IBM WebSphere V5.0 Security - CGISecurity

►
►
►
►
Running daemon as root: when the HTTPD daemon starts, it uses the root
account. Then it initializes a number of threads that actually serve end-user
requests. These threads are managed by the root's controller thread and are
not responsible for administration and control procedures. The StartServer
directive of the httpd.conf file sets the users and groups that own running Web
server process. You have to set these directives to the users and groups that
you define to run a Web server. Never run Web server as the root user.
Digest authentication: basic authentication does not secure user passwords
that are passed from the Web browser to the server in plain text. In order to
encrypt or encode a password, some servers have additional modules that
can implement MD5 encoding. Both your server and your browser should
support MD5 digest authentication. In digest authentication, the password is
not sent across the network. On a client side, the Web browser creates an
MD5 encoded string using the user password and AuthRealm. The Web
server creates its own string based on the information stored in the httpd.conf
file and compares it with the information sent by the client's browser.
Kerberos authentication: Kerberos is a third party authentication system
which allows secure authentication and communication of clients and servers
over the network. It uses DES algorithm for encryption. Refer to your Web
server documentation for required modules in order to run Kerberos system.
Chroot: many operating systems offer the chroot command that tells the
application to treat a given directory as if it were a root directory. This allows
hiding the file system that is above that directory from every process of the
executing application. One drawback to using the chroot command is that all
the executable code and modules used by the application should be placed
within the directory that is visible to the application.
There are many other possible security options that may be used in your
solution. Everything is highly dependent on the selected architecture and
application requirements.
Chapter 4. Securing Web components 45