Apache authentication solution

Greetings,
I'm setting up a couple of apache virtual hosts on my arch server.
www.mydomain.com - web page
wiki.mydomain.com - wiki
media.mydomain.com - image repository
The information on these hosts are only intended for my family and a couple of relatives.
Can someone help me to choose a good security implementation?
- Fast and simple login procedure
- A non-tech person should be able to login to the site
- You should be able to login once and then be able to access all the hosts

A normal .htaccess file will do all apart from the Single Sign On (SSO) part. That will be harder.
Of course, if you can identify "family and friends" by IP Address, then it's a lot simpler.
What about running Apache on an alternative port (say 22280)? It's Security-by-Obscurity which isn't really security, but Security is a compromise of Ease-of-use, and vice-versa.
Last edited by fukawi2 (2010-12-21 23:03:34)

Similar Messages

External Authentication Solution?

I am looking for an external authentication solution for Web AS (ABAP Specifically but the whole AS would be preferable)
i.e. Our External Authetication system sits in front of SAP that does Auth then passes username in a HTTP Header to SAP..
So far we have these previous solutions
1. SAP WAS Java -> Using Header Authenticaion Module
2. SAP Netweaver -> Using ITS Standalone configured for PAS and SNC
So For SAP Web AS We need to do this for the ABAP side of things and I from what I can gather from the documentation the only mechanism to do this is to either :
a) use ITS Standalone in front of the SAP Web AS ABAP or,
b) use the current J2EE solution using Header Authentication Module.???
Now we cannot install ITS Standalone so that is out it is then up to the J2ee solution.
My question is : The documentation refers to Integrated Java -> Does this mean that the Java is installed by default? or does it have to be installed separately?
I have installed the Web AS Preview Installation (ABAP) 2004s but I've put it in this forum as it's more general type concept question
Ideally we'd like to have an ICM SSO solution so that we just deal with one point but I don't know if this is possible?

Raff,
Thank you for your reply. We checked with our server configuration and it does appear to have OpenSSL enabled.
extension=openssl.so
Apache Version
Apache/2.2.11 (Unix) PHP/5.2.9 with Suhosin-Patch mod_ssl/2.2.11 OpenSSL/0.9.7m mod_apreq2-20051231/2.6.0 mod_perl/2.0.3 Perl/v5.8.7
Other than the original apache error log message, we are not getting any error messages in the php error log to indicate a problem. I am making the call from an https://URL with a valid certificate. I get the same error message as before.

Apache authentication via mod_auth_mysql

Hi to all.. anybody have ever tried to configure Apache protected directories
via modauthmysql ?
my result is an error NSURLErrorDomain:-1005 after filling field with username e password...
If is there anybody who tried this authentication method?
I use standard Apache that comes with macosx 10.4.3..
thank you

I have the same problem like you??? You already know the solution?

Apache, authentication required, key not working

I'm trying to set up my PC with Apache Server. If i try to access it from my laptop in our home, it serves on 192.168.1.102 I went to no-ip.biz because we have a dynamic IP here. when i try to remotely access the server, i get a screen that says: Authentication required Enter username and password for "linksys BEFW11S4 V.2" at http://XXXXXX.no-ip.biz (xxx being my subdomain i requested) the screen will not accept any 'admin' or the network key i use. Any advice?

Hi
You should use port forwarding and forward your apache port (usually 80) to the ip address of the machine that has apached installed
Hope this works
Cheers

Apache Authentication

We recently setup an Open Directory server on OSX 10.4 and we're having issues getting our GNU/Linux Apache 2.0 web server to authenticate against it. Here is the section in our httpd.conf:
LoadModule ldap_module modules/mod_ldap.so
LoadModule authldapmodule modules/modauthldap.so
<Directory "/www/docs/public/ldaptest">
Options Indexes FollowSymLinks
AllowOverride None
order allow,deny
allow from all
AuthLDAPEnabled on
AuthType Basic
AuthName "OD LDAP Test"
AuthLDAPURL
"ldap://ldaphost:389/dc=ldaphost,dc=ucsd,dc=edu"
Require valid-user
</Directory>
I've looked at both the apache2 logs and the OD logs on the OSX server but it's not showing anything useful. This same configuration works with a generic OpenLDAP server without any problems. Do I need to use a special module (modappleauth?) or is there some configuration switch I need to change?
We'd also like to have the ability to authenticate via group using the require group directive.
Additionally is there any way to authenticate a SunOne web server to OD?
Thank you.

After looking at the Apache logs I came across this:
auth_ldap authenticate: user ldaptest authentication failed; URI /ldaptest/ [LDAP: ldapsimple_binds() failed][Invalid credentials]
Which looks like the OSX server isn't allowing anonymous binds for some reason. Even though I can do a normal ldapsearch and get results without any problems.

Apache authentication & Leopard

i have an apache site running on my G%. i had password authentication working fine under Panther and Tiger. just upgraded to Leopard and it seems not to be working. it's as though none of the httpd.conf edits (that i see are still there) are not taking effect OR something changed with Apache in Leopard -- or the like.
the httpdd.conf customizations that have worked for quite some time are:
Order deny,allow
Deny from all
Allow from 127.0.0.1
AuthName "By Invitation Only"
AuthType Basic
AuthUserFile /Library/WebServer/.htpasswd
Require valid-user
Satisfy Any
and they are still in what i believe to be the active httpd.conf file. additionally, the .htpasswd file is also located in the right place and is intact after the upgrade.
it's not as though the site is inaccessible. access to my site from the outside world is just swell... just no authentication before providing access.
any ideas of why the password authentication would just not work??
thanks!!

That was exactly it!
I am grateful and so glad I decided to put the question to the forums. I stared and poked at it for more than an hour. I'm not an expert by far, so I was "double checking" myself in circles at 2AM. Thanks SO much for the dot connection.
Any idea where I can read more about the Leopard specific Apache install???
Separately, it was funny because it still took me a while to find the issue. Even when I found my way to /etc/apache2, when i then invoked bbedit httpd.conf from within that directory, it opened up the old one -- or rather the one I was already familiar with in /etc/httpd. I eventually had to have bbedit 'open hidden' to get to the proper new one.
Anyway, thanks for the info!
David

Apache Authentication mod_auth_apple (client)

Hi,
I'm trying to setup my apache with "AuthType Basic", using the local account / users.
Guess this is only possible by using the appleauthmodule (libexec/apache2/modauthapple.so).
Seems that this module isn't available in the non server version of 10.5
So, what's my options?
Read in old dev-mailing lists that the source for modauthapple is available but can't find it...

I have the same problem like you??? You already know the solution?

Product Authentication Solution

I am from the business side of an organization, so please bear with me on this question. Are there any commercially available solutions for authenticating Cisco equipment when it arrives from a reseller? We would ideally like to verify a) all internal chips are authentic, b) all chip-level software is authentic and c) no unauthorized components have been inserted into the products between assembly line and delivery to our front door. Thank you.

Products you buy new from a reputable reseller *should* be sealed in a Cisco box with "Cisco Systems" tape intact. An authentic box with genuine gear it in will have a hologram sticker on it.
Certain Cisco parts will also have hologram stickers on key chips. An easy example is a VWIC2-2MFT-T1E1. There is a hologram sticker on the main chip of this card.
I am not aware of software that performs hardware and software tampering detection. Your best bet would be to buy from a reputable reseller.

Apache authentication using .htaccess not working??

I have added the following to my httpd.conf file:
<Directory "/Library/WebServer/Documents/secret">
Options FollowSymLinks
AllowOverride None
</Directory>
Then I created an .htaccess file in /Library/WebServer/Documents/secret with the following contents:
AuthName "Private area - server owner only. Hit Cancel."
AuthType Basic
AuthUserFile /Library/WebServer/.htpasswd
require valid-user
Then in Terminal I entered the following:
htpasswd -c /Library/WebServer/.htpasswd s1lly
New password: rabb1t
Re-type new password: rabb1t
Adding password for user s1lly
Thn I stopped and re-started Apache using the OS X Server Admin apps. Now when I go to http://localhost/secret in my browser, it asks me for a username & password. I enter s1lly and rabb1t, but all it tells me is:
"Forbidden
You don't have permission to access /secret/ on this server.
Apache/1.3.33 Server at localhost Port 80"
What am I doing wrong? Before I added the .htaccess file and changed the httpd.conf, everything worked properly, so I know the URLs are correct. All files are set to be world-readable.
Changing the .htaccess line from require valid-user to require user s1lly didn't help either.
Thanks,
Mike
G4 MDD 1.25 GHz Mac OS X (10.4.9) Running OS X Server 10.4.9
iBook 700mHz Mac OS X (10.3.9)

Mike--
I have added the following to my httpd.conf file:
<Directory "/Library/WebServer/Documents/secret">
Options FollowSymLinks
AllowOverride None
</Directory>
Shouldn't that be AllowOverride AuthConfig? With it set to "None", Apache shouldn't be looking at the .htaccess file at all.
charlie

WLC/LDAP/WPA authentication solution

Hi Experts,
I have Cisco WLC 4404 with 100 LWAP access points. Currently I am using shared WEP authentication. I like to migrate it WPA. I want the clients to have authenticated using Individual username / password to get into the network. I am using LDAP for username password repository. I also have Cisco ACS (AAA) server kept unused.
I think it can be achieved using
1. web authentication configured in WLC itself. But i donot want this as WLC may be loaded unnecessarily. Is this correct.
2. Another option I read is 802.1x authentication with WPA. Since I am integrating with LDAP, I also learned that only EAP-FAST can be used.
The question is, whether windows XP supports EAP-FAST client by default (I didn't the option in win XP). Or otherwise should i load a third party clients in all the client laptops. Whether cisco aironet client is free to download and use?
Kindly help me
THANKS IN ADVANCE
sairam

Let me list your requirements, to better define them:
1) Clients must log in (each time?) with their username and password
2) You don't have, and don't want to implement, a certificate server
3) You are using a non-Windows AD LDAP directory for user authentication
4) You have a Cisco ACS (version ?) that you can use for RADIUS, to interact between the client and the LDAP server
5) You want to avoid web authentication if you can, because of concerns about overloading the WLC.
One thing - what is your supplicant? Are these standard Windows XP, SP2 machines? Also, what are your encryption requirements? Web authentication provides no encryption for the data after authentication.
And, without a certificate on at least the ACS server (plus appropriate Certificate Authority server), you're out of luck for EAP.
EAP-FAST generally requires a certificate on the server side (if you want it to be at least somewhat secure). And, it requires a Cisco supplicant, such as the Aironet Desktop Utility with the Cisco CB21AG PCMCIA card (or can potentially use the EAPHost supplicant in Windows Vista.)
If you don't need encryption, go with web authentication. The WLC should not have a problem handling the requests (how many simultaneous logins are you looking at?) If you do need encryption, you are going to need some additional components, whether supplicants or a certificate server.

Apache authentication using Oracle dB

I'm a newbie trying to find out how do u set up apache to look at tables in an oracle db to get username, password, and group. I've seen mod_auth_mysql, and other mofules, but I haven't been able to find a module that works with oracle. I'm not sure but should I use the mod_auth_external ? Thanks for your help.

Thanks for the links.
So the ADF security is built on OPSS which in turn uses the Weblogic Server.
So does that mean that say i wanted to make up some pages that were integrated into an already existing CRM system (EBS R12) that i'd also need to install/setup Weblogic server on the existing EBS server? Couldn't i just use the existing Application Server? Or would Weblogic server already be on as standard?
Sorry if they are daft questions.
I can see that the ADF security can have user and groups setup. However what i wanted to avoid is users having to login twice to two different systems. What i want is that users can be using the CRM system and click a button which fires up a custom jsp or similiar page (which is seemless to the users cause its still part of the CRM application) which pulls data from another source for instance. But when they do this i want the implemenation to make sure they are currently logged in correctly to the CRM system. Does that make sense?

Two Factor Authentication on Windows Server 2008 R2

We have a small 2008 R2 Active Directory environment with 2 domain controllers and 13 member servers. We have no additional features such as an RDP gateway or Federation Services - just a plain AD setup. We now have a requirement from our client to have
a two factor authentication solution for each time we logon to any server, either using RDP or locally. We only have 4 admins that ever logon to these servers - we do not have any "regular" users.
Is there anything out there that would work in this environment without having to modify our AD (at least nothing major)?
Thanks

Hi,
You may consider smart card:
Smart Card Overview
http://technet.microsoft.com/en-us/library/hh831433.aspx
Understanding Requirements for Connecting to a Remote Desktop Gateway Server
http://technet.microsoft.com/en-us/library/cc770519.aspx
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Apache FOP Capabilities

Hi all,
When using Apache FOP, is it possible to achieve any of the following :
1. Enable printing at the page level rather than at reports region ?
2. If the report contains some images is it possible that these appear in the PDF output as well?
3. Is it possible to produce XSL-FO files on the APEX server and then transfer these files to a reporting engine (Business Objects Xi) to create PDF files for printing.
Thank you and Kind Regards,
Ana-Maria

Hi Luis,
You can create some incredibly complex and rich reports using the BI Publisher (BIP) integration that APEX allows. In your report template (using the BIP plugins) you can use conditional logic to make colour columns/rows etc depending on certain criteria.
It is possible to do this yourself using the (free) Apache FOP solution, however it involves a great deal of hand-crafting the XSL-FO code yourself (not a task to be taken lightly, but entirely possible).
If you have the budget for it (or your requirement is urgent), then I highly recommend using BIP, if you don't have the budget then I recommend Apache FOP and a bottomless coffee pot and ready access to a local bakery (you're going to need the caffeine and sugar to get you through the manual XSL-FO coding).
Another possibility is to investigate PL/PDF (www.plpdf.com) which might suit your needs.
Hope this helps,
John.

How can i change the DocumentRoot for Apache?

when i change DocumentRoot to another path (eg. "DocumentRoot /srv/www"), i got "Error 403"
what can i do?
thanks
Last edited by kukat (2008-08-05 16:59:46)

http://www.cyberciti.biz/faq/apache-403 … -solution/

Open LDAP Authentication in SAPNW 7.0 AS ABAP ( Linux)

Hello ! I need your help please.
I need to authenticate the SAP Users in a SAPNW 7.0 AS ABAP in Linux With an existing LDAP Directory (OPENLDAP).
I Dont have any Windows Active Directory in the infraesctructure.
The front end is Windows Xp with SAPGUI7.10 for Windows.
I know that is is possible to have a LDAP Directory as user data source but only in UME.
I check this options:
The Pluggable Authentication Services ,requires the availability of Sap Web application Server or lower, since PAS interface is not supported any more by the SAP application Server from SAP NW 2004 and UP.
Java Authentication and Authorization Service ( JAAS ) is not possible because i Need a Sap Netweaver Application Server Java.
¿ What options do I have , i am a bit confused ?
Thanks in advance.

Gabriel,
If you want to logon via SAP GUI using any method of authentication which is not the normal userid+password logon via SAP GUI logon screen, then you need to use the SNC-interface which is included in SAP GUI and SAP ABAP AS. If you use SNC, then you need a cryptographic library which allows you to authenticate outside of SAP, then the credentials obtained are used to establish a security context for authentication purposes. The problem is that LDAP protocol is not a secure method of authentication. I therefore doubt you will find any LDAP authentication solution that works with SNC, mostly because it is not technical practical or even possible to code such an authentication method.
For web logon to SAP ABAP, if you cannot use the standard methods included in ABAP engine, you need to use the JAAS custom login modules, which (as you indicated) will require a J2EE engine to be setup in your landscape, and use to authetnicate users to ABAP applications via a browser redirect.
I am intersted how your XP wrokstation users logon to their workstation without Active Directory ? Are they using local accounts, and no domain is used, or are you using Novell as your domain for user authentication ?
Thanks,
Tim

Apache authentication solution

Similar Messages

Maybe you are looking for