Homework #2. Restrict Directory Access Using Basic Authentication.

Goal:

Learn how to configure apache to restrict access to certain directories
Learn he relationship between web system security and file system access control.

Assignment Date: 9/10/2003
Due Day: 9/17/2003
References: http://cs.uccs.edu/~cs526/accessControl/
Description:

To spread the load, if the last digit of your ss# is 0,1,2,3, use blanca or shavano; 4,5,6 use crestone and shavano; 7,8.9 use redcloud and wetterhorn.

Exercise 1.

Set up a web site in directory ws4 under your apache 1.3 directory with two levels of secure access: secret and topsecret.
Copy to the content of your ws2 to ws4 Using "cp -r ws2 ws4".
Create .htaccess file in sales directory similar to that used in http://cs.uccs.edu/~cs526/accessControl/ so that any access to that directory will require login and password.
In the .htaccess file, specify the Realm name as "CS526 hw2 restrict access".
Create password file using htpasswd with two accounts. Use -m option for md5 based encryption. One is cs526 with the same password we used. The other is cs999 with topsecret as password.
In the .htaccess file of sales directory, include both cs526 and cs999 to be legitimate users that allow to access.
Under sales directory, create costs directory. Set up .htaccess file so that only cs999 can access that directory.
Run your ws4 web site and verify if the access control work.

Exercise 2

Set up a wsGroup web site by copying ws4 to wsGroup and create group-based restrict access.
Create cs522 and cs900 accounts.
Create sales and manager group. See the apache tutorial.
Add cs526 to sales group; cs999 and cs900 to manager group.
Modify the .htaccess of the cost directory to allow only manager group access.
Modify the .htaccess of the sales directory to allow access from acounts with manager or sales group.
Verify that the group-based access control work.

Exercise 3.

Q1. What is the penalty of having this additional access control?
Q2. Do we give web server account write access to the password file? In Questions 2-3, the password files are referred to those used in apache directory access control not the Unix login access control.
Q3. How to protect the password file from web users who does not have account on the machine running the web server?
Q4. How to protect the password file from users that have account on the web server machine? Suggest ways to fix the problem.

Email me the answers to those question in Exercise 3 and the urls to the .htaccess files and access logs of ws4 and wsGroup web site.

Indicate which machines you run your exercises. See if you can keep your web servers running until 9/17 midnight.