Next: Host access control Up: Web access authorization Previous: Limiting directives

Access protection with the GN server

Most Web servers will serve all documents located in directories within the Web directory hierarchy, possibly limiting access to some documents according to an access configuration mechanism. By contrast the GN server will only serve documents that are explicitly specified in a .cache file in the same directory as the document.

The -k or -K command line option is used to specify a user ID or a group ID. All cache files in all directories must then be owned by the user ID or group ID in order for files to be served. The user id or group id should be different from the server process user id and group id. This feature is useful if all cache files are normally created by a single user or group, and precludes the inadvertent use of spoof cache files. When a request is made the GN server checks the ownership of the cache file that controls the information being requested. Note that in the case of a menu being requested, it is the cache file in the parent directory that lists that menu and thus controls access.

To enhance security the GN server should be run with a user ID that has as few permissions as possible. The server should have sufficient permission to write to its log file and read the files it is to serve, but preferably be unable to write to any other files.

An incoming FTP directory should not be located within the GN data hierarchy, as this might allow an unauthorized user to upload a .cache file and thus specify files to be served from that directory.

GN can be compiled with the symbol FORBID_EXEC defined to disallow the execution of all CGI scripts (see Section ). This enhances security but of course restricts the functionality of the server.

• Host access control files

Spinning the Web by Andrew Ford
© 1995 International Thomson Publishing
© 2002 Andrew Ford and Ford & Mason Ltd
Note: this HTML document was generated in December 1994 directly from the LaTeX source files using LaTeX2HTML. It was formatted into our standard page layout using the Template Toolkit. The document is mainly of historical interest as obviously many of the sites mentioned have long since disappeared.