Subject: Some questions [authentification, ftp-gw, http-gw]

From: Zakharov Mikhail <[email-masked]>
Date: Fri, 2 Feb 2001 02:34:28 -0800 (PST)

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hello,

I have several questions about FWTK:

1. Is it possible to setup ftp-gw to work with
browsers, or I have to use http-gw for ftp-connections
(as it was written in FAQ) ?

2. How can I setup authentification to work with
browsers? For http-gw it's impossible, and what about
ftp-gw?

Best regards
Mikhail

__________________________________________________
Get personalized email addresses from Yahoo! Mail - only $35 
a year!  http://personal.mail.yahoo.com/

---

From: Rick Murphy <[email-masked]>
Date: Mon, 05 Feb 2001 06:25:08 -0500

>(as it was written in FAQ) ?

The proxy for a browser responds HTTP commands, not FTP commands. In other 
words, when you set up a ftp proxy, a browser connects to that and sends 
"get ftp://..." and expects HTML as the response. Because of this, you 
can't use the ftp-gw as a FTP proxy for a web browser.

>browsers? For http-gw it's impossible, and what about

This is the same problem as above - you can't authenticate http with the 
toolkit.

Actually, it wouldn't be hard to add authentication, but then it would only 
work with password authentication - and every element of every web page 
would require an authentication server request to verify the passsword. 
This would be very slow.
To get authentication for http to work well requires a persistent front-end 
that the browser connects to which then authenticates. That only has to 
reauthenticate when the user breaks the connection (by clicking ahead, for 
example.) That front-end could cache the authentication results to avoid 
unnecessary authserver traffic.
         -Rick

---

From: Keith Young <[email-masked]>
Date: Mon, 05 Feb 2001 07:55:41 -0500

> unnecessary authserver traffic.

Rick,

Instead of the front-end, couldn't you add 2 auth timeouts in http-gw:
one timeout which states that your auth will be good for X seconds, and
another which states that if you don't go through http-gw in X seconds,
you will need to re-auth?

I know that it is not as secure (since people could then "steal" your IP
address and go through the proxy un-authenticated), but I'd guess that
it would be easier to write than what you mentioned. But I guess if you
are using clear-text name/password schemes then you don't really care
about being secure in the first place  :-).....

-- 
--Keith Young
-Director of Customer Care/Support, V-ONE Corp.
[email-masked]

---

From: Rick Murphy <[email-masked]>
Date: Mon, 05 Feb 2001 17:34:16 -0500

>you will need to re-auth?

Nope. Each http-gw instance only handles one element of a web page. You 
need something to keep the context. Worse is how click-ahead works - if you 
open a web page with 15 or 20 different elements, your browser posts 
requests for those 4 or 5 at a time. If you click off that page, the 
browser then drops all those connections.

Now, the front-end isn't the only way to do this. A simple authentication 
process that keeps open a shared-memory segment that all the daemon http-gw 
processes interrogate about authentication decisions could also work. 
You've got to do something to minimize the overhead - http-gw processes are 
short-lived so you want them to be lightweight.
         -Rick

---

From: Keith Young <[email-masked]>
Date: Mon, 05 Feb 2001 19:09:22 -0500

> short-lived so you want them to be lightweight.

Actually, I thought about my comments as I was driving into work. Guess
trying to think before 8:00am is a bad idea for me  :-).

I forgot to mention to use my recommendation with a shared memory pool,
which could also be used to "cache" the netperm-table instead of reading
it from disk.

Sorry for my (early morning) stupidity.

---

From: Rick Murphy <[email-masked]>
Date: Tue, 06 Feb 2001 17:34:21 -0500

>you will need to re-auth?

That's perfectly OK - especially with one-time passwords. There's no such 
thing as a persistent connection, so you've got to have some way of 
avoiding re-authenticating users all the time.

>about being secure in the first place  :-).....

But.. you've got to have something somewhere to keep track of what users 
are authenticated, external to the http-gw. It's got to be a lightweight 
authentication process of some sort.

(Admittedly, I'm biased by the design of the Gauntlet authenticating http 
proxy; we had to solve several of these problems to make something usable.)
         -Rick