CS526Home ClassInfo PhotoAlbum Grade Assignments Homeworks Q&A Research Projects News Exams

hw1 hw1sol hw2

Solution to Homework #2: Secure Web Access with Login/Password and Client Digital Certificates and Configure LVS using Virtual Machines

Related documents:

• Authentication, Authorization and Access Control, http://httpd.apache.org/docs/2.2/howto/auth.html
• http://httpd.apache.org/docs/2.2/howto/htaccess.html
• Apache SSL/TLS Encryption, http://httpd.apache.org/docs/2.2/ssl/
• http://cs.uccs.edu/~cs526/secureWebAccess/secureWebAccess.htm

Description:

Part 1: Secure Web Access Using .htaccess

• Q1A. Why we use https instead http to access the above secure web sites?
  Ans: the password and login will be transitted in plain text over http connection and subjected to the packet sniffing attacks. https encrypts the data and protect the login and password transmitted.
• Q1B. Using AuthUserFile directive can be slow when search passwords in a large password file, what directive can speed up such password access?
  Ans: By using AuthDBMUserFile directive, the entries in the password list are saved as a DBM file (hash) and can be accessed much quick than the long sequential search on the plain password file implemented by the AuthUserFile directive.
  
• Q1C. How to protect the password file specified in the AuthUseFile from web users who does not have an account on the machine running the apache web server?
  Ans: Put the password file outside the document root directory.
  
• Q1D. How to protect the password file specified in the AuthUseFile from users that have account on the web server machine? Suggest one way to fix the problem.
  Ans: Use the regular Unix access control mechanism to protect the password file. Change the group membership of password file from the owner to that of a group which the apache web server belong to. For example, change the group membership of password file to apache (chgrp apache password; only admin can do this) and change the file permission to 640. Now only the owner can read and write to the password file and the members belong to the apache group can read the password file. All other users can not read the password file.
  
  However, if the location of the password file is known, someone can write a cgi script to read the password file. The cgi script is run by a web server process with apache account. You may want to restrict the access to the directory contains the .htaccess and that of the password file.