IBM WebSphere V5.0 Security - CGISecurity

►►►►Running daemon as root: when the HTTPD daemon starts, it uses the rootaccount. Then it initializes a number of threads that actually serve end-userrequests. These threads are managed by the root's controller thread and arenot responsible for administration and control procedures. The StartServerdirective of the httpd.conf file sets the users and groups that own running Webserver process. You have to set these directives to the users and groups thatyou define to run a Web server. Never run Web server as the root user.Digest authentication: basic authentication does not secure user passwordsthat are passed from the Web browser to the server in plain text. In order toencrypt or encode a password, some servers have additional modules thatcan implement MD5 encoding. Both your server and your browser shouldsupport MD5 digest authentication. In digest authentication, the password isnot sent across the network. On a client side, the Web browser creates anMD5 encoded string using the user password and AuthRealm. The Webserver creates its own string based on the information stored in the httpd.conffile and compares it with the information sent by the client's browser.Kerberos authentication: Kerberos is a third party authentication systemwhich allows secure authentication and communication of clients and serversover the network. It uses DES algorithm for encryption. Refer to your Webserver documentation for required modules in order to run Kerberos system.Chroot: many operating systems offer the chroot command that tells theapplication to treat a given directory as if it were a root directory. This allowshiding the file system that is above that directory from every process of theexecuting application. One drawback to using the chroot command is that allthe executable code and modules used by the application should be placedwithin the directory that is visible to the application.There are many other possible security options that may be used in yoursolution. Everything is highly dependent on the selected architecture andapplication requirements.Chapter 4. Securing Web components 45