# $Id: README,v 1.5 2007/12/08 03:26:51 atobey Exp $

In order to install and use this package you will need Perl version
5.6 or better, mod_perl2, libapreq (Apache2::Request), Crypt::CBC,
Crypt::Blowfish and Authen::ACE.

Installation as usual:

  perl Makefile.PL
  make
  make test
  make install

There are three components to Apache::AuthenSecurID.

Apache::AuthenSecurID
Apache::AuthenSecurID::Auth
ace_initd

There are support files for Redhat-based systems in the redhat directory.

NAME
   Apache2::AuthenSecurID - Authentication via a SecurID server

SYNOPSIS
    # Configuration in httpd.conf or access.conf

   PerlModule Apache2::AuthenSecurID

   <Location /secure/directory> AuthName SecurID AuthType Basic

    PerlAuthenHandler Apache2::AuthenSecurID

    PerlSetVar AuthCryptKey Encryption_Key
    PerlSetVar AuthCookie Name_of_Authentication_Cookie
    PerlSetVar AuthUserCookie Name_of_Username_Authentication_Cookie
    PerlSetVar AuthCookiePath /path/of/authentication/cookie
    PerlSetVar AuthCookieTimeOut 30
    PerlSetVar Auth_Handler /path/of/authentication/handler

    require valid-user
   </Location>

DESCRIPTION
   This module allows authentication against a SecurID server. It detects
   whether a user has a valid encrypted cookie containing their username
   and last activity time stamp. If the cookie is valid the module will
   change the activity timestamp to the present time, encrypt and send the
   cookie. If the cookie is not valid the module will redirect to the
   authentication handler to prompt for username and passcode.

LIST OF TOKENS
   * AuthCryptKey
   The Blowfish key used to encrypt and decrypt the authentication cookie.
   It defaults to my secret if this variable is not set.

   * AuthCookie
   The name of the of cookie to be set for the authentication token. It
   defaults to SecurID if this variable is not set.

   * AuthUserCookie
   The name of the of cookie that contains the value of the persons
   username in plain text. This is checked against the contents of the
   encrypted cookie to verify user. The cookie is set of other applications
   can identify authorized users. It defaults to SecurID_User if this
   variable is not set.

   * AuthCookiePath
   The path of the of cookie to be set for the authentication token. It
   defaults to / if this variable is not set.

   * AuthCookieTimeOut
   The time in minute a cookie is valid for. It is not recommended to set
   below 5. It defaults to 30 if this variable is not set.

   * Auth_Handler
   The path of authentication handler. This is the URL which request with
   invalid cookie are redirected to. The handler will prompt for username
   and passcode. It does the actual authentication and sets the initial
   cookie. This mechanism is used instead of get_basic_auth_pw because
   get_basic_auth_pw will do multiple authentication attempt on pages that
   contain frames. The ACE server will deny simultaneous authentication
   attempts since it considers this a type of attack. It defaults to
   /ace_init if this variable is not set. Please see
   Apache2::AuthenSecurID::Auth to properly configure this functionality.

CONFIGURATION
   The module should be loaded upon startup of the Apache daemon. Add the
   following line to your httpd.conf:

    PerlModule Apache2::AuthenSecurID

PREREQUISITES
   For AuthenSecurID you need to enable the appropriate call-back hook when
   making mod_perl:

     perl Makefile.PL PERL_AUTHEN=1

   AuthenSecurID requires Crypt::Blowfish and Crypt::CBC.

SEE ALSO
   Apache, mod_perl, Authen::ACE Apache2::AuthenSecurID::Auth

AUTHORS
   * mod_perl by Doug MacEachern <[email protected]>
   * Authen::ACE by Dave Carrigan <[email protected]>
   * Apache::AuthenSecurID by David Berk <[email protected]>
   * mod_perl2 port and other modifications by Al Tobey <[email protected]>

COPYRIGHT
   The Apache2::AuthenSecurID module is free software; you can redistribute
   it and/or modify it under the same terms as Perl itself.

NAME
   Apache2::AuthenSecurID::Auth - Authentication handler for
   Apache2::AuthenSecurID

SYNOPSIS
    # Configuration in httpd.conf

   <Location /path/of/authentication/handler> SetHandler perl-script
   PerlHandler Apache2::AuthenSecurID::Auth

      PerlSetVar AuthCryptKey Encryption_Key
      PerlSetVar AuthCookie Name_of_Authentication_Cookie
      PerlSetVar AuthUserCookie Name_of_Username_Authentication_Cookie
      PerlSetVar AuthCookiePath /path/of/authentication/cookie
      PerlSetVar AuthApacheCookie Apache_Cookie
      PerlSetVar ace_initd_server name.of.ace.handler.server.com
      PerlSetVar ace_initd_port 1969
   </Location>

DESCRIPTION
   This module allows authentication against a SecurID server. A request is
   redirected to this handler if the authentication cookie does not exist
   or is no longer valid. The handler will prompt for username and
   passcode. It will then construct and encrypt a UDP packet and send it to
   the Ace request daemon. This is necessary since libsdiclient.a needs to
   persist for NEXT TOKEN MODE and SET PIN MODE. If the authentication is
   valid an encrypted Authentication Cookie is set and the request is
   redirected to the originating URI. If the user needs to enter NEXT TOKEN
   or set their PIN they will be prompted to do so and if valid the request
   is then redirected to the originating URI.

LIST OF TOKENS
   * AuthCryptKey
   The Blowfish key used to encrypt and decrypt the authentication cookie.
   It defaults to my secret if this variable is not set.

   * AuthCookie
   The name of the of cookie to be set for the authentication token. It
   defaults to SecurID if this variable is not set.

   * AuthUserCookie
   The name of the of cookie that contains the value of the persons
   username in plain text. This is checked against the contents of the
   encrypted cookie to verify user. The cookie is set of other applications
   can identify authorized users. It defaults to SecurID_User if this
   variable is not set.

   * AuthCookiePath
   The path of the of cookie to be set for the authentication token. It
   defaults to / if this variable is not set.

   * AuthApacheCookie
   The name of the mod_usertrack cookie. The mod_usertrack module must be
   compile and enabled in order to track user sessions. This is set by the
   CookieName directive in httpd.conf. It defaults to Apache if this
   variable is not set.

   * ace_initd_server
   The name of the server running the ACE request daemon. This daemon is
   the actual process that communicates with the ACE Server. If the user is
   in NEXT TOKEN MODE due to repeated failures or SET PIN MODE the
   Authen::ACE object must persist beyond the initial request. A request
   packet is constructed with a random number, type of transaction,
   username, passcode and session identifier. The request packet is then
   encrypted using Blowfish and sent to the ACE request daemon. The ACE
   request daemon decrypts and parses the packet. The request if forwarded
   to the ACE server and the response is sent back to the handler. The
   random number originally sent is returned to prevent attacks. It
   defaults to localhost if this variable is not set.

   * ace_initd_port
   The port the that the Ace request daemon listens on. It defaults to 1969
   if this variable is not set.

CONFIGURATION
   The module should be loaded upon startup of the Apache daemon. Add the
   following line to your httpd.conf:

    PerlModule Apache2::AuthenSecurID::Auth

PREREQUISITES
   For AuthenSecurID::Auth you need to enable the appropriate call-back
   hook when making mod_perl:

     perl Makefile.PL PERL_AUTHEN=1

   AuthenSecurID::Auth requires Crypt::Blowfish and Crypt::CBC.

   For AuthenSecurID::Auth to properly track users mod_usertrack must be
   compiled and enabled.

SEE ALSO
   Apache, mod_perl, Authen::ACE Apache2::AuthenSecurID::Auth

AUTHORS
   * mod_perl by Doug MacEachern <[email protected]>
   * Authen::ACE by Dave Carrigan <[email protected]>
   * Apache::AuthenSecurID by David Berk <[email protected]>
   * Apache::AuthenSecurID::Auth by David Berk <[email protected]>
   * port to mod_perl2 and cleanups by Al Tobey <[email protected]>

COPYRIGHT
   The Apache2::AuthenSecurID::Auth module is free software; you can
   redistribute it and/or modify it under the same terms as Perl itself.

NAME
   ace_initd - ACE Authentication daemon for Apache::AuthenSecurID::Auth

SYNOPSIS
   nohup ./ace_initd --listen=127.0.0.1 --facility=local2 --secret=123456
   --port=1969 --var_ace=/var/ace

DESCRIPTION
   This daemon handles the ACE authentication requests for the
   Apache::SecurID::Auth module. It is a single threaded, single fork
   server that listens on a specified UDP port. Incoming requests are
   decrypted and requests forwarded to the ACE server. If a specific
   request is in either in NEXT TOKEN MODE or SET PIN MODE the Authen::ACE
   object is not deleted. It is instead kept in memory to handle those
   specific requests later.

LIST OF TOKENS
   * --var_ace
   Specifies the location of the sdconf.rec file. It defaults to
   $ENV{VAR_ACE} if this variable is not set.

   * --secret
   The Blowfish key used to encrypt and decrypt the authentication cookie.
   It defaults to my secret if this variable is not set.

   * --port
   The port the that the Ace request daemon listens on. It defaults to 1969
   if this variable is not set.

   * --facility
   The syslog facility ace_initd logs to. It defaults to local2 if this
   variable is not set.

   * --daemon
   Break off from the shell and become a daemon.

CONFIGURATION
   Either run from the command line;

   prompt$ nohup ./ace_initd &

   or write the appropriate scripts in the /etc/rc directories.

PREREQUISITES
   ace_initd requires Crypt::Blowfish, Crypt::CBC and Authen::ACE.

SEE ALSO
   Authen::ACE Apache::AuthenSecurID Apache::AuthenSecurID::Auth

AUTHORS
   * mod_perl by Doug MacEachern <[email protected]>
   * Authen::ACE by Dave Carrigan <[email protected]>
   * Apache::AuthenSecurID by David Berk <[email protected]>
   * Apache::AuthenSecurID::Auth by David Berk <[email protected]>
   * Various changes by Al Tobey <[email protected]>

COPYRIGHT
   ace_initd is free software; you can redistribute it and/or modify it
   under the same terms as Perl itself.

You are viewing proxied material from ftp.icm.edu.pl. The copyright of proxied material belongs to its original authors. Any comments or complaints in relation to proxied material should be directed to the original authors of the content concerned. Please see the disclaimer for more details.