1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
|
====================
Using Authentication
====================
----------------
Module: mod_auth
----------------
:Author: Jan Kneschke
:Date: $Date$
:Revision: $Revision$
:abstract:
The auth module provides ...
.. meta::
:keywords: lighttpd, authentication
.. contents:: Table of Contents
Description
===========
Supported Methods
-----------------
lighttpd supportes both authentication method described by
RFC 2617:
basic
`````
The Basic method transfers the username and the password in
cleartext over the network (base64 encoded) and might result
in security problems if not used in conjunction with a crypted
channel between client and server.
digest
``````
The Digest method only transfers a hashed value over the
network which performs a lot of work to harden the
authentication process in insecure networks.
Backends
--------
Depending on the method lighttpd provides various way to store
the credentials used for the authentication.
for basic auth:
- plain_
- htpasswd_
- htdigest_
- ldap_
for digest auth:
- plain_
- htdigest_
plain
`````
A file which contains username and the cleartext password
seperated by a colon. Each entry is terminated by a single
newline.::
e.g.:
agent007:secret
htpasswd
````````
A file which contains username and the crypt()'ed password
seperated by a colon. Each entry is terminated by a single
newline. ::
e.g.:
agent007:XWY5JwrAVBXsQ
You can use htpasswd from the apache distribution to manage
those files. ::
$ htpasswd lighttpd.user.htpasswd agent007
htdigest
````````
A file which contains username, realm and the md5()'ed
password seperated by a colon. Each entry is terminated
by a single newline. ::
e.g.:
agent007:download area:8364d0044ef57b3defcfa141e8f77b65
You can use htdigest from the apache distribution to manage
those files. ::
$ htdigest lighttpd.user.htdigest 'download area' agent007
Using md5sum can also generate the password-hash: ::
#!/bin/sh
user=$1
realm=$2
pass=$3
hash=`echo -n "$user:$realm:$pass" | md5sum | cut -b -32`
echo "$user:$realm:$hash"
To use it:
$ htdigest.sh 'agent007' 'download area' 'secret'
agent007:download area:8364d0044ef57b3defcfa141e8f77b65
ldap
````
the ldap backend is basically performing the following steps
to authenticate a user
1. connect anonymously (at plugin init)
2. get DN for filter = username
3. auth against ldap server
4. disconnect
if all 4 steps are performed without any error the user is
authenticated
Configuration
=============
::
## debugging
# 0 for off, 1 for 'auth-ok' messages, 2 for verbose debugging
auth.debug = 0
## type of backend
# plain, htpasswd, ldap or htdigest
auth.backend = "htpasswd"
# filename of the password storage for
# plain
auth.backend.plain.userfile = "lighttpd-plain.user"
## for htpasswd
auth.backend.htpasswd.userfile = "lighttpd-htpasswd.user"
## for htdigest
auth.backend.htdigest.userfile = "lighttpd-htdigest.user"
## for ldap
# the $ in auth.backend.ldap.filter is replaced by the
# 'username' from the login dialog
auth.backend.ldap.hostname = "localhost"
auth.backend.ldap.base-dn = "dc=my-domain,dc=com"
auth.backend.ldap.filter = "(uid=$)"
# if enabled, startTLS needs a valid (base64-encoded) CA
# certificate
auth.backend.ldap.starttls = "enable"
auth.backend.ldap.ca-file = "/etc/CAcertificate.pem"
## restrictions
# set restrictions:
#
# ( <left-part-of-the-url> =>
# ( "method" => "digest"/"basic",
# "realm" => <realm>,
# "require" => "user=<username>" )
# )
#
# <realm> is a string to display in the dialog
# presented to the user and is also used for the
# digest-algorithm and has to match the realm in the
# htdigest file (if used)
#
auth.require = ( "/download/" =>
(
"method" => "digest",
"realm" => "download archiv",
"require" => "user=agent007|user=agent008"
),
"/server-info" =>
(
"method" => "digest",
"realm" => "download archiv",
"require" => "valid-user"
)
)
Limitations
============
- The implementation of digest method is currently not
completely compliant with the standard as it still allows
a replay attack.
|
