Xymon Mailing List Archive search

Securing Hobbit from visitors

23 messages in this thread

list Josh Luthman · Wed, 12 Mar 2008 00:58:16 -0400 · 
I am curious to see how the crew here on the mailing list secures their
Hobbit from the outside world.  I need to have the WWW pages visible from
every IP but only from certain people, therefor I need to use users and
passwords.  Our Hobbitmon is viewed via cell phones and computers (IE and
Firefox) and protected by an HTTP(S) login currently.  The problem is that
with three different Directory statements in httpd.conf, you need to login
three times every time you restart Firefox.

Also, how many businesses have Hobbitmon wide open for the viewing, such as
Henrik's demo, if any?

-- 
Josh Luthman
Office: XXX-XXX-XXXX
Direct: XXX-XXX-XXXX
XXXX Wayne St
Suite XXXX
Troy, OH XXXXX

Those who don't understand UNIX are condemned to reinvent it, poorly.
--- Henry Spencer
list Ben · Tue, 11 Mar 2008 22:39:57 -0700 · 
We don't have ours open (in fact very we keep access as limited in
scope as is necessary; in our environment we can so we do - thank
goodness for socks5 and ssh), but a little time testing yields answers
for the auth question.

Set the same realm (AuthName directive) and password auth file(s)
(AuthUserFile and optionally AuthGroupFile if using groups -
recommended for multiple users so you can give everyone their own
accounts, manage them simply via group management, and safely revoke
access when needed) in all three locations.  That will do the trick
(Tested via Firefox, Opera, and Epiphany).  Even setting the same
password file(s) should be sufficient most of the time.  I even can
create the same user/pass credentials in separate password files and
login only once to access all three locations.

Ben

On Tue, Mar 11, 2008 at 9:58 PM, Josh Luthman
▸ quoted from Josh Luthman
<user-4c45a83f15cb@xymon.invalid> wrote:
I am curious to see how the crew here on the mailing list secures their
Hobbit from the outside world.  I need to have the WWW pages visible from
every IP but only from certain people, therefor I need to use users and
passwords.  Our Hobbitmon is viewed via cell phones and computers (IE and
Firefox) and protected by an HTTP(S) login currently.  The problem is that
with three different Directory statements in httpd.conf, you need to login
three times every time you restart Firefox.

Also, how many businesses have Hobbitmon wide open for the viewing, such as
Henrik's demo, if any?

--
Josh Luthman
Office: XXX-XXX-XXXX
Direct: XXX-XXX-XXXX
XXXX Wayne St
Suite XXXX
 Troy, OH XXXXX

Those who don't understand UNIX are condemned to reinvent it, poorly.
--- Henry Spencer
list Ben · Tue, 11 Mar 2008 22:44:28 -0700 · 
PS: We're running LAMP stack Apache 2.0 should it make a difference.
▸ quoted from Ben

On Tue, Mar 11, 2008 at 10:39 PM, Ben <user-b723e840da44@xymon.invalid> wrote:
We don't have ours open (in fact very we keep access as limited in
 scope as is necessary; in our environment we can so we do - thank
 goodness for socks5 and ssh), but a little time testing yields answers
 for the auth question.

 Set the same realm (AuthName directive) and password auth file(s)
 (AuthUserFile and optionally AuthGroupFile if using groups -
 recommended for multiple users so you can give everyone their own
 accounts, manage them simply via group management, and safely revoke
 access when needed) in all three locations.  That will do the trick
 (Tested via Firefox, Opera, and Epiphany).  Even setting the same
 password file(s) should be sufficient most of the time.  I even can
 create the same user/pass credentials in separate password files and
 login only once to access all three locations.

 Ben


 On Tue, Mar 11, 2008 at 9:58 PM, Josh Luthman
 <user-4c45a83f15cb@xymon.invalid> wrote:
I am curious to see how the crew here on the mailing list secures their
Hobbit from the outside world.  I need to have the WWW pages visible from
every IP but only from certain people, therefor I need to use users and
passwords.  Our Hobbitmon is viewed via cell phones and computers (IE and
Firefox) and protected by an HTTP(S) login currently.  The problem is that
with three different Directory statements in httpd.conf, you need to login
three times every time you restart Firefox.

Also, how many businesses have Hobbitmon wide open for the viewing, such as
Henrik's demo, if any?

--
Josh Luthman
Office: XXX-XXX-XXXX
Direct: XXX-XXX-XXXX
XXXX Wayne St
Suite XXXX
 Troy, OH XXXXX

Those who don't understand UNIX are condemned to reinvent it, poorly.
--- Henry Spencer
list Ben · Tue, 11 Mar 2008 22:56:03 -0700 · 
PPS:  And for the record, I wouldn't have known myself until I tried
it out to know (I sounded a little short in my initial reply and
didn't want you to think I meant you should have known better).  Thank
you, for helping me learn something new today :-)
▸ quoted from Ben

Ben

On Tue, Mar 11, 2008 at 10:44 PM, Ben <user-b723e840da44@xymon.invalid> wrote:
PS: We're running LAMP stack Apache 2.0 should it make a difference.


 On Tue, Mar 11, 2008 at 10:39 PM, Ben <user-b723e840da44@xymon.invalid> wrote:
We don't have ours open (in fact very we keep access as limited in
 scope as is necessary; in our environment we can so we do - thank
 goodness for socks5 and ssh), but a little time testing yields answers
 for the auth question.

 Set the same realm (AuthName directive) and password auth file(s)
 (AuthUserFile and optionally AuthGroupFile if using groups -
 recommended for multiple users so you can give everyone their own
 accounts, manage them simply via group management, and safely revoke
 access when needed) in all three locations.  That will do the trick
 (Tested via Firefox, Opera, and Epiphany).  Even setting the same
 password file(s) should be sufficient most of the time.  I even can
 create the same user/pass credentials in separate password files and
 login only once to access all three locations.

 Ben
list Dirk Kastens · Wed, 12 Mar 2008 08:44:28 +0100 · 
Also, how many businesses have Hobbitmon wide open for the viewing, such as Henrik's demo, if any?
Our hobbit is open for the whole subnet, but before you see the details (if you click on a test icon) you have to authenticate yourself. Only some admins are allowed to see the details. This is done by configuring "require user" statements for the /hobbit-cgi and /hobbit-seccgi aliases inside the httpd.conf file.

-- 
Regards,

Dirk Kastens
Universitaet Osnabrueck, Rechenzentrum (Computer Center)
Albrechtstr. 28, 49069 Osnabrueck, Germany
Tel.: +XX-XXX-XXX-XXXX, FAX: -2470
list H. Klomp · Wed, 12 Mar 2008 09:16:47 +0100 · 
We only have hobbit open from the internal network.
But only system engineers are capable of using the scripts in the cgi-secure directory.

Regards,
Bert Klomp
▸ quoted from Josh Luthman


From: Josh Luthman [mailto:user-4c45a83f15cb@xymon.invalid]
Sent: woensdag 12 maart 2008 5:58
To: user-ae9b8668bcde@xymon.invalid
Subject: [hobbit] Securing Hobbit from visitors

I am curious to see how the crew here on the mailing list secures their Hobbit from the outside world.  I need to have the WWW pages visible from every IP but only from certain people, therefor I need to use users and passwords.  Our Hobbitmon is viewed via cell phones and computers (IE and Firefox) and protected by an HTTP(S) login currently.  The problem is that with three different Directory statements in httpd.conf, you need to login three times every time you restart Firefox.

Also, how many businesses have Hobbitmon wide open for the viewing, such as Henrik's demo, if any?

--
Josh Luthman
Office: XXX-XXX-XXXX
Direct: XXX-XXX-XXXX
XXXX Wayne St
Suite XXXX
Troy, OH XXXXX

Those who don't understand UNIX are condemned to reinvent it, poorly.
--- Henry Spencer
list Buchan Milne · Wed, 12 Mar 2008 10:21:56 +0200 ·
▸ quoted from Josh Luthman
On Wednesday 12 March 2008 06:58:16 Josh Luthman wrote:
I am curious to see how the crew here on the mailing list secures their
Hobbit from the outside world.  I need to have the WWW pages visible from
every IP but only from certain people, therefor I need to use users and
passwords.  Our Hobbitmon is viewed via cell phones and computers (IE and
Firefox) and protected by an HTTP(S) login currently.  The problem is that
with three different Directory statements in httpd.conf, you need to login
three times every time you restart Firefox.

Also, how many businesses have Hobbitmon wide open for the viewing, such as
Henrik's demo, if any?

We run ours requiring authentication of a valid user in our LDAP directory for any access to Hobbit at all, and membership of the monitoring group in LDAP for access to the /hobbit-seccgi location. This allows to (besides reduce user management overhead) have password expiration, lockout, etc. etc.

If you use the same authentication source in all the directory statements, users should not have to authenticate more than once (we don't). Even if you do authorization only on /hobbit-seccgi.

This is really more of an Apache thing than anything else ... but you may want to post the authentication aspects of your apache configuration for Hobbit if you need more assistance.

Regards,
Buchan
list Josh Luthman · Wed, 12 Mar 2008 08:14:41 -0400 · 
This is what I have in httpd.conf that makes me login three times (you can
tell which three, obviously =)

Alias /hobbit/  "/hobbitdir/server/www/"
<Directory "/hobbitdir/server/www">
    Options Indexes FollowSymLinks Includes MultiViews
    Order allow,deny
    Allow from all
  AuthUserFile /hobbitdir/server/etc/hobbitpasswd
  AuthType Basic
  AuthName "Hobbit Monitoring1"
  Require valid-user
</Directory>

ScriptAlias /hobbit-cgi/ "/hobbitdir/cgi-bin/"
<Directory "/hobbitdir/cgi-bin">
    AllowOverride None
    Options ExecCGI Includes
    Order allow,deny
    Allow from all
  AuthUserFile /hobbitdir/server/etc/hobbitpasswd
  AuthType Basic
  AuthName "Hobbit Monitoring2"
  Require valid-user
</Directory>

ScriptAlias /hobbit-seccgi/ "/hobbitdir/cgi-secure/"
<Directory "/hobbitdir/cgi-secure">
    AllowOverride None
    Options ExecCGI Includes
    Order allow,deny
    Allow from all

    AuthUserFile /hobbitdir/server/etc/hobbitpasswd
    AuthGroupFile /hobbitdir/server/etc/hobbitgroups
    AuthType Basic
    AuthName "Hobbit Monitoring3"
    Require valid-user
    Require group group4admin
</Directory>
▸ quoted from Buchan Milne


On 3/12/08, Buchan Milne <user-9b139aff4dec@xymon.invalid> wrote:
On Wednesday 12 March 2008 06:58:16 Josh Luthman wrote:
I am curious to see how the crew here on the mailing list secures their
Hobbit from the outside world.  I need to have the WWW pages visible
from
every IP but only from certain people, therefor I need to use users and
passwords.  Our Hobbitmon is viewed via cell phones and computers (IE
and
Firefox) and protected by an HTTP(S) login currently.  The problem is
that
with three different Directory statements in httpd.conf, you need to
login
three times every time you restart Firefox.

Also, how many businesses have Hobbitmon wide open for the viewing, such
as
Henrik's demo, if any?

We run ours requiring authentication of a valid user in our LDAP directory
for
any access to Hobbit at all, and membership of the monitoring group in
LDAP
for access to the /hobbit-seccgi location. This allows to (besides reduce
user management overhead) have password expiration, lockout, etc. etc.

If you use the same authentication source in all the directory statements,
users should not have to authenticate more than once (we don't). Even if
you
do authorization only on /hobbit-seccgi.

This is really more of an Apache thing than anything else ... but you may
want
to post the authentication aspects of your apache configuration for Hobbit
if
you need more assistance.

Regards,

Buchan

-- 
Josh Luthman
Office: XXX-XXX-XXXX
Direct: XXX-XXX-XXXX
XXXX Wayne St
Suite XXXX
Troy, OH XXXXX

Those who don't understand UNIX are condemned to reinvent it, poorly.
--- Henry Spencer
list Buchan Milne · Wed, 12 Mar 2008 15:11:31 +0200 ·
▸ quoted from Josh Luthman
On Wednesday 12 March 2008 14:14:41 Josh Luthman wrote:
This is what I have in httpd.conf that makes me login three times (you can
tell which three, obviously =)

Alias /hobbit/  "/hobbitdir/server/www/"
<Directory "/hobbitdir/server/www">
    Options Indexes FollowSymLinks Includes MultiViews
    Order allow,deny
    Allow from all
  AuthUserFile /hobbitdir/server/etc/hobbitpasswd
  AuthType Basic
  AuthName "Hobbit Monitoring1"
  Require valid-user
</Directory>

ScriptAlias /hobbit-cgi/ "/hobbitdir/cgi-bin/"
<Directory "/hobbitdir/cgi-bin">
    AllowOverride None
    Options ExecCGI Includes
    Order allow,deny
    Allow from all
  AuthUserFile /hobbitdir/server/etc/hobbitpasswd
  AuthType Basic
  AuthName "Hobbit Monitoring2"
  Require valid-user
</Directory>

ScriptAlias /hobbit-seccgi/ "/hobbitdir/cgi-secure/"
<Directory "/hobbitdir/cgi-secure">
    AllowOverride None
    Options ExecCGI Includes
    Order allow,deny
    Allow from all

    AuthUserFile /hobbitdir/server/etc/hobbitpasswd
    AuthGroupFile /hobbitdir/server/etc/hobbitgroups
    AuthType Basic
    AuthName "Hobbit Monitoring3"
    Require valid-user
    Require group group4admin
</Directory>
If you use the same AuthName, most likely you users should not need to log in 
more than once. Was there a reason you used different ones.


Regards,
Buchan
list Josh Luthman · Wed, 12 Mar 2008 10:24:54 -0400 · 
Buchan,

First of all I want to point out you don't need to email both the mailing
list and me, the point of the mailing list is that there is one reply
address =P  Simply email user-ae9b8668bcde@xymon.invalid (without modifying the subject) and
everyone will get your message.  It will make it more visually friendly =)

Secondly, there are three different "virtual directories" requiring the
three different authentication statements.  The problem is that there are
now three places to login at, the /hobbit and /hobbit-cgi and /hobbit-cgisec
and it gets very irritating.  I don't mind logging in once, but when you
navigate through pages and have to login again for the same application is
looks pretty ridiculous.

Can you show me an example of your LDAP authentication configuration (on
Apache), Buchan?

Josh
▸ quoted from Buchan Milne

On 3/12/08, Buchan Milne <user-9b139aff4dec@xymon.invalid> wrote:
On Wednesday 12 March 2008 14:14:41 Josh Luthman wrote:
This is what I have in httpd.conf that makes me login three times (you
can
tell which three, obviously =)

Alias /hobbit/  "/hobbitdir/server/www/"
<Directory "/hobbitdir/server/www">
    Options Indexes FollowSymLinks Includes MultiViews
    Order allow,deny
    Allow from all
  AuthUserFile /hobbitdir/server/etc/hobbitpasswd
  AuthType Basic
  AuthName "Hobbit Monitoring1"
  Require valid-user
</Directory>

ScriptAlias /hobbit-cgi/ "/hobbitdir/cgi-bin/"
<Directory "/hobbitdir/cgi-bin">
    AllowOverride None
    Options ExecCGI Includes
    Order allow,deny
    Allow from all
  AuthUserFile /hobbitdir/server/etc/hobbitpasswd
  AuthType Basic
  AuthName "Hobbit Monitoring2"
  Require valid-user
</Directory>

ScriptAlias /hobbit-seccgi/ "/hobbitdir/cgi-secure/"
<Directory "/hobbitdir/cgi-secure">
    AllowOverride None
    Options ExecCGI Includes
    Order allow,deny
    Allow from all

    AuthUserFile /hobbitdir/server/etc/hobbitpasswd
    AuthGroupFile /hobbitdir/server/etc/hobbitgroups
    AuthType Basic
    AuthName "Hobbit Monitoring3"
    Require valid-user
    Require group group4admin
</Directory>

If you use the same AuthName, most likely you users should not need to log
in
more than once. Was there a reason you used different ones.


Regards,

Buchan

-- 
Josh Luthman
Office: XXX-XXX-XXXX
Direct: XXX-XXX-XXXX
XXXX Wayne St
Suite XXXX
Troy, OH XXXXX

Those who don't understand UNIX are condemned to reinvent it, poorly.
--- Henry Spencer
list Dirk Kastens · Wed, 12 Mar 2008 17:38:37 +0100 · 
Josh,

Secondly, there are three different "virtual directories" requiring the three different authentication statements.  The problem is that there are now three places to login at, the /hobbit and /hobbit-cgi and /hobbit-cgisec and it gets very irritating.  I don't mind logging in once, but when you navigate through pages and have to login again for the same application is looks pretty ridiculous.
  AuthName "Hobbit Monitoring1"
  AuthName "Hobbit Monitoring2"
    AuthName "Hobbit Monitoring3"
And that's what Buchan wanted to point out: why do you use three different AuthNames? Just use the same AuthName for your three alias entries and everything will be fine. Your users only will have to authenticate once.
▸ quoted from Dirk Kastens

-- 
Regards,

Dirk Kastens
Universitaet Osnabrueck, Rechenzentrum (Computer Center)
Albrechtstr. 28, 49069 Osnabrueck, Germany
Tel.: +XX-XXX-XXX-XXXX, FAX: -2470
list Josh Luthman · Wed, 12 Mar 2008 13:13:47 -0400 · 
Forgot all about that - I originally had the lines...

AuthName "Hobbit Monitoring"

Then I added the 1, 2 and 3 to the ends of them to identify/confirm where
the secondary and tertiary logins were coming from (obviously, the Alias
statements =)

There was no change before/after the number after the AuthName

Josh
▸ quoted from Dirk Kastens

On 3/12/08, Dirk Kastens <user-e4253f8fc63b@xymon.invalid> wrote:
Josh,


Secondly, there are three different "virtual directories" requiring the
three different authentication statements.  The problem is that there
are now three places to login at, the /hobbit and /hobbit-cgi and
/hobbit-cgisec and it gets very irritating.  I don't mind logging in
once, but when you navigate through pages and have to login again for
the same application is looks pretty ridiculous.
  AuthName "Hobbit Monitoring1"
  AuthName "Hobbit Monitoring2"
    AuthName "Hobbit Monitoring3"
And that's what Buchan wanted to point out: why do you use three
different AuthNames? Just use the same AuthName for your three alias
entries and everything will be fine. Your users only will have to
authenticate once.


--
Regards,

Dirk Kastens
Universitaet Osnabrueck, Rechenzentrum (Computer Center)
Albrechtstr. 28, 49069 Osnabrueck, Germany
Tel.: +XX-XXX-XXX-XXXX, FAX: -2470


-- 
Josh Luthman
Office: XXX-XXX-XXXX
Direct: XXX-XXX-XXXX
XXXX Wayne St
Suite XXXX
Troy, OH XXXXX

Those who don't understand UNIX are condemned to reinvent it, poorly.
--- Henry Spencer
list Stef Coene · Wed, 12 Mar 2008 18:40:12 +0100 ·
▸ quoted from Josh Luthman
On Wednesday 12 March 2008, Josh Luthman wrote:
I am curious to see how the crew here on the mailing list secures their
Hobbit from the outside world.  I need to have the WWW pages visible from
every IP but only from certain people, therefor I need to use users and
passwords.  Our Hobbitmon is viewed via cell phones and computers (IE and
Firefox) and protected by an HTTP(S) login currently.  The problem is that
with three different Directory statements in httpd.conf, you need to login
three times every time you restart Firefox.

Also, how many businesses have Hobbitmon wide open for the viewing, such as
Henrik's demo, if any?
I just found out the nice module Apache2-AuthenMSAD.  Very small module, very 
easy to install, very easy to change and adapt.  It authenticate the user 
against the windows domain, it just tries an ldap connection with the 
supplied username and password.  This is the authentication part of apache:

AuthName "Windows domain login"
AuthType Basic

# Authentication  method/handler
PerlAuthenHandler Apache2::AuthenMSAD
PerlSetVar MSADDomain WindowsDomain
PerlSetVar MSADServer DomainController

# Require lines can be any of the following -- any user, one of a list
require valid-user


Stef
list Josh Luthman · Wed, 12 Mar 2008 13:49:17 -0400 · 
That is very cool information, but everyone is out and about so we don't use
a domain =(
▸ quoted from Stef Coene

On 3/12/08, Stef Coene <user-dbffe946c0f4@xymon.invalid> wrote:
On Wednesday 12 March 2008, Josh Luthman wrote:
I am curious to see how the crew here on the mailing list secures their
Hobbit from the outside world.  I need to have the WWW pages visible
from
every IP but only from certain people, therefor I need to use users and
passwords.  Our Hobbitmon is viewed via cell phones and computers (IE
and
Firefox) and protected by an HTTP(S) login currently.  The problem is
that
with three different Directory statements in httpd.conf, you need to
login
three times every time you restart Firefox.

Also, how many businesses have Hobbitmon wide open for the viewing, such
as
Henrik's demo, if any?
I just found out the nice module Apache2-AuthenMSAD.  Very small module,
very
easy to install, very easy to change and adapt.  It authenticate the user
against the windows domain, it just tries an ldap connection with the
supplied username and password.  This is the authentication part of
apache:

AuthName "Windows domain login"
AuthType Basic

# Authentication  method/handler
PerlAuthenHandler Apache2::AuthenMSAD
PerlSetVar MSADDomain WindowsDomain
PerlSetVar MSADServer DomainController

# Require lines can be any of the following -- any user, one of a list
require valid-user


Stef


-- 
Josh Luthman
Office: XXX-XXX-XXXX
Direct: XXX-XXX-XXXX
XXXX Wayne St
Suite XXXX
Troy, OH XXXXX

Those who don't understand UNIX are condemned to reinvent it, poorly.
--- Henry Spencer
list Dirk Kastens · Thu, 13 Mar 2008 09:01:31 +0100 ·
▸ quoted from Josh Luthman
Josh Luthman schrieb:
Forgot all about that - I originally had the lines...

AuthName "Hobbit Monitoring"

Then I added the 1, 2 and 3 to the ends of them to identify/confirm where the secondary and tertiary logins were coming from (obviously, the Alias statements =)

There was no change before/after the number after the AuthName
Then I don't know why it didn't work. I have the following configuration in my httpd.conf:

ScriptAlias /hobbit-cgi/ "/data1/hobbit/cgi-bin/"
<Directory "/data1/hobbit/cgi-bin">
...
     AuthName "LDAP-Kennung"
     AuthType basic
     AuthLDAPEnabled on
...
require user userA userB userC
</Directory>

ScriptAlias /hobbit-seccgi/ "/data1/hobbit/cgi-secure/"
<Directory "/data1/hobbit/cgi-secure">
...
     AuthName "LDAP-Kennung"
     AuthType basic
     AuthLDAPEnabled on
...
     require user userB userD
</Director>

When userB calls a script under /hobbit-cgi he has to authenticate against LDAP. When he then calls a script under /hobbit-seccgi he doesn't have to authenticate again, because apache regognizes the he already authenticated against the AuthName "LDAP-Kennung".
▸ quoted from Josh Luthman

Regards,

Dirk Kastens
Universitaet Osnabrueck, Rechenzentrum (Computer Center)
Albrechtstr. 28, 49069 Osnabrueck, Germany
Tel.: +XX-XXX-XXX-XXXX, FAX: -2470
list T.J. Yang · Thu, 13 Mar 2008 04:59:03 -0600 · 
I got a working configuration in Solaris 10 with apache 2.x server.
What is your OS and apache version ?

lets document the fix here when problem is resolved.

http://en.wikibooks.org/wiki/System_Monitoring_with_Hobbit/Administration_Guide#LDAP_Authentication

tj
▸ quoted from Dirk Kastens

From: "Dirk Kastens" <user-e4253f8fc63b@xymon.invalid>
Sent: Thursday, March 13, 2008 2:01 AM
To: <user-ae9b8668bcde@xymon.invalid>
Subject: Re: [hobbit] Securing Hobbit from visitors

Josh Luthman schrieb:
Forgot all about that - I originally had the lines...

AuthName "Hobbit Monitoring"

Then I added the 1, 2 and 3 to the ends of them to identify/confirm where the secondary and tertiary logins were coming from (obviously, the Alias statements =)

There was no change before/after the number after the AuthName
Then I don't know why it didn't work. I have the following configuration in my httpd.conf:

ScriptAlias /hobbit-cgi/ "/data1/hobbit/cgi-bin/"
<Directory "/data1/hobbit/cgi-bin">
...
    AuthName "LDAP-Kennung"
    AuthType basic
    AuthLDAPEnabled on
...
require user userA userB userC
</Directory>

ScriptAlias /hobbit-seccgi/ "/data1/hobbit/cgi-secure/"
<Directory "/data1/hobbit/cgi-secure">
...
    AuthName "LDAP-Kennung"
    AuthType basic
    AuthLDAPEnabled on
...
    require user userB userD
</Director>

When userB calls a script under /hobbit-cgi he has to authenticate against LDAP. When he then calls a script under /hobbit-seccgi he doesn't have to authenticate again, because apache regognizes the he already authenticated against the AuthName "LDAP-Kennung".

Regards,

Dirk Kastens
Universitaet Osnabrueck, Rechenzentrum (Computer Center)
Albrechtstr. 28, 49069 Osnabrueck, Germany
Tel.: +XX-XXX-XXX-XXXX, FAX: -2470
list Josh Luthman · Thu, 13 Mar 2008 08:41:48 -0400 · 
CentOS release 5 (Final) and Apache/2.2.3

Is it possible that .htpasswd acts differently from LDAP?
▸ quoted from T.J. Yang

On 3/13/08, T.J. Yang <user-8e841282cda5@xymon.invalid> wrote:
I got a working configuration in Solaris 10 with apache 2.x server.
What is your OS and apache version ?

lets document the fix here when problem is resolved.


http://en.wikibooks.org/wiki/System_Monitoring_with_Hobbit/Administration_Guide#LDAP_Authentication

tj

From: "Dirk Kastens" <user-e4253f8fc63b@xymon.invalid>
Sent: Thursday, March 13, 2008 2:01 AM
To: <user-ae9b8668bcde@xymon.invalid>
Subject: Re: [hobbit] Securing Hobbit from visitors


Josh Luthman schrieb:
Forgot all about that - I originally had the lines...

AuthName "Hobbit Monitoring"

Then I added the 1, 2 and 3 to the ends of them to identify/confirm
where
the secondary and tertiary logins were coming from (obviously, the
Alias
statements =)

There was no change before/after the number after the AuthName
Then I don't know why it didn't work. I have the following configuration
in my httpd.conf:

ScriptAlias /hobbit-cgi/ "/data1/hobbit/cgi-bin/"
<Directory "/data1/hobbit/cgi-bin">
...
    AuthName "LDAP-Kennung"
    AuthType basic
    AuthLDAPEnabled on
...
require user userA userB userC
</Directory>

ScriptAlias /hobbit-seccgi/ "/data1/hobbit/cgi-secure/"
<Directory "/data1/hobbit/cgi-secure">
...
    AuthName "LDAP-Kennung"
    AuthType basic
    AuthLDAPEnabled on
...
    require user userB userD
</Director>

When userB calls a script under /hobbit-cgi he has to authenticate
against
LDAP. When he then calls a script under /hobbit-seccgi he doesn't have
to
authenticate again, because apache regognizes the he already
authenticated
against the AuthName "LDAP-Kennung".

Regards,

Dirk Kastens
Universitaet Osnabrueck, Rechenzentrum (Computer Center)
Albrechtstr. 28, 49069 Osnabrueck, Germany
Tel.: +XX-XXX-XXX-XXXX, FAX: -2470


-- 
Josh Luthman
Office: XXX-XXX-XXXX
Direct: XXX-XXX-XXXX
XXXX Wayne St
Suite XXXX
Troy, OH XXXXX

Those who don't understand UNIX are condemned to reinvent it, poorly.
--- Henry Spencer
list Galen Johnson · Thu, 13 Mar 2008 10:01:28 -0400 · 
Yes, it does since AuthLDAP requires additional binding and search information in order to get the user info.

=G=
▸ quoted from Josh Luthman

From: Josh Luthman [mailto:user-4c45a83f15cb@xymon.invalid]
Sent: Thursday, March 13, 2008 8:42 AM
To: user-ae9b8668bcde@xymon.invalid
Subject: Re: [hobbit] Securing Hobbit from visitors

CentOS release 5 (Final) and Apache/2.2.3

Is it possible that .htpasswd acts differently from LDAP?
On 3/13/08, T.J. Yang <user-8e841282cda5@xymon.invalid<mailto:user-8e841282cda5@xymon.invalid>> wrote:
I got a working configuration in Solaris 10 with apache 2.x server.
What is your OS and apache version ?

lets document the fix here when problem is resolved.

http://en.wikibooks.org/wiki/System_Monitoring_with_Hobbit/Administration_Guide#LDAP_Authentication

tj

From: "Dirk Kastens" <user-e4253f8fc63b@xymon.invalid<mailto:user-e4253f8fc63b@xymon.invalid>>
Sent: Thursday, March 13, 2008 2:01 AM
To: <user-ae9b8668bcde@xymon.invalid<mailto:user-ae9b8668bcde@xymon.invalid>>
Subject: Re: [hobbit] Securing Hobbit from visitors


Josh Luthman schrieb:
Forgot all about that - I originally had the lines...

AuthName "Hobbit Monitoring"

Then I added the 1, 2 and 3 to the ends of them to identify/confirm where
the secondary and tertiary logins were coming from (obviously, the Alias
statements =)

There was no change before/after the number after the AuthName
Then I don't know why it didn't work. I have the following configuration
in my httpd.conf:

ScriptAlias /hobbit-cgi/ "/data1/hobbit/cgi-bin/"
<Directory "/data1/hobbit/cgi-bin">
...
    AuthName "LDAP-Kennung"
    AuthType basic
    AuthLDAPEnabled on
...
require user userA userB userC
</Directory>

ScriptAlias /hobbit-seccgi/ "/data1/hobbit/cgi-secure/"
<Directory "/data1/hobbit/cgi-secure">
...
    AuthName "LDAP-Kennung"
    AuthType basic
    AuthLDAPEnabled on
...
    require user userB userD
</Director>

When userB calls a script under /hobbit-cgi he has to authenticate against
LDAP. When he then calls a script under /hobbit-seccgi he doesn't have to
authenticate again, because apache regognizes the he already authenticated
against the AuthName "LDAP-Kennung".

Regards,

Dirk Kastens
Universitaet Osnabrueck, Rechenzentrum (Computer Center)
Albrechtstr. 28, 49069 Osnabrueck, Germany
Tel.: +XX-XXX-XXX-XXXX, FAX: -2470


--
Josh Luthman
Office: XXX-XXX-XXXX
Direct: XXX-XXX-XXXX
XXXX Wayne St
Suite XXXX
Troy, OH XXXXX

Those who don't understand UNIX are condemned to reinvent it, poorly.
--- Henry Spencer
list Buchan Milne · Thu, 13 Mar 2008 16:17:49 +0200 ·
▸ quoted from T.J. Yang
On Thursday 13 March 2008 12:59:03 T.J. Yang wrote:
I got a working configuration in Solaris 10 with apache 2.x server.
What is your OS and apache version ?

lets document the fix here when problem is resolved.


http://en.wikibooks.org/wiki/System_Monitoring_with_Hobbit/Administration_G
uide#LDAP_Authentication
Uh, why document Apache ??? The Apache people have documented it sufficiently.

Regards,
Buchan
list Josh Luthman · Thu, 13 Mar 2008 10:31:39 -0400 · 
It's more Apache configuration specifically for Hobbit at this point.  That
is why it was suggested we document our configuration for Hobbit specifics
on the Hobbit wiki page.

Does anyone have any ideas as far as what I can do with authentication
excluding using LDAP?

Josh
▸ quoted from Buchan Milne

On 3/13/08, Buchan Milne <user-9b139aff4dec@xymon.invalid> wrote:
On Thursday 13 March 2008 12:59:03 T.J. Yang wrote:
I got a working configuration in Solaris 10 with apache 2.x server.
What is your OS and apache version ?

lets document the fix here when problem is resolved.


http://en.wikibooks.org/wiki/System_Monitoring_with_Hobbit/Administration_G
uide#LDAP_Authentication

Uh, why document Apache ??? The Apache people have documented it
sufficiently.

Regards,

Buchan


-- 
Josh Luthman
Office: XXX-XXX-XXXX
Direct: XXX-XXX-XXXX
XXXX Wayne St
Suite XXXX
Troy, OH XXXXX

Those who don't understand UNIX are condemned to reinvent it, poorly.
--- Henry Spencer
list Buchan Milne · Thu, 13 Mar 2008 17:07:02 +0200 ·
▸ quoted from Galen Johnson
On Thursday 13 March 2008 16:01:28 Galen Johnson wrote:
Yes, it does since AuthLDAP requires additional binding and search
information in order to get the user info.
Sure, but how the "authentication realm" is handled should not.

I will see if I can test quickly here ...
list Galen Johnson · Thu, 13 Mar 2008 12:49:03 -0400 · 
There are other Authentication modules availabe for apache as well that you could consider...however, one thing to keep in mind is do you want your monitoring solution to depend on something you monitor (yes, I realize it currently is but even if the web is down, you may still get notices).  Without knowing how you have your htaccess files set up you may want to consider using group definitions within them.
▸ quoted from Josh Luthman

=G=

From: Josh Luthman [mailto:user-4c45a83f15cb@xymon.invalid]
Sent: Thursday, March 13, 2008 10:32 AM
To: user-ae9b8668bcde@xymon.invalid
Cc: T.J. Yang
Subject: Re: [hobbit] Securing Hobbit from visitors

It's more Apache configuration specifically for Hobbit at this point.  That is why it was suggested we document our configuration for Hobbit specifics on the Hobbit wiki page.

Does anyone have any ideas as far as what I can do with authentication excluding using LDAP?

Josh
On 3/13/08, Buchan Milne <user-9b139aff4dec@xymon.invalid<mailto:user-9b139aff4dec@xymon.invalid>> wrote:
On Thursday 13 March 2008 12:59:03 T.J. Yang wrote:
I got a working configuration in Solaris 10 with apache 2.x server.
What is your OS and apache version ?

lets document the fix here when problem is resolved.

http://en.wikibooks.org/wiki/System_Monitoring_with_Hobbit/Administration_G
uide#LDAP_Authentication

Uh, why document Apache ??? The Apache people have documented it sufficiently.

Regards,

Buchan


--
Josh Luthman
Office: XXX-XXX-XXXX
Direct: XXX-XXX-XXXX
XXXX Wayne St
Suite XXXX
Troy, OH XXXXX

Those who don't understand UNIX are condemned to reinvent it, poorly.
--- Henry Spencer
list Josh Luthman · Thu, 13 Mar 2008 13:06:29 -0400 · 
Galen - I don't have .htaccess files overwriting the configuration of
httpd.conf - everything is in there (except for the htpasswd with
users/passwords/groups).  The configuration that applies was pasted above in
a previous email.  I don't want to flood everyone screen with configuration
again =)

We do use the BBTray tool to get notified, too, but I'd be willing to drop
that for a solid solution.

Josh
▸ quoted from Galen Johnson

On 3/13/08, Galen Johnson <user-87f955643e3d@xymon.invalid> wrote:
 There are other Authentication modules availabe for apache as well that
you could consider…however, one thing to keep in mind is do you want your
monitoring solution to depend on something you monitor (yes, I realize it
currently is but even if the web is down, you may still get notices).
Without knowing how you have your htaccess files set up you may want to
consider using group definitions within them.


=G=


*From:* Josh Luthman [mailto:user-4c45a83f15cb@xymon.invalid]
*Sent:* Thursday, March 13, 2008 10:32 AM
*To:* user-ae9b8668bcde@xymon.invalid
*Cc:* T.J. Yang
*Subject:* Re: [hobbit] Securing Hobbit from visitors


It's more Apache configuration specifically for Hobbit at this point.
That is why it was suggested we document our configuration for Hobbit
specifics on the Hobbit wiki page.

Does anyone have any ideas as far as what I can do with authentication
excluding using LDAP?

Josh

On 3/13/08, *Buchan Milne* <user-9b139aff4dec@xymon.invalid> wrote:

On Thursday 13 March 2008 12:59:03 T.J. Yang wrote:
I got a working configuration in Solaris 10 with apache 2.x server.
What is your OS and apache version ?

lets document the fix here when problem is resolved.


http://en.wikibooks.org/wiki/System_Monitoring_with_Hobbit/Administration_G
uide#LDAP_Authentication

Uh, why document Apache ??? The Apache people have documented it
sufficiently.

Regards,

Buchan


--
Josh Luthman
Office: XXX-XXX-XXXX
Direct: XXX-XXX-XXXX
XXXX Wayne St
Suite XXXX
Troy, OH XXXXX

Those who don't understand UNIX are condemned to reinvent it, poorly.
--- Henry Spencer

-- 
Josh Luthman
Office: XXX-XXX-XXXX
Direct: XXX-XXX-XXXX
XXXX Wayne St
Suite XXXX
Troy, OH XXXXX

Those who don't understand UNIX are condemned to reinvent it, poorly.
--- Henry Spencer