NetManage Web Server - Security


Basic Authentication

Basic Authentication is a standard HTTP protocol for prompting users for username and password information, in order to control casual access to certain documents.

Basic Authentication was not designed to be a robustly secure system - it does not encrypt data flow, nor is password encryption very sophisticated. However, it does exclude casual users from browsing certain portions of your server's Web space.

The Windows95, NT and NT Server versions of NetManage's Web Server supports an early implementation of Basic Authentication:

One Web Server feature not supported on other web servers is Basic Authentication support for CGI:

Overview

Basic Authentication on Web Server is controlled through Groups. Groups are authorized to access a customizable list of secure directories. Users that are members of those lists are in turn authorized to access documents in those secure directories.

Groups are unique to each port number: a group named Testers on port 80 is unrelated to another group named Testers on port 443. Each user name must be unique for all server ports on the system.

Each group has a cgi-bin subdirectory for CGI scripts that can only be executed by members of that group.

Web Server recognizes two special groups: ROOT and ADMIN. ROOT users have complete authority over all server ports on the server, and are authorized to create/delete other ROOT and ADMIN users. ADMIN users have complete authority over their authorized port and control user access to groups on that port server.


ROOT

Root Administrators belong to the ROOT group, are created via the Security Configuration dialog.

The ROOT group has a private cgi-bin subdirectory called admin.sec. CGI scripts within this directory can be remotely executed only by Root Administrators, using the following URL form: http://HOST:PORT/cgi-bin/admin/SCRIPT, where SCRIPT is the name of the CGI script stored in the admin.sec directory.

The cgi-bin\admin.sec directory also contains Web Server's user list: users.ini. This list is maintained via the Users section of the Security Configuration dialog.

In this release, the list is clear-text form and appears as follows:

	;Add Users here.
	;
	;These are users that are authorized to access secure documents
	;on this server.
	;
	;Format: user_name = password
	;
	[USERS]
	guest=guest
	nmtest=test


	;Define User Info here.
	[guest]
	email=
	name=Guest User
	desc=Guest User

	[nmtest]
	email=info@netmanage.com
	name=Mr. Info
	desc=NetManage Information
The [Users] section lists all authorized users, with their passwords. ROOT and ADMIN users do not show up here.

This is followed by sections for each user, containing information about them. The email entry is used to provide CGI scripts with the HTTP_FROM CGI variable, if none is supplied by the web client.


ADMIN

Server Administrators belong to the ADMIN group, are created by ROOT Administrators via the Security Configuration dialog.

Each Web Server port has a separate ADMIN group. Each port has a cgi-bin subdirectory in the form of w3sXXX, where XXX is the port number. Within this is an admin.sec subdirectory that houses the private CGI scripts of the Server Administrators of that port. For example, the administrators subdirectory for port 80 would be in cgi-bin\w3s80\admin.sec, and the URL form to access them is http://HOST:PORT/cgi-bin/admin/SCRIPT.

The Server Administrator's private directory (cgi-bin\w3sXXX\admin.sec) also contains two key files used in Web Server's Basic Authentication: groups.ini and security.ini.


USERS

All other users are created by Root and Server Administrators, via the Security Configuration dialog. Non-administrator users may access secure areas only if they belong to a group that has been authorized to access that area.

A SECURITY.INI file defines which groups have access to secured areas; A GROUPS.INI file defines which users belong to given groups. This release of Web Server does not provide a dialog for defining or managing groups; these files must currently be edited manually.

Each group may have their own private cgi-bin script subdirectories - for example, a Testers group on port 80 would have thier private CGI scripts stored in cgi-bin\w3s80\testers, and the URL form to access them is http://HOST:PORT/cgi-bin/group/testers/SCRIPT.


GROUP.INI

The group list (groups.ini) is stored in each server administrator's admin.sec directory. This controls which users are members of a group. The format is as follows:
	;Add Groups here.
	;
	;These are groups that are authorized to access secure documents
	;on this web port.
	;
	;Format: group_name = "Description"
	;
	[Groups]
	Guests="Guests of this site"
	NMTester="NetManage Web Testers"


	;Add Group's User List here.
	;
	;Format: user_name = "Description"
	;
	[Guests]
	Guest="Guest user"
	nmtest="Default test user"

	[NMTester]
	nmtest="Default test user"
The [Groups] section lists the authorized group names and a description. This is followed by group sections which have lists of authorized users.

This Web Server release does not provide automated management of this list.

Note: a group subdirectory for each group should be created in the port's cgi-bin subdirectory - for example: cgi-bin\w3s80\testers


SECURITY.INI

The security.ini file controls which secure directories each group is authorized to access. The format is as follows:
	;Add Secure Paths here.
	;
	;This lists groups allowed to access secure directories
	;on this web port.
	;For performance reasons, all secure directories must have a .SEC extention.
	;
	;Note: the Realm should be unique each directory
	;
	[/guest.sec]
	Authentication=Basic
	Realm=Guest Directory
	Groups=Guests,NMTester

	[/test/test.sec]
	Authentication=Basic
	Realm=Secure Test Directory
	Groups=NMTester
Each section is a web path (logical path) that has been secured. For performance reasons, all secure paths must be have a .sec extension to be recognized as a secure directory.

The Athentication field for each group must be set to basic. The Realm field contains a description of the secure area; this is what the user will see in their browser's login dialog. The Groups field contains a comma-separated list of groups authorized to access this sub-directory.


Examples

Default groups and users have been set up as examples for testing Basic authentication. NOTE: this sample subdirectory may not be available in all Web Server releases.