Basic Authentication was not designed to be a robustly secure system - it does not encrypt data flow, nor is password encryption very sophisticated. However, it does exclude casual users from browsing certain portions of your server's Web space.
The Windows95, NT and NT Server versions of NetManage's Web Server supports an early implementation of Basic Authentication:
Groups are unique to each port number: a group named Testers on port 80 is unrelated to another group named Testers on port 443. Each user name must be unique for all server ports on the system.
Each group has a cgi-bin subdirectory for CGI scripts that can only be executed by members of that group.
Web Server recognizes two special groups: ROOT and ADMIN. ROOT users have complete authority over all server ports on the server, and are authorized to create/delete other ROOT and ADMIN users. ADMIN users have complete authority over their authorized port and control user access to groups on that port server.
The ROOT group has a private cgi-bin subdirectory called admin.sec. CGI scripts within this directory can be remotely executed only by Root Administrators, using the following URL form: http://HOST:PORT/cgi-bin/admin/SCRIPT, where SCRIPT is the name of the CGI script stored in the admin.sec directory.
The cgi-bin\admin.sec directory also contains Web Server's user list: users.ini. This list is maintained via the Users section of the Security Configuration dialog.
In this release, the list is clear-text form and appears as follows:
;Add Users here. ; ;These are users that are authorized to access secure documents ;on this server. ; ;Format: user_name = password ; [USERS] guest=guest nmtest=test ;Define User Info here. [guest] email= name=Guest User desc=Guest User [nmtest] email=info@netmanage.com name=Mr. Info desc=NetManage InformationThe [Users] section lists all authorized users, with their passwords. ROOT and ADMIN users do not show up here.
This is followed by sections for each user, containing information about them. The email entry is used to provide CGI scripts with the HTTP_FROM CGI variable, if none is supplied by the web client.
Each Web Server port has a separate ADMIN group. Each port has a cgi-bin subdirectory in the form of w3sXXX, where XXX is the port number. Within this is an admin.sec subdirectory that houses the private CGI scripts of the Server Administrators of that port. For example, the administrators subdirectory for port 80 would be in cgi-bin\w3s80\admin.sec, and the URL form to access them is http://HOST:PORT/cgi-bin/admin/SCRIPT.
The Server Administrator's private directory (cgi-bin\w3sXXX\admin.sec) also contains two key files used in Web Server's Basic Authentication: groups.ini and security.ini.
A SECURITY.INI file defines which groups have access to secured areas; A GROUPS.INI file defines which users belong to given groups. This release of Web Server does not provide a dialog for defining or managing groups; these files must currently be edited manually.
Each group may have their own private cgi-bin script subdirectories - for example, a Testers group on port 80 would have thier private CGI scripts stored in cgi-bin\w3s80\testers, and the URL form to access them is http://HOST:PORT/cgi-bin/group/testers/SCRIPT.
;Add Groups here. ; ;These are groups that are authorized to access secure documents ;on this web port. ; ;Format: group_name = "Description" ; [Groups] Guests="Guests of this site" NMTester="NetManage Web Testers" ;Add Group's User List here. ; ;Format: user_name = "Description" ; [Guests] Guest="Guest user" nmtest="Default test user" [NMTester] nmtest="Default test user"The [Groups] section lists the authorized group names and a description. This is followed by group sections which have lists of authorized users.
This Web Server release does not provide automated management of this list.
Note: a group subdirectory for each group should be created in the port's cgi-bin subdirectory - for example: cgi-bin\w3s80\testers
;Add Secure Paths here. ; ;This lists groups allowed to access secure directories ;on this web port. ;For performance reasons, all secure directories must have a .SEC extention. ; ;Note: the Realm should be unique each directory ; [/guest.sec] Authentication=Basic Realm=Guest Directory Groups=Guests,NMTester [/test/test.sec] Authentication=Basic Realm=Secure Test Directory Groups=NMTesterEach section is a web path (logical path) that has been secured. For performance reasons, all secure paths must be have a .sec extension to be recognized as a secure directory.
The Athentication field for each group must be set to basic. The Realm field contains a description of the secure area; this is what the user will see in their browser's login dialog. The Groups field contains a comma-separated list of groups authorized to access this sub-directory.