O'Reilly - Practical UNIX & Internet Sec... 7015KB

[Chapter 18] 18.3 Controlling Access to Files on Your Server
Chapter 18
WWW Security
18.3 Controlling Access to Files on Your Server
Many sites are interested in limiting the scope of the information that they distribute with their Web servers.
This may be because a Web server is used by an organization to distribute both internal data, such as
employee handbooks or phone books, and external data, such as how to reach the organization's
headquarters by mass transit. To provide for this requirement, many Web servers have a system for
restricting access to Web documents.
The WN Server
Most of this chapter discusses the NCSA and CERN servers, which are two of the most popular servers in
use on the Internet at this time. A server that appears to offer considerably more security than these servers
is the WN server, developed by John Franks.
The WN server is a Web server designed from the ground up to provide security and flexibility. The server
can perform many functions, such as banners, footers, and searching, and the selective retrieval of portions
of documents, which can only be performed on other servers using CGI scripts. The server is also smaller
than the NCSA and CERN servers, making it easier to validate.
Another feature of the WN server is that it will not transfer any file in any directory unless that file is listed
in a special index file, normally called index.cache. The index file also contains the MIME file type of each
file in the directory; thus, WN eliminates the need to give your Web files extensions, such as filename.html
or picture.jpeg. Automated tools are provided for creating these files, if you chose to use them.
We do not have significant experience with the WN server, but its design looks promising. For more
information, check http://hopf.math.nwu.edu/docs/manual.html.
Most servers support two primary techniques for controlling access to files and directories:
1.
2.
Restricting access to particular IP addresses, subnets, or DNS domains.
Restricting access to particular users. Users are authenticated through the use of a password that is
stored on the server.
Servers that are equipped with the necessary software for public key cryptography (usually, servers that are
purchased for commercial purposes) have a third technique for restricting access:
1.
Restricting access to users who present public keys that are signed by an appropriate certification
authority.
file:///C|/Oreilly Unix etc/O'Reilly Reference Library/networking/puis/ch18_03.htm (1 of 6) [2002-04-12 10:44:26]