklein% more encode.pl #!/usr/bin/perl use MIME::Base64; $str = encode_base64(”st.patrick:shamrock"); print "$str\n"; (mln-web:~/public_html/restricted) mklein% ./encode.pl c3QucGF0cmljazpzaGFtcm9jaw==

  8. Request #1 bookpower:~ mk$ telnet mln-web.cs.odu.edu 80 Trying 128.82.4.82... Connected to mln-web.cs.odu.edu. Escape character is '^]'. HEAD /~mklein/restricted/ HTTP/1.1 Host: mln-web.cs.odu.edu Connection: close HTTP/1.1 401 Authorization Required Date: Wed, 10 Mar 2010 22:50:35 GMT Server: Apache WWW-Authenticate: Basic realm="It's St.Patrick's Day, Lads - pwd required" Connection: close Content-Type: text/html; charset=iso-8859-1 Connection closed by foreign host.

  9. Request #2 bookpower:~ mk$ telnet mln-web.cs.odu.edu 80 Trying 128.82.4.82... Connected to mln-web.cs.odu.edu. Escape character is '^]'. HEAD /~mklein/restricted/ HTTP/1.1 Host: mln-web.cs.odu.edu Connection: close Authorization: Basic c3QucGF0cmljazpzaGFtcm9jaw== HTTP/1.1 200 OK Date: Wed, 10 Mar 2010 22:51:37 GMT Server: Apache Connection: close Content-Type: text/html;charset=ISO-8859-1 Connection closed by foreign host.

  10. Why Not a “403 Forbidden” ? 10.4.4 403 Forbidden The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated. If the request method was not HEAD and the server wishes to make public why the request has not been fulfilled, it SHOULD describe the reason for the refusal in the entity. If the server does not wish to make this information available to the client, the status code 404 (Not Found) can be used instead.

More Related