openafs/src/afsweb

Copyright 2000, International Business Machines Corporation and others.
All Rights Reserved.

This software has been released under the terms of the IBM Public
License.  For details, see the LICENSE file in the top-level source
directory or online at http://www.openafs.org/dl/license10.html

AFS Web Security Pack for the Apache Web Server, Version 1.0


Release Notes

I. Introduction

The AFS Web Security Pack is an extension available for selected Web servers 
that enables system administrators to provide secure access via a 
Web browser to documents stored in the AFS filespace. This document 
provides information specific to this release of the AFS Web Security Pack.

Note: Due the long filenames and file extensions used for the AFS Web 
Secure distribution files, download of the AFS Web Secure product to 
a PC sometimes results in incorrect filenames. Note that all AFS Web 
Secure distribution files are g-zipped tar files, even if the *.tar.gz 
file extension is lost during the download process. 

II. Installation Prerequisites

Note: If you have installed a previous version of the AFS Web Security Pack, 
you must first remove the previous version, including any modifications made 
to your Apache Web server configuration and runtime configuration files 
before installing this version of the product.

Your system must meet the following software and disk space requirements 
to install this version of the AFS Web Security Pack.

Operating system:	 Solaris 2.5.1, AIX 4.2x, AIX 4.3, or AIX 4.3.1 
Web server:		 Apache 1.2.6 or Apache 1.3.1 
AFS (client):		 AFS Client 3.4a 
Disk Space:		 650 KB 

Note: Due to security considerations, OpenAFS strongly recommends that the
AFS Web Security Pack be used only on a server enabled with Secure Sockets 
Layer (SSL).


IV. Known Defects and Limitations 

* Due to a preexisting problem in the AFS UNIX product, the Apache 
server Fancy Indexing option does not function as expected when AFS 
directories are displayed. If the Fancy Indexing option is enabled 
on the Apache server, when a user initially browses an ACL-protected 
directory (with "system:anyuser l" access), the user is able to see 
file details for directories and links, but not for files. Once the 
user selects a file and enters a username and password, details for 
the files are then displayed. This problem is not caused by the AFS Web
Security Pack or the Apache server, but is due to a defect in the UNIX-based 
AFS code. We are working to address this problem and will make an 
announcement when a corrected version is available. In the interim, 
please be aware of this limitation as you use the AFS Web Security Pack.

*If the AFS Web Security Pack is used on the Apache server version 1.3.1, user 
directories cannot be directly accessed through the use of a special character
such as a tilde (~) despite use of the Apache server User Directory directive. 

VII. AFS Web Security Pack Documentation

Postscript and HTML versions of the documentation for the AFS Web Security
Pack are available in the doc directory. 

VIII. Additional Information about Apache and SSL

The following sites on the World Wide Web provide additional information 
about the Apache Web Server and SSL.

* Apache Home Page http://www.apache.org 
* Stronghold Home http://www.c2.net 
* Stronhold International http://www.int.c2.net 
* Apache-SSL Home http://www.apache-ssl.org 
* SSLeay FAQ http://www.psy.uq.edu.au:8080/~ftp/Crypto/