>
WebRSH: Help: Options: Access Control:
WebRSH implements an independent access control mechanism, which is intended
to integrate with the server's access control. It includes:
- The ability to restrict access by location (IP address of the accessing
client).
- The ability to check that some user authorization transaction took place,
by checking for the existence of the environment variable 'AUTH_TYPE'.
- The ability to restrict access only to some specified users. (However,
WebRSH does not authenticate users by itself. It counts on the server to
authenticate users and supply properly authenticated usernames.)
These built-in security features of WebRSH can be used to:
- Enhance the server's access control mechanism (e.g., some servers do not
implement location-based access control).
- Double-check the server, to protect from bugs and/or configuration errors.
Before setting access control, it is recommended that you check for the
existence of certain environment variables. To do that enter the command 'set'
in the command field, and click 'Execute' (or click '[MORE]' from the Main Menu
and then click 'set'). You should look for the following variables:
- REMOTE_ADDR: The IP address of the computer from which WebRSH had been accessed.
- AUTH_TYPE: The authentication method used. The existence of this variable
indicates that authentication information had been submitted by the client
when WebRSH had been accessed.
- REMOTE_USER (or AUTH_USER if the server is WebSite): The name of the user
accessing WebRSH.
- Location-Based Access Control
- Location-based access control is completely disabled unless the 'Restrict
Access by Location' box is checked. Once checked, WebRSH will be accessible
only to hosts that match one of the masks in the 'Allowed Hosts' list and
do not match any of the masks in the 'Denied Hosts' list. Masks are IP
addresses (of the form x.x.x.x) which may contain the following wild card
symbols: '*' stands for zero or more digits. '?' stands for one digit.
In order for all this to work properly, the accessing host's IP address
must be supplied by the server in the environment variable 'REMOTE_ADDR'.
- Authorization Transaction Check
- If the 'Check for User Authentication' box is checked, WebRSH will be
accessible only if the environment variable 'AUTH_TYPE' exists and has
a non-null value. If your server properly supplies this variable, it is
recommended that you check this box. Otherwise, you should leave it unchecked.
Note that this check doesn't provide much protection by itself, and a
malicious client should be able to fool many servers into creating this
variable. The main purpose of this check is to verify that the server indeed
requires user authentication (under normal operation) and to alert you
in case it does not.
- User-Based Access Control
- If the 'Allow Access Only to these Users' box is checked, then only users
with usernames that appear in the proceeding list will be able to access
WebRSH. You should check that your server properly supplies the username in
the environment variable 'REMOTE_USER' (or 'AUTH_USER' if the server is
WebSite) before checking this box.