[pca] password protecting the proxy server

[amy.rich at tufts.edu]

martin> If you have the SOA data in a config file within the document root of
martin> the server currently, you should better move it to
martin> /etc/pca-proxy.conf.  Like that, the data won't be available via port
martin> 80.

Hm, I apologize for not being s particularly clear there.  I have it outside
of the documentroot, but not in /etc since the proxy server has the same
client config as the rest of the hosts in /etc/pca.conf (readable only by
root).  The reading of ../etc/pca.conf is mighty convenient for the proxy
portion.

My concern here was more that I have apache running wide open to hosts run by
people outside of my group because of the way our infrastructure is set up (we
share IP space).  If anyone was able to exploit a cgi script running on the
box, they'd have immediate read access to the account info as the apache user.
I'd rather severely restrict who can actually access the webserver with
password authentication to cut down on the number of people who can execute
anything that might possibly be exploitable.

>> I also don't want to become a patch repository for anyone who knows the
>> host exists.

martin> I understand that. If security by obscurity isn't enough, you can use
martin> any of apache's .htaccess options; put the .htaccess into the
martin> directory that holds pca-proxy.cgi and the patches under the document
martin> root. I'd recommend using "Allow/Deny" clauses to restrict access to
martin> the server based on source IP ranges and/or domains.

This would work except that we share IP space with untrusted users.  We'd have
to have hundreds of entries in ipfilter for each individual machine.

martin> If you access the server from different hosts, user/passwd based
martin> authentication might be better. Use standard AuthType/AuthName/Require
martin> claused in the .htaccess file, and set xrefurl/patchurl on the clients
martin> like this:

martin> xrefurl=http://user:passwd@host/pca/pca-proxy.cgi
martin> patchurl=http://user:passwd@host/pca/pca-proxy.cgi

This is the kind of functionality I was looking for, but I wasn't sure if
there was a separate setting for it like there is for the SOA user and passwd.
Will the above example break xref/patch retrieval In the case where the local
patch proxy isn't available, and the client host tries to fall back to
sunsolve?  Would it be better (possible) to set localurl to
http://user:passwd@host/pca/pca-proxy.cgi ?

martin> Hope this helps. Thanks for last year's article in samag's Q&A
martin> section, BTW, I have a copy of the magazine on my "pca wall of fame"

My pleasure!  Thank you for writing a patching system that actually _works_.