Goal:

• Learn how to secure a web site using basic authenticate feature (login/password) provided by the apache web server with .htaccess configuration.
• Learn how to secure a web site using client digital certificate.
• Learn how to access VMware virtual machine using VMWare server management console.
• Learn how to configure a LVS cluster using a set of VMware virtual machines (pending).

Assignment Date: 3/3/2006
Due Day: 3/10/2006
Related documents:

• Authentication, Authorization and Access Control, http://httpd.apache.org/docs/2.2/howto/auth.html
• http://httpd.apache.org/docs/2.2/howto/htaccess.html
• Apache SSL/TLS Encryption, http://httpd.apache.org/docs/2.2/ssl/
• http://cs.uccs.edu/~cs526/secureWebAccess/secureWebAccess.htm

Description:

Part 1: Secure Web Access Using .htaccess

To spread the load, if the last digit of your SID is 0,1,2,3, use windom or redcloud; 4,5,6 use crestone and shavano; 7,8.9 use blanca and wetterhorn.

• Set up a secret directory under your ~<login>/public_html/cs526 directory with secure access using .htaccess.
• Create .htaccess file in secret directory similar to that used in http://cs.uccs.edu/~cs526/accessControl/ so that any access to that directory will require login and password.
• In the .htaccess file, specify the Realm name as "CS526 hw2 restrict access".
• Create password file using htpasswd with two accounts. Use -m option for md5 based encryption. One of the login is cs526 with the same root password we used for virtual machines. The other login is cs999 with topsecret as password.
• Under secret directory, create topsecret directory. Set up .htaccess file there so that only cs999 can access that directory.
• Access https://cs.uccs.edu/~<login>/cs526/secret and https://cs.uccs.edu/~<login>/cs526/secret/topsecret and see if they are protected.
• Check if we need to add cs999 into the require user directive of .htaccess file in secret directory.
• Answer the following questions:
• Q1A. Why we use https instead http to access the above secure web sites?
• Q1B. Using AuthUserFile directive can be slow when search passwords in a large password file, what directive can speed up such password access?
• Q1C. How to protect the password file specified in the AuthUseFile from web users who does not have an account on the machine running the apache web server?
• Q1D. How to protect the password file specified in the AuthUseFile from users that have account on the web server machine? Suggest one way to fix the problem.

Part 2: Secure Web Access Using Client Digital Certificate.

• A customized Fedora Core 5 Test 3 VMWare virtual machine was set up on windom for you. The virtual machine has <login>fc5t3 as its ID and use your SID as the root password. It does not allow remote root access with ssh. An account with your CS login with your SID as password was created on this virtual machine. Once you find out the IP address allocated to the virtual machine using ifconfig etho command. You can access the machine using ssh with that account.
• Note that this virtual machine is for your cs526 lab exercises. Do not use it for other purpose unless you obtain approval.
• You can remote access your virtual machine using VMware management console.
• At school, you can use the VMware management console on Windom (a Dell Optiplex 680 workstation in EN149 to the right EN143 door or that on EN149-29 (the PC right next to windom).
  • On Windom, login in as a CS Unix machine user and type in "vmware-console" as command as select local machine as option. Select the virtual machine with <login>fc5t3.
  • On EN149-29 PC, just click on the WMware server icon and it will prompt you to enter the machine (in our case choose windom), and CS login and passwrod to access the virtual machine lists on windom server. Select the virtual machine with <login>fc5t3.
• At home, you can download the VMWare management console as one of the software modules in VMware Server beta package http://www.vmware.com/programs/8/serverbeta.do. Just register as a user and download VMware Server Windows client package or download VMware Server Linux client package.
• For window client, there are three software packages in the zip file (21.4MB). Install COM and Perl scripting API modules first.
  • Windows VMware Server Console (.exe)
  • COM scripting API for Windows (.exe)
  • Perl scripting API for Windows (.exe)
• 
• click on your virtual machine <login>fc5t3 and select the Start this virtual machine or the play green button.
• Note that the current system is configured for any legitimate user to view and share editing the same virtual machine. Therefore your classmates and me can be watching every move you did on your virtual machines! The screen images are synchronzied.
• Follow the step in http://cs.uccs.edu/~cs526/secureWebAccess/secureWebAccess.htm to create server certificate and personal digital certifiate, and set up the apache web server with secure certificate-based access.
• More details and help to follow.