Thread: Web Security

Web Security

From
Paul Joseph McGee
Date:
Hi everybody,
I am trying to implement a website where users may login and view
available properties. Basically it is an online auctioneering site which
is my final year project. I want to be able as SysAdmin to log in
myself
and modify, add properties, upload images etc. At the moment I am toying
with letting
both users and SysAdmin log in from the same authentication window. The
properties are all saved in a PostgreSQL database on my machine here. I
have created a user <webadmin> who has insert, update, select and delete
priveleges
on all tables in my database. This user is unable to create databases or
users. When the SysAdmin logs in he will have a page where he can modify
houses etc, while when an ordinary user logs in he will have the basic
window where he can search for houses. At the moment I have it such that
both users and SysAdmin when connected are connected as webadmin. I dont
think this is a very secure method but its all i can think of at the
moment. I'm also not sure how to kep the SysAdmin's page secure from
everybody else. At the moment all my pages are in a
/usr/local/apache/htdocs/project/ directory. Does anybody have an idea how
i could make this implementation more secure and functional.
Thanks,
Paul

Re: Web Security

From
Dorin Grunberg
Date:
Perhaps you could create a directory called SysAdmin protected by an
.htaccess file that  allows access only to the SysAdmin person with the
right user name and password.

Depending on the $REMOTE_USER you can allow or disallow access to certain
areas of your site.

All the best,

Dorin



At 02:05 PM 2/27/2001 +0000, Paul Joseph McGee wrote:
>Hi everybody,
>I am trying to implement a website where users may login and view
>available properties. Basically it is an online auctioneering site which
>is my final year project. I want to be able as SysAdmin to log in
>myself
>and modify, add properties, upload images etc. At the moment I am toying
>with letting
>both users and SysAdmin log in from the same authentication window. The
>properties are all saved in a PostgreSQL database on my machine here. I
>have created a user <webadmin> who has insert, update, select and delete
>priveleges
>on all tables in my database. This user is unable to create databases or
>users. When the SysAdmin logs in he will have a page where he can modify
>houses etc, while when an ordinary user logs in he will have the basic
>window where he can search for houses. At the moment I have it such that
>both users and SysAdmin when connected are connected as webadmin. I dont
>think this is a very secure method but its all i can think of at the
>moment. I'm also not sure how to kep the SysAdmin's page secure from
>everybody else. At the moment all my pages are in a
>/usr/local/apache/htdocs/project/ directory. Does anybody have an idea how
>i could make this implementation more secure and functional.
>Thanks,
>Paul


Re: Web Security

From
"Adam Lang"
Date:
Like you said, have separate users with separate security.

For the people that are only allowed to look at info, implement views on the
postgresql database that only allow basic select statements.

Adam Lang
Systems Engineer
Rutgers Casualty Insurance Company
http://www.rutgersinsurance.com
----- Original Message -----
From: "Paul Joseph McGee" <mcgee@student.cs.ucc.ie>
To: <pgsql-php@postgresql.org>
Sent: Tuesday, February 27, 2001 9:05 AM
Subject: [PHP] Web Security


> Hi everybody,
> I am trying to implement a website where users may login and view
> available properties. Basically it is an online auctioneering site which
> is my final year project. I want to be able as SysAdmin to log in
> myself
> and modify, add properties, upload images etc. At the moment I am toying
> with letting
> both users and SysAdmin log in from the same authentication window. The
> properties are all saved in a PostgreSQL database on my machine here. I
> have created a user <webadmin> who has insert, update, select and delete
> priveleges
> on all tables in my database. This user is unable to create databases or
> users. When the SysAdmin logs in he will have a page where he can modify
> houses etc, while when an ordinary user logs in he will have the basic
> window where he can search for houses. At the moment I have it such that
> both users and SysAdmin when connected are connected as webadmin. I dont
> think this is a very secure method but its all i can think of at the
> moment. I'm also not sure how to kep the SysAdmin's page secure from
> everybody else. At the moment all my pages are in a
> /usr/local/apache/htdocs/project/ directory. Does anybody have an idea how
> i could make this implementation more secure and functional.
> Thanks,
> Paul


Re: Web Security

From
"Adam Lang"
Date:
I think the best solution is to start with appropriate security rules for
the database itself.

Here is more detail.

You create 3 types of users on the database.  SystemAdmins - they can
change, updaters (or whatever you want to call them) - they can change stuff
that they created or whatever you want them to be able to do, and then you
have the generaluser - they only view info.

When you add a user for your web application, you store the user in a table
along with what group they are.

Then, for your app, you have different database passwords for each group
type.  Sysadmins will have a set, updaters will have a set and users will
have a set.

When JoeBloe user logs into your app, the password HE types in is checked to
make sure he is really JoeBloe.  If he is, you grab from the database what
group he is ... user.  So when you go to access data from the db, you use
the login/password pair for the user ... the user on the database will have
no securiy rights to do anything but sijple selects.

Same thing for the other groups of users.

Adam Lang
Systems Engineer
Rutgers Casualty Insurance Company
http://www.rutgersinsurance.com
----- Original Message -----
From: "Dorin Grunberg" <dorin@visgen.com>
To: "Paul Joseph McGee" <mcgee@student.cs.ucc.ie>;
<pgsql-php@postgresql.org>
Sent: Tuesday, February 27, 2001 10:26 AM
Subject: Re: [PHP] Web Security


> Perhaps you could create a directory called SysAdmin protected by an
> .htaccess file that  allows access only to the SysAdmin person with the
> right user name and password.
>
> Depending on the $REMOTE_USER you can allow or disallow access to certain
> areas of your site.
>
> All the best,
>
> Dorin
>
>
>
> At 02:05 PM 2/27/2001 +0000, Paul Joseph McGee wrote:
> >Hi everybody,
> >I am trying to implement a website where users may login and view
> >available properties. Basically it is an online auctioneering site which
> >is my final year project. I want to be able as SysAdmin to log in
> >myself
> >and modify, add properties, upload images etc. At the moment I am toying
> >with letting
> >both users and SysAdmin log in from the same authentication window. The
> >properties are all saved in a PostgreSQL database on my machine here. I
> >have created a user <webadmin> who has insert, update, select and delete
> >priveleges
> >on all tables in my database. This user is unable to create databases or
> >users. When the SysAdmin logs in he will have a page where he can modify
> >houses etc, while when an ordinary user logs in he will have the basic
> >window where he can search for houses. At the moment I have it such that
> >both users and SysAdmin when connected are connected as webadmin. I dont
> >think this is a very secure method but its all i can think of at the
> >moment. I'm also not sure how to kep the SysAdmin's page secure from
> >everybody else. At the moment all my pages are in a
> >/usr/local/apache/htdocs/project/ directory. Does anybody have an idea
how
> >i could make this implementation more secure and functional.
> >Thanks,
> >Paul


Re: Web Security

From
Steve Bern
Date:
If you want to learn by example, check out the geeklog application ...
there are several like it, but geeklog prides itself on security.  It is a
full functioning website/newssite/pollsite all driven with, in this case,
MySQL... but it would be pretty easy to apply what it's doing to
PostGreSQL.  It also uses PHP, which I'm not sure if you're using.  But,
anyway, it has basically, all the features you mentioned (Admin section,
way to do passwords, set up users, have users do some things, have even
others who aren't admin, but can do specific things...)

http://geeklog.newsgeeks.com

Steve

On Tue, 27 Feb 2001, Paul Joseph McGee wrote:

> Hi everybody,
> I am trying to implement a website where users may login and view
> available properties. Basically it is an online auctioneering site which
> is my final year project. I want to be able as SysAdmin to log in
> myself
> and modify, add properties, upload images etc. At the moment I am toying
> with letting
> both users and SysAdmin log in from the same authentication window. The
> properties are all saved in a PostgreSQL database on my machine here. I
> have created a user <webadmin> who has insert, update, select and delete
> priveleges
> on all tables in my database. This user is unable to create databases or
> users. When the SysAdmin logs in he will have a page where he can modify
> houses etc, while when an ordinary user logs in he will have the basic
> window where he can search for houses. At the moment I have it such that
> both users and SysAdmin when connected are connected as webadmin. I dont
> think this is a very secure method but its all i can think of at the
> moment. I'm also not sure how to kep the SysAdmin's page secure from
> everybody else. At the moment all my pages are in a
> /usr/local/apache/htdocs/project/ directory. Does anybody have an idea how
> i could make this implementation more secure and functional.
> Thanks,
> Paul
>





Re: Web Security

From
Steve Bern
Date:
If you want to learn by example, check out the geeklog application ...
there are several like it, but geeklog prides itself on security.  It is a
full functioning website/newssite/pollsite all driven with, in this case,
MySQL... but it would be pretty easy to apply what it's doing to
PostGreSQL.  It also uses PHP, which I'm not sure if you're using.  But,
anyway, it has basically, all the features you mentioned (Admin section,
way to do passwords, set up users, have users do some things, have even
others who aren't admin, but can do specific things...)

http://geeklog.newsgeeks.com

Steve

On Tue, 27 Feb 2001, Paul Joseph McGee wrote:

> Hi everybody,
> I am trying to implement a website where users may login and view
> available properties. Basically it is an online auctioneering site which
> is my final year project. I want to be able as SysAdmin to log in
> myself
> and modify, add properties, upload images etc. At the moment I am toying
> with letting
> both users and SysAdmin log in from the same authentication window. The
> properties are all saved in a PostgreSQL database on my machine here. I
> have created a user <webadmin> who has insert, update, select and delete
> priveleges
> on all tables in my database. This user is unable to create databases or
> users. When the SysAdmin logs in he will have a page where he can modify
> houses etc, while when an ordinary user logs in he will have the basic
> window where he can search for houses. At the moment I have it such that
> both users and SysAdmin when connected are connected as webadmin. I dont
> think this is a very secure method but its all i can think of at the
> moment. I'm also not sure how to kep the SysAdmin's page secure from
> everybody else. At the moment all my pages are in a
> /usr/local/apache/htdocs/project/ directory. Does anybody have an idea how
> i could make this implementation more secure and functional.
> Thanks,
> Paul
>