AFSandtheWeb Using PAM for Apache for an authorized

Size: px

Start display at page:

Download "AFSandtheWeb Using PAM for Apache for an authorized"

Harold White
10 years ago
Views:

1 ØØÔ»» Ö ÚºØÙ¹ ÑÒ ØÞº»ÔÙ»¾¼¼¼»¼¼ ¾» AFSandtheWeb Using PAM for Apache for an authorized accesstoafsfilespacefromtheweb Thomas Müller Chemnitz University of Technology, Computer Center 14./ AFS Meeting 2000 Garching 1

Müller Chemnitz University of Technology, Computer Center Thomas.

2 14./ AFS Meeting 2000 Garching 2»»ØÙ¹ ÑÒ ØÞº» ÓÑ»ÙÖÞ»Ø»Ø Ñ»ÔÙ Ð ØÑÐ» Ò Üº ØÑÐ AFSandtheWeb Our situation Apache 1.3.x(with mod ssl) on Solaris and Redhat Linux several L4 switched servers arestoredinafs allwebpagesof ØØÔ»»ÛÛÛºØÙ¹ ÑÒ ØÞº» especially user web space, e.g. is resolved to ØØÔ»»ÛÛÛºØÙ¹ ÑÒ ØÞº» Ø Ñ»

3 Goals optional usage of AFS/Kerberos authentication optional usage of AFS file protection(acl) user-driven fall back to Apache s own authentication scheme no changes of Apache source code 14./ AFS Meeting 2000 Garching 3

fall back to Apache s own authentication scheme no

4 request handling by Apache master daemon forwards received requests to one of its children request handling is broken down into a series of steps URIµfilename translation authentication checking... sendingtheresponsetotheclient logging Apache modules may add funtionality to each step 14./ AFS Meeting 2000 Garching 4

5 Pluggable Authentication Modules user user user login ftpd xdm dtlogin xlock Authentication Management Account Mangement Password Management Session Management UNIX DCE Security Service AFS S/Key Config File System Admin PAM Application Program Interface PAM Service Provider Interface 14./ AFS Meeting 2000 Garching 5

UNIX DCE Security Service AFS S/Key Config File System Admin PAM Application

6 modauthpam ApachemoduleÑÓ Ô Ñ ÙØ byingolütkebohle: enables Apache to use PAM for authenticating remote users ØØÔ»»Ô Ñº ÓÙÖ ÓÖ ºÒ Ø»ÑÓ ÙØ Ô Ñ» implements the PAM module types: authentication management account management doesn t handle credentials(afs token)- Apache knows nothing about different users in the filesystem 14./ AFS Meeting 2000 Garching 6

types: authentication management account management doesn t handle credentials(afs token)-

7 ËËÄÊ ÕÙ Ö ËËÄ ± Øº Ø ÙØ Æ Ñ Ë ÙÖ Ö ÙØ ÌÝÔ Ù È Å ÙÐØµ ÙØ È Å Ò Ð ÓÒ Ö ÕÙ Ö Ú Ð ¹Ù Ö ÙØ È Å ÐÐÌ ÖÓÙ Ó ÝÔ ÓØ Ö ÙØ ÑÓ ÙÐØµ AFSandtheWeb Example 1 14./ AFS Meeting 2000 Garching 7 ÓÙÒØÖ ÕÙ Ö Ô Ñ º Óº½ ÙØ Ö ÕÙ Ö Ô Ñ º Óº½ ÒÓÖ ÖÓÓØ ± Ø» Ø»Ô Ñº» ØØÔ

8 ºººººººººººººººººººººººººººººººººººººººººººººººººººº init µ... auth Þ... ººººººººººººººººººººººººººººº Þ logging modauthpam pamauthenticate(...) pam afs.so.1 pamsmauthenticate(...) if(!fork()) ka VerifyUserPassword(...+ KA USERAUTH DOSETPAG,...) 14./ AFS Meeting 2000 Garching 8

..) pam afs.so.1 pamsmauthenticate(...) if(!

9 Effects 1 authentication seems to work but wedon tgetanafstoken hangs sometimes(seems it doesn t wait correctly for the child s termination) each request creates a new PAG 14./ AFS Meeting 2000 Garching 9

correctly for the child s termination) each request

10 Solution considerthehandlingofahttprequestasakindofa session modify the Apache module mod auth pam implement session management as an optional feature(storing and removing of credentials) modify the AFS-PAM pam afs.so.1 make the fork() optional findabetterwaytohandlepags 14./ AFS Meeting 2000 Garching 10

and removing of credentials) modify the AFS-PAM pam afs.so.

11 ËËÄÊ ÕÙ Ö ËËÄ ± Øº Ø ÙØ Æ Ñ Ë ÙÖ Ö ÙØ ÌÝÔ ØÖ ÒØ Ð ÙØ È ÅË Ø Ö ÓÒ ± Ø» Ø»Ô Ñº» ØØÔ Ö ÕÙ Ö Ú Ð ¹Ù Ö AFSandtheWeb Example 2 14./ AFS Meeting 2000 Garching 11 ÓÒÓÔØ ÓÒ ÐÔ Ñ º Óº½ Ö ÕÙ Ö Ô Ñ º Óº½ ÒÓÖ ÖÓÓØ ÓÒØ ÓÖ ÓÙÒØÖ ÕÙ Ö Ô Ñ º Óº½ ÙØ

12 ºººººººººººººººººººººººººººººººººººººººººººººººººººº init µ... auth Þ... ººººººººººººººººººººººººººººº Þ logging modauthpam pamauthenticate(...) if(authpam SetCred) pam close session(...) pamsetcred(...) Å Å Å µ pam afs.so.1 pamsmauthenticate(...) setpag() kaverifyuserpassword(...) pamsmclosesession(...) ktcforgetalltokens(...) pamsmsetcred(...) ka UserAuthenticateGeneral(...) 14./ AFS Meeting 2000 Garching 12

..) if(authpam SetCred) pam close session(...) pamsetcred(...) Å Å Å µ pam afs.so.1 pamsmauthenticate(.

13 Effects 2 optional usage of AFS/Kerberos authentication optional usage of AFS file protection ÙØ È Å Ò Ð ÓÒ Ó user-driven fall back to Apache s own protection ÙØ È ÅË Ø Ö ÓÒ Ó scheme controlledbyº Ø 14./ AFS Meeting 2000 Garching 13

user-driven fall back to Apache s own protection ÙØ È ÅË Ø Ö

14 Effects 2 each request creates a new PAG Ø Ø µstherequestedfilebeforetheauthstep workaround:provideðóó ÙÔpermissiontothe workaround:makethedirectoryofº Ø readabletoandmoveyourprotectedfilestoa needsanafstokentoreadº Ø subdirectory 14./ AFS Meeting 2000 Garching 14

ÙÔpermissiontothe workaround:makethedirectoryofº Ø

15 Summary it works ºhelp desk ØØÔ»» ÖÚ º ÖÞºØÙ¹ ÑÒ ØÞº» ºmanagement of print spool requests ºaccess to HOME directories ØØÔ»»ÐÓ ÒºØÙ¹ ÑÒ ØÞº» AFS Web Security Pack more efficient(token caching, PAG handling) Doesanybodyuseit? 14./ AFS Meeting 2000 Garching 15

ÑÒ ØÞº» AFS Web Security Pack more efficient(token caching, PAG

16 »»ØÙ¹ ÑÒ ØÞº»ÓÔ Ò»½º¼» Ù Ð» Ö»Ô Ñ AFSandtheWeb Sources modified mod auth pam modified AFS PAM»»ØÙ¹ ÑÒ ØÞº»ÓÔ Ò» ÇÒ»ÑÓ ÙØ Ô Ñ 14./ AFS Meeting 2000 Garching 16

Proceedings of the 5 th Annual Linux Showcase & Conference

USENIX Association Proceedings of the 5 th Annual Linux Showcase & Conference Oakland, California, USA November 5 10, 2001 THE ADVANCED COMPUTING SYSTEMS ASSOCIATION 2001 by The USENIX Association All