[pca] password protecting the proxy server

[Martin Paul]

Amy,

> I've set up pca as a proxy server, and that's working fine.  Based on the
> documentation, though, there doesn't appear to be a way to password protect
> the proxy server.  I don't want to expose my SOA password to everyone with
> access to port 80.

If you have the SOA data in a config file within the document root of 
the server currently, you should better move it to /etc/pca-proxy.conf. 
Like that, the data won't be available via port 80.

> I also don't want to become a patch repository for anyone
> who knows the host exists.

I understand that. If security by obscurity isn't enough, you can use 
any of apache's .htaccess options; put the .htaccess into the directory 
that holds pca-proxy.cgi and the patches under the document root. I'd 
recommend using "Allow/Deny" clauses to restrict access to the server 
based on source IP ranges and/or domains.

If you access the server from different hosts, user/passwd based 
authentication might be better. Use standard AuthType/AuthName/Require 
claused in the .htaccess file, and set xrefurl/patchurl on the clients 
like this:

   xrefurl=http://user:passwd@host/pca/pca-proxy.cgi
   patchurl=http://user:passwd@host/pca/pca-proxy.cgi

There is currently no way to feed user/passwd for proxy-authentication 
to pca interactively (like --askauth does with SunSolve SOA data).

Hope this helps. Thanks for last year's article in samag's Q&A section, 
BTW, I have a copy of the magazine on my "pca wall of fame" :)

Martin.