ØØÔ»» Ö ÚºØÙ¹ ÑÒ ØÞº»ÔÙ»¾¼¼¼»¼¼ ¾» AFSandtheWeb Using PAM for Apache for an authorized accesstoafsfilespacefromtheweb Thomas Müller Chemnitz University of Technology, Computer Center Thomas.Mueller@hrz.tu-chemnitz.de 14./15. 12. 2000 AFS Meeting 2000 Garching 1
14./15. 12. 2000 AFS Meeting 2000 Garching 2»»ØÙ¹ ÑÒ ØÞº» ÓÑ»ÙÖÞ»Ø»Ø Ñ»ÔÙ Ð ØÑл Ò Üº ØÑÐ AFSandtheWeb Our situation Apache 1.3.x(with mod ssl) on Solaris and Redhat Linux several L4 switched servers arestoredinafs allwebpagesof ØØÔ»»ÛÛÛºØÙ¹ ÑÒ ØÞº» especially user web space, e.g. is resolved to ØØÔ»»ÛÛÛºØÙ¹ ÑÒ ØÞº» Ø Ñ»
Goals optional usage of AFS/Kerberos authentication optional usage of AFS file protection(acl) user-driven fall back to Apache s own authentication scheme no changes of Apache source code 14./15. 12. 2000 AFS Meeting 2000 Garching 3
request handling by Apache master daemon forwards received requests to one of its children request handling is broken down into a series of steps URIµfilename translation authentication checking... sendingtheresponsetotheclient logging Apache modules may add funtionality to each step 14./15. 12. 2000 AFS Meeting 2000 Garching 4
Pluggable Authentication Modules user user user login ftpd xdm dtlogin xlock Authentication Management Account Mangement Password Management Session Management UNIX DCE Security Service AFS S/Key Config File System Admin PAM Application Program Interface PAM Service Provider Interface 14./15. 12. 2000 AFS Meeting 2000 Garching 5
modauthpam ApachemoduleÑÓ Ô Ñ ÙØ byingolütkebohle: enables Apache to use PAM for authenticating remote users ØØÔ»»Ô Ѻ ÓÙÖ ÓÖ ºÒ Ø»ÑÓ ÙØ Ô Ñ» implements the PAM module types: authentication management account management doesn t handle credentials(afs token)- Apache knows nothing about different users in the filesystem 14./15. 12. 2000 AFS Meeting 2000 Garching 6
ËËÄÊ ÕÙ Ö ËËÄ ± غ Ø ÙØ Æ Ñ Ë ÙÖ Ö ÙØ ÌÝÔ Ù È Å ÙÐص ÙØ È Å Ò Ð ÓÒ Ö ÕÙ Ö Ú Ð ¹Ù Ö ÙØ È Å ÐÐÌ ÖÓÙ Ó ÝÔ ÓØ Ö ÙØ ÑÓ ÙÐص AFSandtheWeb Example 1 14./15. 12. 2000 AFS Meeting 2000 Garching 7 ÓÙÒØÖ ÕÙ Ö Ô Ñ º Óº½ ÙØ Ö ÕÙ Ö Ô Ñ º Óº½ ÒÓÖ ÖÓÓØ ± Ø» Ø»Ô Ñº» ØØÔ
ºººººººººººººººººººººººººººººººººººººººººººººººººººº init µ... auth Þ... ººººººººººººººººººººººººººººº Þ logging modauthpam pamauthenticate(...) pam afs.so.1 pamsmauthenticate(...) if(!fork()) ka VerifyUserPassword(...+ KA USERAUTH DOSETPAG,...) 14./15. 12. 2000 AFS Meeting 2000 Garching 8
Effects 1 authentication seems to work but wedon tgetanafstoken hangs sometimes(seems it doesn t wait correctly for the child s termination) each request creates a new PAG 14./15. 12. 2000 AFS Meeting 2000 Garching 9
Solution considerthehandlingofahttprequestasakindofa session modify the Apache module mod auth pam implement session management as an optional feature(storing and removing of credentials) modify the AFS-PAM pam afs.so.1 make the fork() optional findabetterwaytohandlepags 14./15. 12. 2000 AFS Meeting 2000 Garching 10
ËËÄÊ ÕÙ Ö ËËÄ ± غ Ø ÙØ Æ Ñ Ë ÙÖ Ö ÙØ ÌÝÔ ØÖ ÒØ Ð ÙØ È ÅË Ø Ö ÓÒ ± Ø» Ø»Ô Ñº» ØØÔ Ö ÕÙ Ö Ú Ð ¹Ù Ö AFSandtheWeb Example 2 14./15. 12. 2000 AFS Meeting 2000 Garching 11 ÓÒÓÔØ ÓÒ ÐÔ Ñ º Óº½ Ö ÕÙ Ö Ô Ñ º Óº½ ÒÓÖ ÖÓÓØ ÓÒØ ÓÖ ÓÙÒØÖ ÕÙ Ö Ô Ñ º Óº½ ÙØ
ºººººººººººººººººººººººººººººººººººººººººººººººººººº init µ... auth Þ... ººººººººººººººººººººººººººººº Þ logging modauthpam pamauthenticate(...) if(authpam SetCred) pam close session(...) pamsetcred(...) Å Å Å µ pam afs.so.1 pamsmauthenticate(...) setpag() kaverifyuserpassword(...) pamsmclosesession(...) ktcforgetalltokens(...) pamsmsetcred(...) ka UserAuthenticateGeneral(...) 14./15. 12. 2000 AFS Meeting 2000 Garching 12
Effects 2 optional usage of AFS/Kerberos authentication optional usage of AFS file protection ÙØ È Å Ò Ð ÓÒ Ó user-driven fall back to Apache s own protection ÙØ È ÅË Ø Ö ÓÒ Ó scheme controlledbyº Ø 14./15. 12. 2000 AFS Meeting 2000 Garching 13
Effects 2 each request creates a new PAG Ø Ø µstherequestedfilebeforetheauthstep workaround:provideðóó ÙÔpermissiontothe workaround:makethedirectoryofº Ø readabletoandmoveyourprotectedfilestoa needsanafstokentoreadº Ø subdirectory 14./15. 12. 2000 AFS Meeting 2000 Garching 14
Summary it works ºhelp desk ØØÔ»» ÖÚ º ÖÞºØÙ¹ ÑÒ ØÞº» ºmanagement of print spool requests ºaccess to HOME directories ØØÔ»»ÐÓ ÒºØÙ¹ ÑÒ ØÞº» AFS Web Security Pack more efficient(token caching, PAG handling) Doesanybodyuseit? 14./15. 12. 2000 AFS Meeting 2000 Garching 15
»»ØÙ¹ ÑÒ ØÞº»ÓÔ Ò»½º¼» ٠л Ö»Ô Ñ AFSandtheWeb Sources modified mod auth pam modified AFS PAM»»ØÙ¹ ÑÒ ØÞº»ÓÔ Ò» ÇÒ»ÑÓ ÙØ Ô Ñ 14./15. 12. 2000 AFS Meeting 2000 Garching 16