Systems Integration On Free Software

Transcription

1 Systems Integration On Free Software Web Server Apache Webmail Roundcube WebProxy Squid Author: Carlos Alberto López Pérez

2 Web Server: Apache Apache Since April 1996 Apache has been the most popular HTTP server software in use. As of May 2011 Apache was estimated to serve 63% of all websites and 66% of the million busiest. Developer Nº servers Percent (05/2011) Apache 61,961, % Microsoft 16,598, % Google 12,651, % nginx 9,499, % lighttpd 678, % 1 / 21

3 Apache: Introduction Multi-Processing Modules (MPMs) event, prefork, worker, itk winnt, netware, os2... Dynamic Shared Objects (DSOs), APXS Cgi Server side scripting languages: perl, php, python, tcl... Virtual hosts Reverse proxy URL rewriting... 2 / 21

4 Apache: Installation 1. Launch the virtual server 2. Open a root console (ssh) into your server (alpha): ssh root@localhost -p Install Apache: apt-get install apache2 4. Control it: service apache2 [stop start restart reload] 3 / 21

9 Apache: Configuration Directory: /etc/apache2 apache2.conf (main system configuration) httpd.conf (user configuration) Subdirectory: conf.d (system packages configuration) Subdirectories: sites-available, sites-enabled (user defined sites) Subdirectories: modules-available, modules-enabled (modules configuration) Utilities: a2enmod a2dismod a2ensite a2dissite apachectl 4 / 21

10 Apache: Configuration (2) Global environment Config root: ServerRoot /etc/apache2 Performance: Timeout, Keepalive, MaxKeepAliveRequests, KeepaliveTimeout, MinSpareServers, MaxSpareServers, StartServers, MaxClient, MaxRequestsPerChild Listen ports (ports.conf): Listen ip:port, BindAddress host <IfModule>: Parses config only if selected module has been loaded 5 / 21

11 Apache: Configuration (3) Virtual host directory options <Directory>, <DirectoryMatch> <Files>, <FilesMatch> <Location>, <LocationMatch> <Options> ExecCGI, FollowSymLinks, Indexes, SymlinksIfOwnerMatch... Allow/Deny from ip/host/mask(*), Order 6 / 21

12 Apache: Configuration (4) Virtual host directory options Unix process user: User, Group Access control: AccessFileName.htaccess UseCanonicalName Default data types: DefaultType text/plain Resolve hostnames to log: HostNameLookups Log levels and files: ErrorLog, LogLevel, LogFormat, CustomLog 7 / 21

13 Apache: Configuration (5) Virtual host directory options Server version: ServerSignature, ServerTokens Aliases: Alias, ScriptAlias Icons, descriptions and headers AddIconByEncoding, AddIconByType, AddIcon, DefaultIcon, AddDescription, ReadmeName, HeaderName, IndexIgnore 8 / 21

14 Apache: Configuration (6) Virtual host directory options Mime types and i18n: AddLanguage, AddCharset, LanguagePriority, AddType, AddHandler Meta info: MetaDir, MetaSuffix Personal error messages: ErrorDocument 9 / 21

15 Apache: Restricting Access Authtype: Basic (plain text password) Digest (cryptographic hash derived from the password) Pluggable Auth modules: mod_authn_file: User authentication using text files mod_authn_dbd: User authentication using a SQL database mod_authnz_ldap: User authentication using a LDAP directory. mod_authnz_external: Allows the admin to implement custom authenticators: radcheckpassword: Checking against external Radius server(s) pwauth: Authentication against Unix shadow password files or via PAM checkpasswd-imap: An IMAP authenticator written in Python (...) [...] 10 / 21

16 Apache: Mod_authn_file Create new passwd file: htpasswd -c /etc/apache2/mypassfile username Create new digest passwd file: htdigest -c /etc/apache2/mypass "Restricted Area" username Configure authentication: AuthType Digest AuthName "Restricted Area" AuthUserFile /etc/apache2/mypassfile AuthGroupFile /etc/apache2/mygroup Require group hackers 11 / 21

17 Apache: Digest The browser sends a hash derived from the password $ echo -n 'misecretpassword' md5sum 02c3868aa2bcd104ea a1c2d55 The advantage of using the hash value is that the password itself is not sent to the server, so it isn't visible to the Bad Guys. Replay attack? Could a Bad Guy who intercepts the Internet traffic reuse the previous hashes sent by the client?. To protect against replay attacks, digest adds a few other things into the mix: the URI, the method, and a nonce. A nonce is simply a number chosen by the server and told to the client, usually different each time. It ensures that the digest is different each time and protects against replay attacks. 12 / 21

24 Apache: Digest Algorithm The client requests a URL. Because that URL is protected, the server replies with error 401, Authentication required, and among the headers, it sends a nonce. The client combines the user's password, the nonce, the method, and the URL, as described previously, then sends the result back to the server. The server does the same thing with the hash of the user's password retrieved from the password file and checks that its result matches. A different nonce is sent the next time, so that the Bad Guy can't use the captured digest to gain access. The digest function looks like this: MD5(MD5(<password>)+":"+<nonce>+":"+MD5(<method>+":"+<url>)) 13 / 21

25 Webmail: Roundcube Roundcube Roundcube is a web-based IMAP client written in the PHP programming language. Roundcube's most prominent feature is the pervasive use of Ajax technology to present a more fluid and responsive user interface than that of traditional webmail clients. Is licensed under the GNU GPL v3. 14 / 21

26 Roundcube: Features Current Roundcube features Available in over 70 languages Drag-&-drop message management Full support for MIME and HTML messages Sophisticated privacy protection Compose messages with attachments Multiple sender identities Full featured address book with groups and LDAP connectors Find-as-you-type address book integration Richtext/HTML message composing Forwarding messages with attachments Searching messages and contacts Threaded message listing IDNA support Spell checking IMAP folder management Shared/global IMAP folders Support for external SMTP server Support for access control lists (ACL) Built-in caching for fast mailbox access Unlimited users and messages Template system for custom skins Plug-in API for flexible exensions 15 / 21

27 Roundcube: Installation Install Roundcube: apt-get install roundcube roundcube-sqlite 16 / 21

28 Roundcube: Configuration /var/lib/roundcube/config/main.inc.php [...] // automatically create a new RoundCube user when log-in the first time. // a new user will be created once the IMAP login succeeds. // set to false if only registered users can use this service $rcmail_config['auto_create_user'] = TRUE; // the mail host chosen to perform the log-in // leave blank to show a textbox at login, give a list of hosts // to display a pulldown menu or set one host as string. $rcmail_config['default_host'] = 'ssl://imap.gmail.com:993'; // TCP port used for IMAP connections $rcmail_config['default_port'] = 993; // use this host for sending mails. // if left blank, the PHP mail() function is used $rcmail_config['smtp_server'] = 'ssl://smtp.gmail.com'; // SMTP port (default is 25; 465 for SSL) $rcmail_config['smtp_port'] = 465; [...] 17 / 21

29 Webproxy: Squid Squid Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. It reduces bandwidth and improves response times by caching and reusing frequently-requested web pages. Squid also has extensive access controls so it can be used also as a Web firewall in order to improve security by filtering traffic. It runs on most available operating systems, including Windows and is licensed under the GNU GPL. 18 / 21

30 Squid: Features Features: Web caching proxy (http, https, ftp) High performance Multiplatform (Unix, NT) Flexible Access Control List (ACL) rules Interoperable: Content/antivirus filters (dansguardian, squidguard, addzaper) Internet Cache Protocol (ICP) 19 / 21

31 Squid: Installation Packages: squid (squid-common) 20 / 21

32 Squid: Configuration /etc/squid/squid.conf [...] acl localhost src /32 acl localnet src /8 # RFC1918 possible internal network acl localnet src /12 # RFC1918 possible internal network acl localnet src /16 # RFC1918 possible internal network http_access allow localnet http_access allow localhost http_access deny all http_port 3128 acl forbidden2a url_regex -i ^ acl forbidden2b time 10:00-14:00 http_access deny forbidden2a forbidden2b [...] 21 / 21