diff --git a/Makefile.in b/Makefile.in index b55160880a..df4a98a157 100644 --- a/Makefile.in +++ b/Makefile.in @@ -506,9 +506,6 @@ libuafs: libuafs_setup vlserver_depinstall tvlserver_depinstall rx_depinstall \ ${COMPILE_PART1} libuafs ${COMPILE_PART2} ;; \ esac -afsweb: kauth - +${COMPILE_PART1} afsweb ${COMPILE_PART2} - update: cmd comerr auth sys +${COMPILE_PART1} update ${COMPILE_PART2} @@ -717,7 +714,6 @@ clean2: -${COMPILE_PART1} tsm41 ${COMPILE_CLEAN} -${COMPILE_PART1} aklog ${COMPILE_CLEAN} -${COMPILE_PART1} pam ${COMPILE_CLEAN} - -${COMPILE_PART1} afsweb ${COMPILE_CLEAN} -${COMPILE_PART1} update ${COMPILE_CLEAN} -${COMPILE_PART1} log ${COMPILE_CLEAN} -${COMPILE_PART1} bu_utils ${COMPILE_CLEAN} @@ -790,7 +786,6 @@ distclean: clean src/afs/Makefile \ src/afsd/Makefile \ src/afsmonitor/Makefile \ - src/afsweb/Makefile \ src/aklog/Makefile \ src/audit/Makefile \ src/auth/Makefile \ diff --git a/configure.ac b/configure.ac index 36e0d0bfd8..2e45ed35dd 100644 --- a/configure.ac +++ b/configure.ac @@ -59,7 +59,6 @@ AC_CONFIG_FILES([ src/afs/Makefile src/afsd/Makefile src/afsmonitor/Makefile - src/afsweb/Makefile src/aklog/Makefile src/audit/Makefile src/auth/Makefile diff --git a/src/README.md b/src/README.md index 1a850856c4..04ee04ea19 100644 --- a/src/README.md +++ b/src/README.md @@ -166,7 +166,6 @@ longer actively maintained. | directory | description | | --------- | ----------- | -| afsweb | Authenticated AFS access for older versions of Apache | | kauth | Obsolete Kerberos-4 server (`kaserver`) and related programs | | log | Obsolete programs to show and forget Kerberos-4 tokens | | lwp | Lightweight user-level non-preemptive cooperative threading library | diff --git a/src/afsweb/Makefile.in b/src/afsweb/Makefile.in deleted file mode 100644 index d04c62d3e3..0000000000 --- a/src/afsweb/Makefile.in +++ /dev/null @@ -1,240 +0,0 @@ -# Copyright 2000, International Business Machines Corporation and others. -# All Rights Reserved. -# -# This software has been released under the terms of the IBM Public -# License. For details, see the LICENSE file in the top-level source -# directory or online at http://www.openafs.org/dl/license10.html - -srcdir=@srcdir@ -include @TOP_OBJDIR@/src/config/Makefile.config -include @TOP_OBJDIR@/src/config/Makefile.lwp - - - - -UKSRCS=nsafs.h nsafs.c securehash.c - -# -# Targets for Apache AFS Web Secure -# -APACHE_AFS_LIB=libapacheafs.a -APACHE_AFS_COMMON_LIB=libcommon.a - -BINARIES=weblog weblog_starter -SRC_MODULE=afs_module.c -## This module is made compatible with Apache 1.3.1 by including a file called -## ap_compat.h provided by Apache (basically all they do is #define all the old API calls -## as the new ones with ap_ prepended to the old API calls. The makefile takes care of this -## while building afs_module.c and adding the AFS_component_version_number.c file's contents -## in comments. - -APACHEAFS_DOC=README -APACHE_INSTALL_SCRIPT=afswsApache_config.sh -NETSCAPE_INSTALL_SCRIPT=afswsNetscape_config.sh - -system apache_afs_web_secure: - case "${SYS_NAME}" in \ - rs_aix* ) \ - echo Clean, make, and install the lib for 1.2 ; \ - $(MAKE) libclean ; \ - $(MAKE) AUX_CFLAGS=-DAIX $(APACHE_AFS_LIB) ; \ - ${INSTALL} -d ${DEST}/root.afsweb/lib/apache_1.2 ; \ - ${INSTALL_DATA} ${APACHE_AFS_LIB} ${DEST}/root.afsweb/lib/apache_1.2/${APACHE_AFS_LIB} ; \ - echo Make and install source for 1.2 ; \ - /bin/rm -f $(SRC_MODULE) ; \ - $(MAKE) $(SRC_MODULE) VERSION_CFLAG=-DAPACHE_1_2 ; \ - ${INSTALL} -d ${DEST}/root.afsweb/src/apache_1.2 ; \ - ${INSTALL_DATA} $(SRC_MODULE) ${DEST}/root.afsweb/src/apache_1.2/$(SRC_MODULE) ; \ - echo Make and install the lib for 1.3.1 ; \ - $(MAKE) libclean ; \ - $(MAKE) AUX_CFLAGS=-DAIX $(APACHE_AFS_LIB) VERSION_CFLAG="-DAPACHE_1_3 -DAPACHE_1_3_1" ; \ - ${INSTALL} -d ${DEST}/root.afsweb/lib/apache_1.3.1 ; \ - ${INSTALL_DATA} $(APACHE_AFS_LIB) ${DEST}/root.afsweb/lib/apache_1.3.1/$(APACHE_AFS_LIB) ; \ - echo Make and install source for 1.3.1 ; \ - /bin/rm -f $(SRC_MODULE) ; \ - $(MAKE) $(SRC_MODULE) VERSION_CFLAG="-DAPACHE_1_3 -DAPACHE_1_3_1" ; \ - ${INSTALL} -d ${DEST}/root.afsweb/src/apache_1.3.1 ; \ - ${INSTALL_DATA} $(SRC_MODULE) ${DEST}/root.afsweb/src/apache_1.3.1/$(SRC_MODULE) ; \ - echo Clean, make, and install the lib for 1.3.6 ; \ - $(MAKE) libclean ; \ - $(MAKE) AUX_CFLAGS=-DAIX $(APACHE_AFS_LIB) VERSION_CFLAG="-DAPACHE_1_3 -DAPACHE_1_3_6"; \ - ${INSTALL} -d ${DEST}/root.afsweb/lib/apache_1.3.6 ; \ - ${INSTALL_DATA} $(APACHE_AFS_LIB) ${DEST}/root.afsweb/lib/apache_1.3.6/$(APACHE_AFS_LIB) ; \ - /bin/rm -f $(SRC_MODULE) ; \ - echo Make and install source for 1.3.1 ; \ - $(MAKE) $(SRC_MODULE) VERSION_CFLAG="-DAPACHE_1_3 -DAPACHE_1_3_6" ; \ - ${INSTALL} -d ${DEST}/root.afsweb/src/apache_1.3.6 ; \ - ${INSTALL_DATA} $(SRC_MODULE) ${DEST}/root.afsweb/src/apache_1.3.6 ; \ - echo Do the binaries ; \ - $(MAKE) AUX_CFLAGS=-DAIX $(BINARIES) ;; \ - sun*) \ - $(MAKE) libclean ; \ - $(MAKE) AUX_FLAGS=-DSOLARIS $(APACHE_AFS_LIB) ; \ - ${INSTALL} -d ${DEST}/root.afsweb/lib/apache_1.2 ; \ - ${INSTALL_DATA} $(APACHE_AFS_LIB) ${DEST}/root.afsweb/lib/apache_1.2/$(APACHE_AFS_LIB) ; \ - $(MAKE) libclean ; \ - $(MAKE) AUX_FLAGS=-DSOLARIS $(APACHE_AFS_LIB) VERSION_CFLAG="-DAPACHE_1_3 -DAPACHE_1_3_1" ; \ - ${INSTALL} -d ${DEST}/root.afsweb/lib/apache_1.3.1 ; \ - ${INSTALL_DATA} $(APACHE_AFS_LIB) ${DEST}/root.afsweb/lib/apache_1.3.1/$(APACHE_AFS_LIB) ; \ - $(MAKE) libclean ; \ - $(MAKE) AUX_FLAGS=-DSOLARIS $(APACHE_AFS_LIB) VERSION_CFLAG="-DAPACHE_1_3 -DAPACHE_1_3_6" ; \ - ${INSTALL} -d ${DEST}/root.afsweb/lib/apache_1.3.6 ; \ - ${INSTALL_DATA} $(APACHE_AFS_LIB) ${DEST}/root.afsweb/lib/apache_1.3.6/$(APACHE_AFS_LIB) ; \ - /bin/rm -f $(SRC_MODULE) ; \ - $(MAKE) $(SRC_MODULE) VERSION_CFLAG=-DAPACHE_1_2 ; \ - ${INSTALL} -d ${DEST}/root.afsweb/src/apache_1.2 ; \ - ${INSTALL_DATA} $(SRC_MODULE) ${DEST}/root.afsweb/src/apache_1.2/$(SRC_MODULE) ; \ - /bin/rm -f $(SRC_MODULE) ; \ - $(MAKE) $(SRC_MODULE) VERSION_CFLAG="-DAPACHE_1_3 -DAPACHE_1_3_1" ; \ - ${INSTALL} -d ${DEST}/root.afsweb/src/apache_1.3.1 ; \ - ${INSTALL_DATA} $(SRC_MODULE) ${DEST}/root.afsweb/src/apache_1.3.1/$(SRC_MODULE) ; \ - /bin/rm -f $(SRC_MODULE) ; \ - $(MAKE) $(SRC_MODULE) VERSION_CFLAG="-DAPACHE_1_3 -DAPACHE_1_3_6" ; \ - ${INSTALL} -d ${DEST}/root.afsweb/src/apache_1.3.6 ; \ - ${INSTALL_DATA} $(SRC_MODULE) ${DEST}/root.afsweb/src/apache_1.3.6/$(SRC_MODULE) ; \ - $(MAKE) AUX_CFLAGS=-DSOLARIS "XLIBS=-lsocket -lnsl" $(BINARIES) ;; \ - *linux*) \ - $(MAKE) libclean ; \ - $(MAKE) AUX_FLAGS=-DLINUX $(APACHE_AFS_LIB) ; \ - ${INSTALL} -d ${DEST}/root.afsweb/lib/apache_1.2 ; \ - ${INSTALL_DATA} $(APACHE_AFS_LIB) ${DEST}/root.afsweb/lib/apache_1.2/$(APACHE_AFS_LIB) ; \ - $(MAKE) libclean ; \ - $(MAKE) AUX_FLAGS=-DLINUX $(APACHE_AFS_LIB) VERSION_CFLAG="-DAPACHE_1_3 -DAPACHE_1_3_1" ; \ - ${INSTALL} -d ${DEST}/root.afsweb/lib/apache_1.3.1 ; \ - ${INSTALL_DATA} $(APACHE_AFS_LIB) ${DEST}/root.afsweb/lib/apache_1.3.1/$(APACHE_AFS_LIB) ; \ - $(MAKE) libclean ; \ - $(MAKE) AUX_FLAGS=-DLINUX $(APACHE_AFS_LIB) VERSION_CFLAG="-DAPACHE_1_3 -DAPACHE_1_3_6" ; \ - ${INSTALL} -d ${DEST}/root.afsweb/lib/apache_1.3.6 ; \ - ${INSTALL_DATA} $(APACHE_AFS_LIB) ${DEST}/root.afsweb/lib/apache_1.3.6/$(APACHE_AFS_LIB) ; \ - /bin/rm -f $(SRC_MODULE) ; \ - $(MAKE) $(SRC_MODULE) VERSION_CFLAG=-DAPACHE_1_2 ; \ - ${INSTALL} -d ${DEST}/root.afsweb/src/apache_1.2 ; \ - ${INSTALL_DATA} $(SRC_MODULE) ${DEST}/root.afsweb/src/apache_1.2/$(SRC_MODULE) ; \ - /bin/rm -f $(SRC_MODULE) ; \ - $(MAKE) $(SRC_MODULE) VERSION_CFLAG="-DAPACHE_1_3 -DAPACHE_1_3_1" ; \ - ${INSTALL} -d ${DEST}/root.afsweb/src/apache_1.3.1 ; \ - ${INSTALL_DATA} $(SRC_MODULE) ${DEST}/root.afsweb/src/apache_1.3.1/$(SRC_MODULE) ; \ - /bin/rm -f $(SRC_MODULE) ; \ - $(MAKE) $(SRC_MODULE) VERSION_CFLAG="-DAPACHE_1_3 -DAPACHE_1_3_6" ; \ - ${INSTALL} -d ${DEST}/root.afsweb/src/apache_1.3.6 ; \ - ${INSTALL_DATA} $(SRC_MODULE) ${DEST}/root.afsweb/src/apache_1.3.6/$(SRC_MODULE) ; \ - $(MAKE) AUX_CFLAGS=-DLINUX "XLIBS=-lnsl" $(BINARIES) ;; \ - * ) \ - echo "NOT BUILT FOR ${SYS_NAME}"; ;; \ - esac - ${INSTALL} -d ${DEST}/root.afsweb/doc - ${INSTALL_DATA} ${APACHEAFS_DOC} ${DEST}/root.afsweb/doc/${APACHEAFS_DOC} - ${INSTALL} -d ${DEST}/root.afsweb/install - ${INSTALL_SCRIPT} ${APACHE_INSTALL_SCRIPT} ${DEST}/root.afsweb/install/${APACHE_INSTALL_SCRIPT} - ${INSTALL} -d ${DEST}/root.afsweb/bin - ${INSTALL_PROGRAM} $(BINARIES) ${DEST}/root.afsweb/bin - -netscape_afs_web_secure: - ${INSTALL} -d ${DEST}/root.afsweb/install - ${INSTALL} -m 755 ${NETSCAPE_INSTALL_SCRIPT} ${DEST}/root.afsweb/install - -all: - -install: - -## -## For Apache Afs Web Secure libraries and binaries -## NOTE: APACHE_INCLUDES should point to the Apache src directory where -## httpd.h and all it's included files reside which right now is src/afsweb/include -## and we have Apache versions as subdirectories but these are taken care of by the -## code. Be sure to compile with the VERSION_CFLAG=-DAPACHE_1_3 option for Apache 1.3 -## -APACHE_INCLUDES=-Iapache_includes - -XLIBS= -DEFINES=-DSTATUS -OPTF= -DEBUG_FLAG= -AUX_CFLAGS= -VERSION_CFLAG= -AFS_INCL=-I${TOP_INCDIR} -I.. -I../config -XCFLAGS= $(CFLAGS) $(OPTF) $(DEFINES) -I. -I.. $(VERSION_CFLAG) $(DEBUG_FLAG) -INCLS=${TOP_INCDIR}/ubik.h \ - ${TOP_INCDIR}/lwp.h \ - ${TOP_INCDIR}/lock.h \ - ${TOP_INCDIR}/rx/rx.h \ - ${TOP_INCDIR}/rx/xdr.h \ - ${TOP_INCDIR}/rx/rxkad.h \ - ${TOP_INCDIR}/afs/com_err.h \ - weblog_errors.h $(DCE_DLOG_INCLUDES) -deslib=${TOP_LIBDIR}/libdes.a -rxkadlib=${TOP_LIBDIR}/librxkad.a -authlib=${TOP_LIBDIR}/libauth.a -cmdlib=${TOP_LIBDIR}/libcmd.a -utilib=${TOP_LIBDIR}/util.a -kauthlib=${TOP_LIBDIR}/libkauth.a - -LIBS=${kauthlib} ${TOP_LIBDIR}/libubik.a ${TOP_LIBDIR}/libprot.a \ - ${authlib} ${rxkadlib} ${TOP_LIBDIR}/libsys.a ${TOP_LIBDIR}/librx.a \ - ${TOP_LIBDIR}/libsys.a \ - ${TOP_LIBDIR}/liblwp.a ${deslib} ${cmdlib} \ - ${TOP_LIBDIR}/libafscom_err.a ${utilib} \ - $(DBM) $(XLIBS) - -AR=ar -ARFLAGS=rv -LIBCOMMON_OBJS=apache_afs_utils.o apache_afs_cache.o -LIBAPACHE_OBJS=apache_afs_client.o apache_afs_plugin.o -LIBOBJS=$(LIBCOMMON_OBJS) $(LIBAPACHE_OBJS) -OBJS=$(LIBOBJS) apache_afs_weblog.o weblog.o - -.c.o: - $(CCOBJ) -c $(XCFLAGS) $(AFS_INCL) $(AUX_CFLAGS) $< -%.o: %.c - $(CCOBJ) -c $(XCFLAGS) $(AFS_INCL) $(AUX_CFLAGS) $< - -weblog: weblog.o $(APACHE_AFS_COMMON_LIB) - $(CC) -o $@ weblog.o $(APACHE_AFS_COMMON_LIB) $(LIBS) $(XLIBS) - -weblog_starter: apache_afs_weblog.o weblog_errors.h - $(CC) -o $@ apache_afs_weblog.o - -$(APACHE_AFS_COMMON_LIB):$(LIBCOMMON_OBJS) - - /bin/rm -f $@ - $(AR) $(ARFLAGS) $@ $(LIBCOMMON_OBJS) - -$(APACHE_AFS_LIB): $(LIBOBJS) AFS_component_version_number.o - - /bin/rm -f $@ - $(AR) $(ARFLAGS) $@ $(LIBOBJS) - -afs_module.c: apache_afs_module.c - -/bin/rm -f afs_module.c \ - ; echo "/*" > afs_module.c \ - ; cat AFS_component_version_number.c >> afs_module.c \ - ; echo "*/" >> afs_module.c \ - ; case "${VERSION_CFLAG}" in \ - -DAPACHE_1_3*) echo '#include "ap_compat.h"' >> afs_module.c ;; \ - esac \ - ; cat apache_afs_module.c >> afs_module.c - -## -##Dependencies -## - -$(OBJS): Makefile - -apache_afs_weblog.o: apache_afs_weblog.c weblog_errors.h AFS_component_version_number.o -apache_afs_utils.o: apache_afs_utils.c apache_afs_utils.h -apache_afs_cache.o: apache_afs_cache.c apache_afs_cache.h -weblog.o: weblog.c weblog_errors.h $(APACHE_AFS_COMMON_LIB) -apache_afs_client.o: apache_api.h apache_afs_client.c apache_afs_utils.o apache_afs_cache.o AFS_component_version_number.o - $(CC) -c $(XCFLAGS) $(AFS_INCL) $(APACHE_INCLUDES) $(AUX_CFLAGS) apache_afs_client.c -apache_afs_plugin.o: apache_api.h apache_afs_plugin.c apache_afs_client.o apache_afs_utils.o apache_afs_cache.o - $(CC) -c $(XCFLAGS) $(APACHE_INCLUDES) $(AUX_CFLAGS) apache_afs_plugin.c - - -clean: - -/bin/rm -f *.o $(BINARIES) $(APACHE_AFS_LIB) $(APACHE_AFS_COMMON_LIB) - -libclean: - -/bin/rm -f $(APACHE_AFS_LIB) $(LIBOBJS) - -include ../config/Makefile.version - -dest: - diff --git a/src/afsweb/README b/src/afsweb/README deleted file mode 100644 index 1444012bd8..0000000000 --- a/src/afsweb/README +++ /dev/null @@ -1,79 +0,0 @@ -Copyright 2000, International Business Machines Corporation and others. -All Rights Reserved. - -This software has been released under the terms of the IBM Public -License. For details, see the LICENSE file in the top-level source -directory or online at http://www.openafs.org/dl/license10.html - -AFS Web Security Pack for the Apache Web Server, Version 1.0 - - -Release Notes - -I. Introduction - -The AFS Web Security Pack is an extension available for selected Web servers -that enables system administrators to provide secure access via a -Web browser to documents stored in the AFS filespace. This document -provides information specific to this release of the AFS Web Security Pack. - -Note: Due the long filenames and file extensions used for the AFS Web -Secure distribution files, download of the AFS Web Secure product to -a PC sometimes results in incorrect filenames. Note that all AFS Web -Secure distribution files are g-zipped tar files, even if the *.tar.gz -file extension is lost during the download process. - -II. Installation Prerequisites - -Note: If you have installed a previous version of the AFS Web Security Pack, -you must first remove the previous version, including any modifications made -to your Apache Web server configuration and runtime configuration files -before installing this version of the product. - -Your system must meet the following software and disk space requirements -to install this version of the AFS Web Security Pack. - -Operating system: Solaris 2.5.1, AIX 4.2x, AIX 4.3, or AIX 4.3.1 -Web server: Apache 1.2.6 or Apache 1.3.1 -AFS (client): AFS Client 3.4a -Disk Space: 650 KB - -Note: Due to security considerations, OpenAFS strongly recommends that the -AFS Web Security Pack be used only on a server enabled with Secure Sockets -Layer (SSL). - - -IV. Known Defects and Limitations - -* Due to a preexisting problem in the AFS UNIX product, the Apache -server Fancy Indexing option does not function as expected when AFS -directories are displayed. If the Fancy Indexing option is enabled -on the Apache server, when a user initially browses an ACL-protected -directory (with "system:anyuser l" access), the user is able to see -file details for directories and links, but not for files. Once the -user selects a file and enters a username and password, details for -the files are then displayed. This problem is not caused by the AFS Web -Security Pack or the Apache server, but is due to a defect in the UNIX-based -AFS code. We are working to address this problem and will make an -announcement when a corrected version is available. In the interim, -please be aware of this limitation as you use the AFS Web Security Pack. - -*If the AFS Web Security Pack is used on the Apache server version 1.3.1, user -directories cannot be directly accessed through the use of a special character -such as a tilde (~) despite use of the Apache server User Directory directive. - -VII. AFS Web Security Pack Documentation - -Postscript and HTML versions of the documentation for the AFS Web Security -Pack are available in the doc directory. - -VIII. Additional Information about Apache and SSL - -The following sites on the World Wide Web provide additional information -about the Apache Web Server and SSL. - -* Apache Home Page http://www.apache.org -* Stronghold Home http://www.c2.net -* Stronghold International http://www.int.c2.net -* Apache-SSL Home http://www.apache-ssl.org -* SSLeay FAQ http://www.psy.uq.edu.au:8080/~ftp/Crypto/ diff --git a/src/afsweb/README.BETA1 b/src/afsweb/README.BETA1 deleted file mode 100644 index cc91fbe2e2..0000000000 --- a/src/afsweb/README.BETA1 +++ /dev/null @@ -1,127 +0,0 @@ -Copyright 2000, International Business Machines Corporation and others. -All Rights Reserved. - -This software has been released under the terms of the IBM Public -License. For details, see the LICENSE file in the top-level source -directory or online at http://www.openafs.org/dl/license10.html - -Installation instructions for Apache AFS Web Secure -(Version 1 for Apache version 1.2.6) - -Prerequisites:- - -Ensure the following files exist:- - - - weblog - - weblog_starter - - libapacheafs.a - - mod_afs.c - -In addition to these you should know the location of the AFS library - libsys.a - - -The mod_afs.c file should be in the apache src directory with all the other -module files. weblog and weblog_starter should be in the same directory - this -could be any directory (preferably outside AFS - if it is in AFS then -system:anyuser should have the appropriate ACL on that directory). - -Editing the following files in the apache src and conf directories:- - -1. Configuration (or the current Configuration file) - - EXTRA_LIBS= libapacheafs.a libsys.a - -NOTE - specify the full path of these libraries - libsys.a is probably -in /usr/afsws/lib/afs/libsys.a and you can put libapacheafs.a wherever you -want. - -At the end of the configuration file where the modules are add - - Module afs_module mod_afs.o - -Optional: if you want the server to attempt to stop completely if AFS -initialization fails then add -DSHUTDOWN_IF_AFS_FAILS to the EXTRA_CFLAGS line. -Otherwise, on startup if the initialization procedure fails, the apache -server will continue running but AFS authentication will always fail. - -2. httpd.conf (or whatever configuration file the server uses on startup - with the -f flag) - -NOTE: ensure that you provide the entire path for the ErrorLog and PidFile -Directives instead of attempting to have apache prepend ServerRoot. - -See below for an explanation of arguments to these -Apache Directives. - -SetAFSDefaultCell [cell] -SetAFSMountpointDir [dir] -SetAFSCacheExpiration [time] -SetAFSTokenExpiration [time] -SetAFSWeblogPath [path] -SetAFSLocation [loc] - -> -SetHandler afs-Authentication - - - -AllowOverride None - - -NOTE:- SetAFSLocation should be the same as the Location -and should be a path relative to the server-document-root - -NOTE: loc and dir should *NOT* be the same. There should be no symbolic link, -file or directory in the DocumentRoot directory with the same name as the loc -directive. - -cell: REQUIRED directive. - Default AFS cell name. This cell will be used unless the user - specifies a different cell by using the user@cellname syntax - when prompted for a username and password. REQUIRED OPTION. - -dir: REQUIRED directive. - Path to the directory or symbolic link relative to the server document - root directory where the AFS cell mount points are. If you want symbolic - links to be followed make sure you have the - Options FollowSymLinks - directive set. - -time: OPTIONAL directive - Seconds for AFS token cache expiration (cacheExpiration is for the local - cache and tokenExpiration is for the AFS kernel cache manager). - - -path: REQUIRED directive. - The full or relative (to server binary) path for weblog binary. - -loc: REQUIRED directive. - Some location relative to the server root - MAKE SURE THAT THERE DOESN"T ALREADY EXIST A DIRECTORY BY - THIS SAME NAME. This should be the same (case sensitive) - as the argument to the Location directive. Eg. /afs - - -Configure and make apache and start it up with the new config file. - -NOTE: Add the following to the shutdown or stopd file to shutdown the - weblog_starter process BEFORE the kill -TERM for httpd.pid - - kill -TERM `cat .afs` - -Eg. if the httpd.pid file is in /local/stronghold/apache/logs/httpd.pid -then the stopd file should look something like this - - kill -TERM `cat /local/stronghold/apache/logs/httpd.pid.afs` - - kill -TERM `cat /local/stronghold/apache/logs/httpd.pid` - - -POINTERS TO APACHE AND SSL:- - -1. Apache Home Page http://www.apache.org -2. Stronghold Home: http://www.c2.net International: http://www.int.c2.net -3. Apache-SSL Home: http://www.apache-ssl.org -4. SSLeay FAQ http://www.psy.uq.edu.au:8080/~ftp/Crypto/ - diff --git a/src/afsweb/README.BETA2 b/src/afsweb/README.BETA2 deleted file mode 100644 index 82e1ce5d0a..0000000000 --- a/src/afsweb/README.BETA2 +++ /dev/null @@ -1,374 +0,0 @@ -Copyright 2000, International Business Machines Corporation and others. -All Rights Reserved. - -This software has been released under the terms of the IBM Public -License. For details, see the LICENSE file in the top-level source -directory or online at http://www.openafs.org/dl/license10.html - -AFS Web Security Pack Version 1.0 for the Apache Web Server. - -Release Notes - -I. Introduction - -AFS Web Security Pack is an extension available for selected Web servers -that enables system administrators to provide secure access via a -Web browser to documents stored in the AFS filespace. This document -summarizes the changes made to AFS Web Security for this release, and -provides installation and configuration instructions. - -Note: Due the long filenames and file extensions used for the AFS Web -Security Pack distribution files, download of the AFS Web Security Pack - product to a PC sometimes results in incorrect filenames. Note that all -AFS Web Security Pack distribution files are g-zipped tar files, even if the -*.tar.gz file extension is lost during the download process. - -II. Installation Prerequisites - -Your system must meet the following software and disk space requirements -to install this version of AFS Web Security Pack. - -Operating system: Solaris 2.5.1, AIX 4.1, AIX 4.2, or AIX 4.2.1 -Web server: Apache 1.2.6 -AFS (client): AFS Client 3.4a -Disk Space: 650 KB - -Note: Due to security considerations, OpenAFS strongly recommends that -AFS Web Security Pack be used only on a server enabled with Secure -Sockets Layer (SSL). - -III. New Features and Product Changes - -The following list describes new features and changes that are included -in this version of AFS Web Security Pack. - -* Configuration of AFS Web Security Pack is now easier and more flexible. The -AFSMountPointDir and AFSLocation directives are no longer required. -Instead, during configuration of AFS Web Security Pack, an authorization type -(AFSAuthType) of AFS is now specified. (See the Installation and Configuration -instructions that follow for additional details.) - -* The Log In dialog box that is displayed when users attempt to access -the AFS file space via a web browser can now be customized adding the -AFSLoginPrompt directive to the Apache server runtime configuration -file. (See the Installation and Configuration instructions that follow for -additional details.) - - - -* AFS Web Security Pack now provides the ability to log attempts to -access AFS in which permission is denied. This logging can be used to -determine if users are attempting to access information that they are not - authorized to view. To configure this logging, you must add the - SetAFSAccessLog directive to the Apache server runtime configuration file. -(See the Installation and Configuration instructions that follow for -additional details.) - -* AFS Web Security Pack now provides the ability to translate and access user -directories that are specified with a special character such as a tilde (~), -for example. http://www.yourcompany.com/~smith. To enable this feature, you -must add the User Directory directive to the Apache server runtime -configuration file. (See the Installation and Configuration instructions -that follow for additional details.) - -* The previous version of AFS Web Security Pack did not correctly permit -directory indexing of directories for which a user was assigned lookup -permission. In addition, the Parent Link in directory indexes did not -always work correctly. This version of AFS Web Security Pack corrects these -problems. - -* This version of AFS Web Security Pack corrects a problem with the token cache -that occasionally caused access to AFS to be incorrectly denied. - -* The previous version of AFS Web Security Pack did not accept AFS passwords -that included a space. This version of AFS Web Security Pack corrects this problem. - -* This version of AFS Web Security Pack corrects a communication (pipe) problem -that occasionally caused the message SERVER_ERROR to be returned. In -addition, this version improves performance of AFS Web Security Pack. - -IV. Known Defects and Limitations - -* Due to a preexisting problem in the AFS UNIX product, the Apache -server Fancy Indexing option does not function as expected when AFS -directories are displayed. If the Fancy Indexing option is enabled -on the Apache server, when a user initially browses an ACL-protected -directory (with "system:anyuser l" access), the user is able to see -file details for directories and links, but not for files. Once the -user selects a file and enters a username and password, details for -the files are then displayed. This problem is not caused by AFS Web -Security Pack or the Apache server, but is due to a defect in the UNIX-based -AFS code. We are working to address this problem and will make an -announcement when a corrected version is available. In the interim, -please be aware of this limitation as you continue testing. - -V. Upgrade Instructions for AFS Web Security Pack for the Apache Web Server - -Note: Use the following instructions to upgrade AFS Web Security Pack on -your Apache Web Server if Beta Version 1 or Beta Version 2 of the product -is already installed. (If this is the first time you are installing AFS Web -Security Pack, follow the instructions in the next section, Installing and -Configuring AFS Web Security PAck 1.0 for the Apache Web Server.) - -1. Replace the existing versions of the weblog, weblog_starter and -libapacheafs.a files with the new files provided with this version -of AFS Web Security Pack 1.0. Also, in the Apache src directory, -replace the mod_afs.c or afs_module.c file with the new AFS Web Security Pack -Module, afs_module.c. - -2. In the Apache server Configuration file, change the line that -references the AFS Web Security Pack module so that the line appears as -follows: - - Module afs_module afs_module.o - -Note: If you want to enable AFS Web Security Pack to translate and access user - home directories, you must include the userdir_module when you build -the Apache server. For information on including modules when building -the Apache server, consult you Apache server documentation. - -3. In the Apache server src directory, run the Configure script to -create a new configuration Makefile for your operating system. - -4. Stop the Apache server process (httpd). Then, issue the make -command to compile the Apache server. - -5. In the Apache server runtime configuration file, remove (or comment -out) the following two lines: - - SetAFSMountpointDir /afs_mountpoint_directory - SetAFSLocation /afs_location - -6. In the Apache server runtime configuration file, replace (or -comment out) the SetHandler afs-authentication parameter with the -AFSAuthType AFS parameter, so that the Location directive appears as -follows: - - - AFSAuthType AFS - - -where /afs is the directory (or symbolic link to the directory) -that contains the mount points to AFS to be used by the Apache -server and AFS Web Security Pack. - -Note: You can specify AFSAuthType AFS for multiple locations to indicate -that AFS Web Security Pack authentication must be used when a user attempts to -access a specific location. (In specifying a location, you can use wildcard -characters if desired.) - -7. (Optional) To customize the authorization dialog box that is -displayed when users attempt to access the AFS file space via a -web browser, add the following line within the Location directive: - - AFSLoginPrompt [Custom Text] - -where [Custom Text] is the text that you want to appear in the dialog -box that prompts users to enter a user name and password to access AFS -filespace. - -8. (Optional) To enable AFS Web Security Pack to access user directories, -add the following lines to the Apache server runtime configuration -file. This directive specifies the syntax used to access user -directories and indicates that attempts to access user directories -in the AFS filespace must be passed to AFS Web Security Pack: - - - AFSAuthtype AFS - - -Then, add the following line to the Apache server runtime configuration -file to indicate the location of user directories in AFS: - - UserDir [Users Directory] - -where Users Directory indicates the location of user's home directories. - -Note: To enable user directory access in this manner, the Apache Server -must include the UserDir module. For information on including this -module when building the Apache server, consult you Apache server -documentation. - -9. (Optional) To enable logging of attempts to access AFS in which -permission is denied, add the SetAFSAccessLog directive to the Apache -server runtime configuration file as follows: - - SetAFSAccessLog [Access Log File] - -where [Access Log File] is the full path log file in which failed access -attempts are to be recorded. - -10. If necessary, rename the symbolic link to the AFS filespace in the -Apache server's document root directory with the name specified in the -Location directive for the AFS filespace in the server's runtime -configuration file. - -VI. Installing and Configuring AFS Web Security Pack 1.0 for the Apache Web Server - -This section provides brief installation and configuration instructions -for Apache AFS Web Security Pack (Version 1.0 for Apache version 1.2.6 -and Apache version 1.3.1). See the product documentation for complete installation -and configuration instructions and for details about using the configuration script to -set up AFS Web Security Pack on the Apache server. - -1. Uncompress and extract the files from the .tar.gz file, placing the -files in the following locations, where Apache Installation Directory -is the full pathname of the directory where the Apache Web server is -installed: - -- Place both the weblog and weblog_starter files in one directory, -for example, Apache Installation Directory/afswebsecurity. These files -can be placed in any directory as long as they remain together. However, -if the weblog and weblog_starter files are placed in a directory in AFS, -ensure that either the user that the Apache Web server runs as, or the -AFS group system:anyuser is designated as having read and lookup privileges -on the directory's Access Control List (ACL). - -- Place the libapacheafs.a file in any directory, for example, -Apache Installation Directory/afswebsecurity. - -- Place the afs_module.c file in the Apache src directory (Apache version 1.2.6) -or in the src/modules/extra directory (Apache version 1.3.1) -(generally located directly beneath the Apache Installation Directory). - -In addition, note the location of the AFS library file, libsys.a. This -file is installed with the AFS client, and is generally located in the -/usr/afsws/lib/afs directory. - -2. Modify the Apache Server Configuration File as follows. - -Locate the EXTRA_LIBS line in the file, and add the paths to the -libapacheafs.a and libsys.a libraries so that the line reads as follows: - - EXTRA_LIBS=[full path to libapacheafs.a] [full path to libsys.a] - -In the Module configuration section of the file, add a reference to the -AFS Web Security Pack module. It is recommended that the AFS Web Security Pack -module be the first Authentication module. -To add the AFS module to the list of Apache server modules, add the following line -to the Configuration file: - - Module afs_module afs_module.o - -Note: If you want the server to attempt to stop completely if AFS -initialization fails, also add -DSHUTDOWN_IF_AFS_FAILS to the -EXTRA_CFLAGS line in this file. Otherwise, on startup if the -initialization procedure fails on startup, the Apache server -will continue to run but AFS authentication will always fail. - -3. Modify the Apache Server Runtime Configuration File (for example, -httpd.conf) as follows. - -Add the following lines to the runtime configuration file: - - SetAFSDefault [Cell cellname] - SetAFSCacheExpiration [cache_expiration] - SetAFSTokenExpiration [token_expiration] - SetAFSWeblogPath [weblog_starter_path] - -where the arguments for these Apache server directives are as follows: - -[cellname] - The name of the default AFS cell to be accessed via the -Apache server and AFS Web Security Pack. - -[cache_expiration] -The maximum lifetime in seconds of an AFS token -that is stored in the local cache. The default recommendation for -this argument is 300 seconds (5 minutes). - -[token_expiration] -The maximum lifetime in seconds of an AFS token -that is stored in the AFS kernel Cache Manager. The default -recommendation for this argument is 60 seconds (1 minute). - -[weblog_starter_path] -The path to the AFS Web Security Pack weblog_starter program. -Specify the full path or a path relative to the path set by the ServerRoot Apache -directive. - -Note: To enable logging of failed attempts to access AFS in which permission -is denied, also add the directive: - - SetAFSAccessLog [Access Log File] - -where [Access Log File] is the full path of the log file in which -failed access attempts are to be recorded. - -Then, add the following additional lines to the runtime configuration file: - - - AFSAuthType AFS - - -where [afs] is the request provided by users in combination with the -server hostname and domain in order to access AFS filespace. - -Note: This directive only works within Location (and LocationMatch for Apache 1.3.1) -tags and not in any other tags such as Directory or File. - -Note: You can specify AFSAuthType AFS for multiple locations to indicate -that AFS Web Security Pack authentication must be used when a user attempts to -access a specific location. (In specifying a location, you can use wildcard -characters if desired.) - -(Optional) To customize the authorization dialog box that is displayed -when a user attempts to access the AFS file space via a web browser, -add the following line to the Location directive added in the previous -step. The Location directive then appears as follows: - - AFSLoginPrompt [Custom Text] - -where [Custom Text] is the text that you want to appear in the dialog box -that prompts users to enter an AFS user name and password to access the -AFS filespace. - -(Optional) To enable AFS Web Security Pack to access user directories, add the -following additional Location directive to the Apache server runtime -configuration file. - - - AFSAuthType AFS - - -Then, also add the following additional line to the Apache server runtime -configuration file to indicate the location of user directories in AFS. - - UserDir [Users Directory] - -where [Users Directory] indicates the location of user's home -directories in AFS. The location is specified relative to the -server document root directory. - -Note: To enable user directory access in this manner, the Apache -server must include the User Dir module. - -Save and close the modified runtime configuration file. - -4. Stop the Apache server process (httpd). Then, configure and make -the Apache server and start it up with the new runtime configuration -file. - -5. Add the following to the shutdown or stopd file to shutdown the -weblog_starter process BEFORE the kill -TERM for httpd.pid: - - kill -TERM `cat [path to httpd.pid].afs` - -For example, if the httpd.pid file is in -/local/stronghold/apache/logs/httpd.pid, then the stopd file should -look something like this: - - kill -TERM `cat /local/stronghold/apache/logs/httpd.pid.afs` - kill -TERM `cat /local/stronghold/apache/logs/httpd.pid` - -VII. AFS Web Security Pack Documentation - -Postscript and HTML versions of the documentation for the initial -Beta release AFS Web Security Pack are available in the doc directory. - -VIII. Additional Information about Apache and SSL - -The following sites on the World Wide Web provide additional information -about the Apache Web Server and SSL. - -* Apache Home Page http://www.apache.org -* Stronghold Home http://www.c2.net -* Stronghold International http://www.int.c2.net -* Apache-SSL Home http://www.apache-ssl.org -* SSLeay FAQ http://www.psy.uq.edu.au:8080/~ftp/Crypto/ diff --git a/src/afsweb/TestPlan.txt b/src/afsweb/TestPlan.txt deleted file mode 100644 index f3be1c8ef5..0000000000 --- a/src/afsweb/TestPlan.txt +++ /dev/null @@ -1,50 +0,0 @@ -Copyright 2000, International Business Machines Corporation and others. -All Rights Reserved. - -This software has been released under the terms of the IBM Public -License. For details, see the LICENSE file in the top-level source -directory or online at http://www.openafs.org/dl/license10.html - -A very basic document describing some test ideas for AFS Web Secure (Apache) - -1. HTTP tests - - Ensure corect return codes (as per HTTP standards) are being reported for all methods (GET, HEAD, PUT, POST, etc.). - -2. Authentication tests - - Ensure ACL's and return codes match. ie. ensure that if the AFS acl -permits access then the return code from the web server reflcts it and vice -versa. - -3. Cache consistency tests - - Ensure that the token caches are updated and expiration times checked -and expired tokens purged. - -4. PAG tests - - Ensure that each child process for the Apache Server has it's own PAG -and authentication credentials for PAG's do not get mixed up. - -5. CGI tests - - Ensure that AFS acls permit or forbid CGI scripts executing. - -6. Locking - - Apache child processes use a shared pipe (synchromized by file locking) -for inter process communication with the weblog process. This test would -ensure that this communication is indeed synchronized and the request for -an AFS token from one child process does indeed allow the token to be returned -to that same child process with a unique PAG. - -7. Performance testing - - Memory leaks, speed. - - -8. Propogate changes (release) from a read-write colume to read-only volumes -and ensure the web server gives consistent file updates. - - diff --git a/src/afsweb/WebSecure_Design.txt b/src/afsweb/WebSecure_Design.txt deleted file mode 100644 index bbe6896914..0000000000 --- a/src/afsweb/WebSecure_Design.txt +++ /dev/null @@ -1,138 +0,0 @@ -Copyright 2000, International Business Machines Corporation and others. -All Rights Reserved. - -This software has been released under the terms of the IBM Public -License. For details, see the LICENSE file in the top-level source -directory or online at http://www.openafs.org/dl/license10.html - - AFS WEB SECURE DESIGN DOCUMENT - - -Functionality (common to both Servers) - -Any URL beginning with /afs is handled by the plug-in. If a username and -password accompanies the request then the plug-in attempts to authenticate -the user with AFS and uses that token for serving the request. -However in the absense of any Authentication header it attempts to serve -the request as it normally would (without the plug-in). If the request -returns an OK status, the document is served as is. If it returns HTTP -status FORBIDDEN, then the plug-in responds with an AUTHENTICATION_REQUIRED -response with a part of the URL giving the /afs/ as the part of -the WWW-Authenticate header. - - -Netscape Enterprise Server Plug-in - -The Netscape Server is multithreaded (each incoming HTTP request is -handled by a thread). This design led to the requirement of per thread -authentication credentials for AFS, (without which there would be one common -token for all the threads handling requests for possibly different users). -Since the AFS kernel cache manager only provides per process authentication -credentials (using Process Authentication Groups or PAG's), the plug-in -required a user-space cache manager. Within this user space cache manager -a data structure stores the authentication credentials in a manner similar -to PAG's (first two bits used). The user space cache manager provides the -capability of per thread authentication required for the Netscape Server. - - -The Netscape Server API provides an initialization routine using which the -user space cache manager is started up. Unlike the Apache Server plug-in, the -Netscape AFS Web Secure Server does not have to be on an AFS client machine. -Configuration files permit the administrator to specify disk cache directories -other than that used by any other cache managers. Therefore it is possible -to have more than one user space cache manager running on the same machine -along with a kernel cache manager. - -The configuration allows the administrator to specify what URL it should -look for files in AFS. Tokens for user credentials are obtained and cached -in the user-space cache manager, which essentially is a port of the kernel -cache manager into user-space. - - - -Apache Server Module - -The Apache Server software provides an API for adding modules to the web server -and for creating handlers for requests. AFS Web Secure for Apache is built as -a standard Apache module (mod_afs.c) along with a library (libapacheafs.a) and -two binaries (weblog_starter and weblog). - -The web server is not multithreaded but each request is served by child -processes (the number of which is configurable). AFS Authentication requires -each child process to communicate with the weblog process over a UNIX pipe -(file locking is used to provide exclusive access to the pipe). The child -processes send authentication credentials (username, password and cellname) -to the weblog process which authenticates the user with AFS using the -ka_AuthenticateUserGeneral system call (as in klog). Once an AFS token is -obtained it gets the token fro the cache manager using the lpioctl system -call and sends the token back to the child process that requested it. -Note that since AFS permits one token per cell per PAG, it is essential for -each of the child processes to be in a unique PAG. The lsetpag system call -is used on startup to ensure each child process and the weblog process -belong to a unique PAG. Once the child process obtains the token from the -weblog process it sets it using the lpioctl system call to set a token. It -can then access files in AFS with the appropriate ACL's. - -Caching of tokens is done at two levels - the weblog process caches all tokens -for all user credentials that it recieves from all Apache child processes. -Each child process in turn caches the credentials it recieves. Token times -are configurable using the SetAFSCacheExpiration directive. The kernel cache -manager may cache tokens for the time specified using the SetAFSTokenExpiration -directive. This is similar to using klog -lifetime