Set 13: Web Servers (configuration and security) (Chapter 21) IT452 Advanced Web and Internet Systems

Key Questions What does a web server do? How can I control it? –URL re-writing / re-direction (and why do I care?) Access control and security –Developers –Users

One server to rule them all? Popular Web Servers

Web Server Basics What happens? Where does it come from? Are we sure? What happens? Where does it come from?

URL Guidance Things to avoid Things to do How to do this?

How to control a web server? Apache – we focus on the most popular server httpd.conf –The entire site –Must be root user to edit –Requires restart.htaccess –Per directory –Possibly each user (depends on config) –Re-read for each request

Content Control 1.Redirection 2.Rewriting 3.Content negotiation

Redirection # NOTE: this is an example.htaccess file # Redirect a subdirectory to another website Redirect /~nchamber/it452/examples # Or redirect a subdirectory to another subdirectory Redirect /~nchamber/it452/examples /~nchamber/test2 # Redirect permanently, add the ‘permanent’ option Redirect permanent /~nchamber/it452/examples

Redirection OR Rewriting # NOTE: continuation of.htaccess file, still in ‘change’ directory # Must turn on the rewrite engine first. RewriteEngine On # Sets the URL that fills in as your rewrite target’s base directory. # The default is /home/username/public_html RewriteBase /~username # Rules use the directory paths, and redirect to same server RewriteRule ^oldfile3.txt$ change/test3.txt [R,L] RewriteRule ^oldfile*.txt$ change/catchOldFiles.txt [R,L] # Behind the scenes change RewriteRule ^oldfile5.txt$ change/test5.txt [L] # More complex # redirect change/stuff/dogs to change/query.pl?q=dogs # 302 = temp change RewriteRule ^stuff/([^/]+)/?$ change/query.pl?q=$1 [R=302,L]

Exercise Create a rewrite rule: –People visit your site: –Turn all possible fillings into search terms that are sent to your script: –Make it silent so the user doesn’t see the new URL. –It should not redirect a longer URL from the user like:

Apache Access Control – Options 1.Domain/IP restrictions –Manually list the domains that are allowed or not 2.Basic password protection –Create a basic password file with usernames –Passwords are sent over plain text (or the hash is sent over plain text) 3.More advanced modules – keep passwords in DB rather than “flat file”

1. Access control: IP-based order deny,allow deny from all allow from.nadn.navy.mil allow from.usna.navy.mil allow from.usna.edu allow from.naps.edu # Naval Academy Prep School allow from # test bench allow from # test bench allow from # test bench allow from # NAPS allow from # Navy Medical allow from # Navy Medical allow from # Joint Spectrum Command allow from # Alumni Association allow from allow from allow from

2. Access Control: “Basic” Whole directory AuthType Basic AuthUserFile /home/mXXX/public_html/.htpasswd AuthName "Members Only" require valid-user Per file AuthType Basic AuthUserFile /home/mXXX/public_html/.htpasswd AuthName "Members Only" require valid-user Can also list specific users Require user nchamber needham

3. Access Control: “Digest” Same as “Basic”, but AuthType is different: AuthType Digest Both Basic and Digest can also list specific users Require user nchamber needham Create the password file: htpasswd -c c:/wamp/.htpasswd username OR htdigest -c c:/wamp/.htpasswddigest realm username “-c” creates a new file – omit to just add new entry Provide the actual path to the password file Don’t store password file in the web space!

Where to get more info Textbook (some in Chapter 21) Redirection/rewriting –Simple overview –Not-so-simple details Access control

Extra Info: Users and Passwords Don’t save passwords in plain text! Encryption: md5 –Basic approach, ok for normal sites –*Not collision resistant –Online databases can lookup common passwords! Perl requirements: –Use Digest::MD5 qw(md5 md5_hex) –my $hashed = md5_hex($password)