Dev Module Web Server Security

["Aaron D. Turner" <aturner@pobox.com>]

-----BEGIN PGP SIGNED MESSAGE-----


Would you believe I actually figured the bloody thing out?  :-)  Ok,
here's how it works:

1) We place some data in the httpd.conf that tells the web server to use
some perl modules for authentication and authorization.  This is where we
set the Auth Zone.  Each CVS module should have it's own zone.

2) We place a .htaccess file in the directory trees we want to protect.
Each of these will have some basic statments that are common to all
.htaccess files regardless of CVS module, zone, etc.  These files should
be managed via CVS of course.

3) There is one line that is different however:

require group ? ? ?

where ? is the vaild group number(s) from Users->RoleID.  Just list the
groups you want to allow to that directory tree.

See: /home/http/prepub/dev/html/.htaccess for an example.

So, try it out.  I've configured the dev module (aka main) to use the
linuxkb users table for authentication.  You'll also need RoleID=1.
Currently only Jason, Micah, and myself have accounts, but I expect that
this will be solved soon. :-)

Two last things:

1) User auth info is cached for 1 hour.  This means that the Perl module
only needs to do one MySQL lookup/hour/user.  We can increase/decrease
this value later as needed.

2) The hack to use MySQL's password() function is, well, ugly.  For some
unknown reason I had to append an "8" to the end of the table lookup
query, because calling the function directly added a "8" to the end.
Probably coulda/shoulda solved it with a chop(), but I didn't so there.

Happy hacking.

- -- 
Aaron Turner           | Either which way, one half dozen or another. 
aturner@pobox.com      | Check out the Red Hat Linux User's FAQ Online!
www.pobox.com/~aturner | http://www.pobox.com/~aturner/RedHat-FAQ/
All emails from this account are PGP signed.  Lack of a signature is "bad".
PGP Key fingerprint = FB E1 CE ED 57 E4 AB 80  59 6E 60 BF 45 1B 20 E8



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBNuYZ5DM3jpXy1kJtAQGiawP/QcocCXYks5cbrWaMM0wda0Pm310F1/SU
dc8drze8XW+gsgVSDZ6XUGczgKb3P8nBkdao7SGTUSgQKah+AjYBwU+9WEVbkfCM
NjBDPD1BUj8iDhVGj3JGHwCL48BHOnAn8LPiqMu6GIzUb51PswvLlmTq6KuDfMe9
mz1zeO9sFxk=
=jHYn
-----END PGP SIGNATURE-----