[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Apache Configuration



> What security model do these have ? Passwords ? Use SSL/SSH ? Usable from
> Mozilla or require special client ? Proxy ? 

Although some of the projects are still under development, I can
answer you: Every security model supported by Apache, is usable by
these tools, i.e. passwords, access-lists, SSL under Apache-SSL, etc.

But I think that the most important model is: using a special port,
different than 80. Not only that it is supported by these tools, but
as I understood it is even the default. The security is achieved by
using a port which is blocked by your router and/or your firewall
and/or your UNIX. Although it is not a replacement for the basic
methods (since it doesn't block the other internal users), it is a
critical method for blocking external intruders.

The commercial tool requires a frames+tables supported browser. The
HTTP/Java tool requires a Java supported browser.

BTW: At least the commercial tool, requires you to run it as root.
Although not a good practice, but they explain how to do it with
the minimal danger.

BTW^2: Meanwhile, I cancel my plans to develop yet another tool. I
was not aware of the other tools (as well as 99% of the Apache
users. These 3 projects are so unknown and unfamous...). I believe
that the leading tool among the 3 will be the tool developed by
Justin ( http://butler.disa.mil/ApacheConfig/ ), because of the
following reasons:

1. It looks the most professional.
2. Web interface (HTTP, HTML, Java) contrary to the Tcl/Tk tool.
3. Programmable interface (SNMP!).
4. Free (contrary to WarPaint).
5. Full source (contrary to WarPaint).
6. To be included in Apache 2.0 (scheduled to May, but let me be
   skeptical  :-(

-- 
Eli Marmor
marmor@elmar.co.il
El-Mar Software Ltd.