Security Filter: Controlled Access to Web Pages


Description

Overview

Security Filter is a Common Gateway Interface (CGI) application which controls/restricts the access to the Web pages.

Each single page "protected" by the Security Filter can have its own access control list.


The Security Filter in the Web Browser/Server Context

The above picture shows the Security Filter in the context of the Web Browser/Server architecture. The Security Filter imposes a distinction between:

Note that while the Normal HTML Pages have to be visible to the Web server (i.e they have to belong to one of the directories visible to it), the Restricted HTML Pages do not need to be visible. Therefore while an attempt to violate the Web server security protection(s) may manage to access some of the Normal HTML Pages, it will never manage to access the Restricted HTML Pages.

The Security Filter, like all other CGIs, requires a HTML page containing a form to be started. Therefore while Normal HTML Pages are accessed directly via Normal (hyper) Links, the Restricted HTML Pages are accessed via Restricted Links. A Restricted Link is the link which goes from a HTML Page, via the form contained in it and the Security Filter CGI to a Restricted HTML Page.


Normal and Restricted Links

The HTML page containing the Security Filter form (i.e. the starting point of a Restricted Link) can be considered as a sort of gateway to a restricted area; therefore it is called Gateway.

Access Control List(s) Configuration

The Security Filter allows to control/restrict the access on a page by page basis (i.e. each single Restricted HTML Page can have its own access control list). Hereafter it is explained how.

The Form in the Gateway Page

Each Gateway HTML page must contain a form like the one shown hereafter.

<FORM METHOD=POST
ACTION="http://host.domain.country/cgi-bin/secfil">
  <INPUT TYPE="hidden" NAME="Home" VALUE="/home/directory">
  <INPUT TYPE="hidden" NAME="Key" VALUE="key1">
  <INPUT TYPE="submit" VALUE="Enter Restricted Page1">
</FORM>

The input field Home is the equivalent of the environment variable HOME in UNIX. The Security Filter will look for the start-up file secfil.ini in the directory ${HOME}/swwings/conf. This start-up file does not need to belong to the directories' hierarchy(ies) visible to the Web server. Therefore it is possible to put it in a directory where no undesired intruder will be able to see it.

The input field Key contains a key, a code, which works as an index in the start-up file. In the start-up file there is a record (a line) for each HTML Restricted Page and this record is identified by the key contained in the form. This way the page containing the above form can be considered as a Gateway to the HTML Restricted Page.

The input field with type "submit" is the only one seen by the people reading the Gateway HTML Page on the Web. By clicking it, the Security Filter is activated and, if the access is granted, the Restricted HTML Page will be displayed.

The Start-up File

The start-up file contains a set of records (lines), one for each Restricted HTML Page. Each line contains the following information.

The Users File, the Ok File and the Not Ok File do not need to belong to the directories' hierarchy(ies) visible to the Web server. Therefore it is possible to put them in directories where no undesired intruder will be able to see them.

In the Not Ok File it is possible to insert, apart from the obvious error messages, some mail addresses so that users who have not been granted the access can request it.

Example

proj-a /swwings/conf/proja.use /resarea/projaok.htm /resarea/projanok.htm
proj-b /swwings/conf/projb.use /resarea/projbok.htm /resarea/projbnok.htm

The Users File

The Users File is a text file containing a line for each user. Each end user is identified by a (partial) internet address. Adopting a partial address allows to identify entire internet domains as single users. The user identifier (i.e. his partial internet address) is matched by the Security Filter against the environment variables REMOTE_HOST and REMOTE_ADDR. With these mechanism only the users (i.e. the internet locations) specified in this file are authorised to access the Restricted HTML Page.

Example

123.456.789.123
fred.john
host.domain.country

The Log File

The Security Filter maintains a log file, secfil.log, which is located in the directory ${HOME}/swwings/log. This file contains the following information.