This started out as a project to take Apache NTLM authentication and offload it to cookie authentication, because the NTLM auth was flaky and would sometimes croak on random pages, given that NTLM authentication was being done for each keepalive. Upon completion of this project, it is determined that ANY authentication process, be it NTLM, Kerberos, RSA SecurID, or other method that can be performed against apache can be used, and offload credentials to cookie authentication. Without further ado, let's look at how it works:
User visits Application Webserver
Application Webserver receives no authentication cookie, redirects user to Authentication Webserver with Application Webservers called URL as the query string.
The user visits the Authentication Webserver and authenticates by whatever means (NTLM, Kerberos, RSA, Basic Auth, other)
Authentication Webserver stores user credentials and the original URL on the Application Server that the user was trying to reach in a randomly named file, and directs Web Client back to the Application Webserver with information about how to get the random data file.
Web Client sends credentials data file info to the Application Webserver
Application Webserver fetches credentials data file from Authentication Webserver, after which the Authentication Webserver deletes credentials file. (Note that credentials are not entrusted to the client and pass from the authentication server to the application server directly.) Application Server generates cookie value associates userid with it, saving for 12 hours.
Application Webserver sends Web Client the authentication cookie lasting 12 hours along with a redirect to the original URL the client called.
Client visits original URL with authentication cookie, server uses the value to look up the userid and populates the REMOTE_USER environment variable, and the user is able to proceed.
After the cookie expires, whatever URL the Web Client hits next will trigger this whole process again
Wednesday, July 08 2009 @ 11:14 AM CDT
Contributed by: nat
Views: 277
Apache 2.2's load balancer is pretty neat. However, to get persistence to work properly, you have to be careful. Here we are setting the balancer manager to watch a client cookie called BALANCEID, and each member has a particular route string tied to it that is set in the cookie. It's important to note that the cookie format must be: something.routestring, ie, nat.server1. If it is justserver1, it will not work.
Now there's the issue of the client cookie being set. What if you are load balancing a third party app or webserver and can't easily get the cookie set on the client? No problem! While it didn't work in 2.2.3 (in particular, the BALANCER_ROUTE_CHANGED var being set), when I tried in 2.2.11, I was able to set the cookie myself based on which balancer member was selected:
# Set session cookie if BALANCER_ROUTE_CHANGED, containing BALANCER_WORKER_ROUTE env variable, which is set to the route above
# Note that cookie value should be a session id, followed by a period, followed by the route.
# Since session id cookie usually not advised to be mutable, best create own cookie with anything you want
# for the session part, just make sure to have a period and route part last
### Used for setting cookie
LoadModule headers_module modules/mod_headers.so
Header add Set-Cookie "BALANCEID=balancer.%{BALANCER_WORKER_ROUTE}e; path=/;" env=BALANCER_ROUTE_CHANGED
# Just give some debug info in the header, don't use once you have it working
Header add X-Var "BALANCER_ROUTE_CHANGED=%{BALANCER_ROUTE_CHANGED}e" env=BALANCER_ROUTE_CHANGED
Header add X-Var "BALANCER_WORKER_ROUTE=%{BALANCER_WORKER_ROUTE}e" env=BALANCER_WORKER_ROUTE
Header add X-Var "BALANCER_SESSION_ROUTE=%{BALANCER_SESSION_ROUTE}e" env=BALANCER_SESSION_ROUTE
Presto! Session persistence, all handled at the reverse proxy load balancer level.
Normally most webservers these days that hold sensitive information allow SSL ciphers of 128 bit or higher. However, it would be nice to redirect older browsers to a different page, suggesting that they upgrade their browser to one supporting decent encryption.
This can be done in Apache with mod_rewrite and enabling lower strength ciphers. Read on to see example configuration code...
Apache's mod_rewrite can be used to do time-sensitive redirects... handy if you have to make a scheduled change at an inconvenient time. But even better, what if you need to get to the original site? This example also includes a url /backdoor that sets a 15 min cookie, redirects to the main page, and an exclusion to not redirect anyone who has that cookie set. Cool stuff.
RewriteEngine On
# Start redirecting after this datetime
RewriteCond %{TIME_YEAR}%{TIME_MON}%{TIME_DAY}%{TIME_HOUR}%{TIME_MIN} >200904040900
# Don't redirect certain paths
RewriteCond %{REQUEST_URI} !^/favicon.ico
RewriteCond %{REQUEST_URI} !^/webservices
RewriteCond %{REQUEST_URI} !^/backdoor
# Don't redirect if backdoor cookie is active
RewriteCond %{HTTP_COOKIE} !backdoor
# Do the rewrite
RewriteRule .* http://mynewhostname/ [R,L]
# Allow back door access to old site (this site) - hit /backdoor and they get a cookie for
# 15 mins such that they won't be redirected while it is active.
RewriteRule ^/backdoor http://myoldhostname/ [CO=backdoor:yes:myoldhostname:15:/]
One of my passions is automated monitoring and correction of network and server problems. I have the most experience with SiteScope (primarily a commercial website monitoring tool that has branched out to include protocols, application stacks, and whatever custom stuf you want) and Nagios, which is free and open source, and very very configurable.
I would LOVE to form a company implementing these or similar monitoring tools. I've done this a lot at work, and a little bit on the side for a few friends and their companies.
I've been looking around, and it seems that in addition to Nagios, two other contenders are Zenoss and Cacti. I've heard good things about Zenoss, specifically how it is easier to set up than Nagios. I think I may check it out, though I am a fan of Nagios's flexibility.
We had a requirement from a client whose windows website we were migrating to UNIX that the new site be able to handle mixed case tickers, ie, /pwc, /Pwc, /PWC, /pwC, etc. Using mod_rewrite, it was doable:
# Take any mixed or uppercase ticker and set to lower
RewriteMap lowercase int:tolower
RewriteRule ^(/[A-Z]...?)$ ${lowercase:$1} [R,L]
RewriteRule ^(/.[A-Z]..?)$ ${lowercase:$1} [R,L]
RewriteRule ^(/..[A-Z].?)$ ${lowercase:$1} [R,L]
RewriteRule ^(/...[A-Z])$ ${lowercase:$1} [R,L]
This case conversion will be true for any 3 or 4 char URI with an uppercase letter. (It would probably be better to replace the "." above with [a-zA-Z], as it's likely intended for only chars to replace. Above will transform /a/BB as well, which is probably not desired.)
It seems that even selecting a jury in Fort Bend county takes longer than can be done before lunch. I had a deceptively filling steak burrito at a local mexican place, and then decided to spend the remaining 60 of my 90 minute lunch walking around historic Richmond. I noticed an Italian place serving Osso Bucco! Darn, too bad I already ate. Now I almost want to be on the jury so I can go back there as well as another popular looking place or two.
I had the misfortune of walking into a gift shop with a confectionery, and thus walked out with two pieces of peanut butter fudge. Sitting on the bench in the cool afternoon tasting the peanutty treat with the sun on my face really made my day.
I got back to the courtroom with 30 minutes to spare, and I noticed that the jury chairs are nice, padded, blue leather chairs. Did I mention that they recline? I'm dead meat after lunch if I am on the jury!
I wonder if it's OK to have a margarita with lunch? Needless to say, I didn't get selected, so I won't get the opportunity... It's probably also not a good idea to do so during jury days, but having one on the jury selection day can't hurt! Just don't get sloshed. *wink wink*
Interesting note: they pay $40 / day if you are selected on the jury, but not for the jury selection. I guess that's sort of the consolation prize for those who have to return the next day.
Monday, September 04 2006 @ 12:28 AM CDT
Contributed by: nat
Views: 430
I noticed tonight that the baby channel (Noggin) that runs shows like Little Bear, Blues Clues, Barney, etc turns into Teen Soap Opera channel after 5. Wow.... Wife started watching one and didn't want me to switch to something else... and damn, I started following it, too.... There's been a "Degrassi" marathon on tonight that's been on while I've been computing on my laptop. I suppose it's interesting enough for a background show, but it's scary to think that I'd stop computing and do more watching... Like I said, teenage soap opera. More interesting that my wife's soap operas she used to watch, anyway. Is that a bad thing?
Tuesday, August 15 2006 @ 10:55 AM CDT
Contributed by: nat
Views: 438
Lots of times I have a need to make a backup of a file or such that I end up forgetting about and it sits around taking up disk space. Sometimes in annoyance of this, I have simply skipped making the backup, and have been burned by it. Finally I came up with this alternative:
Make a directory on your desktop called DeleteIn2Weeks. In my case, the full path was /home/guytonw/Desktop/DeleteIn2Weeks
Create the following cron entries:
0 1 * * * find /home/guytonw/Desktop/DeleteIn2Weeks -mtime +14 -type f -exec echo Deleting {} \;
1 1 * * * find /home/guytonw/Desktop/DeleteIn2Weeks -mtime +14 -type f -exec rm {} \;
This is nice because any files put in there will automatically be swept away after a sufficient amount of time. (Hopefully I won't need the backup after 2 weeks' time!)