Subject: http-gw restrictions from WinNT Term Svr/Citrix MetaFrame

From: [email-masked] (Michael Cassidy)
Date: Mon, 30 Jul 2001 21:41:56 -0700 (PDT)

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hi All,

Just wondering if anyone might have any ideas on how one could go about
controlling access to http-gw for users running from WinNT sessions on
a Windows NT Terminal Server (which also happens to be running Citrix
MetaFrame). I'm guessing not much can be done since each user on any
given server will be seen as coming from the same IP address, but I
thought it would be worth a try anyway. Of course the objective is to
be able to allow certain users access to http-gw and others not.

Although all the users would have the same IP address, I'm wondering
whether there might be some way to "push" some additional info to
http-gw that could be used to distinguish one user from another.

Anyone have any suggestions? Thanks.

Michael Cassidy

---

From: Denis Tokarev <[email-masked]>
Date: Tue, 31 Jul 2001 10:18:29 +0400

> http-gw that could be used to distinguish one user from another.

	May be using some kind of authorisation is a solution? Consider using of
authsrv component from fwtk package.

/dvt

---

From: [email-masked]
Date: Tue, 31 Jul 2001 14:07:53 +0400

-----BEGIN PGP SIGNED MESSAGE-----

nuqneH,

http authorization is real PITA and it is really hard to implement it properly.
the proper way seems to be use of short-living reusable passwords generated
after traditional authsrv OTP authentication succeeds.

> authsrv component from fwtk package.
 
                                     _     _  _  _  _      _  _
 {::} {::} {::}  CU in Hell          _| o |_ | | _|| |   / _||_|   |_ |_ |_
 (##) (##) (##)        /Arkan#iD    |_  o  _||_| _||_| /   _|  | o |_||_||_|
 [||] [||] [||]            Do i believe in Bible? Hell,man,i've seen one!