NodeBrain TM Webster Module Tutorial

Certificate Authentication

Certificates provide the best level of security with Webster. Since Webster is intended for NodeBrain application administrators, it extends the full rights of the native caboodle account for issuing shell commands. For this reason, Webster insists on user authentication, and we strongly recommend that you use certificates for this purpose. If you elect to use passwords for user authentication, then it is very important that you use HTTPS, which requires a server certificate.

Configure Server Certificate

You obtain a server certificate for Webster the same way you would obtain a server certificate for an Apache web server, or many other applications that use TLS/SSL. You will need the openssl command. Change to the security directory for this section.

    cd tutorial/Webster/security
    
Start by generating a private key. (Note: We are using Webster's default file names in this section to avoid having to configure the options that tell Webster to use different names, so use the exact names shown.)
    openssl genrsa -out ServerKey.pem 1024
    
Then you need to generate a certificate signing request. Enter your server's fully qualified host name as the "Common Name".
    openssl req -new -key ServerKey.pem -out CertificateRequest.csr
    
Next send the certificate signing request to a certificate authority (e.g. VeriSign) and store the returned certificate as tutorial/Webster/security/ServerCertificate.pem.

To save time for this tutorial, let's generate a self signed certificate.

    cd tutorial/Webster/Security
    openssl x509 -req -days 90 -in CertificateRequest.csr -signkey ServerKey.pem -out ServerCertificate.pem
    
Now kill your webster2 process and execute webster3. The webster3 script looks like this.
    #!/usr/bin/nb -d
    # File: tutorial/Webster/webster3
    -rm log/webster.log
    set log="log/webster.log";
    define webster node webster;
    webster. define uri cell "https://0.0.0.0:62443";
    webster. define option cell "cert";
    webster. define Authenticate cell "password";   # Default is "yes"
    
Change the URL in your browser to use HTTPS instead of HTTP.
    https://hostname:62443/certificates.html
When using a self signed certificate, your browser will not recognize your server certificate as having been signed by a trusted certificate authority, so you will need to respond to your browser's complaints and tell it to trust your certificate. You should view the certificate displayed by your browser before accepting it. Now you have a secure configuration. Still using passwords for user authentication, but at least now the passwords are encrypted when sent to the server.

Configuring Client Certificates

There are two requirements for using client certificates: 1) you must install a client certificate in your browser, and 2) you must configure Webster to trust the signer of your browser certificate.

For this tutorial, we're going to take the easy path. We'll start by making our server certificate our "trusted certificate". This just means we will trust client certificates that have been signed by our server key. We do this by copying our ServerCertificate.pem to a file named TrustedCertificates.pem.

    cd tutorial/Webster/security
    cp ServerCertificate.pem TrustedCertificates.pem
Now we need to create a client certificate for our browser. What you pick for a "Common Name" when creating the certificate signing request must uniquely identify the user of the certificate.
    openssl genrsa -out browser.key 1024
    openssl req -new -key browser.key -out browser.csr
    openssl x509 -req -days 90 -in browser.csr -signkey ServerKey.pem -out browser.crt
    openssl pkcs12 -export -in browser.crt -out browser.p12 -inkey ServerKey.pem -name "My Cert"
    
Import browser.p12 into your browser following the instructions for your browser.

Now you can kill your webster3 process and run webster4. It looks like this.

    #!/usr/bin/nb -d
    # File: tutorial/Webster/webster4
    -rm log/webster.log
    set log="log/webster.log";
    define webster node webster("default@0.0.0.0:62443");
    webster. define uri cell "https://0.0.0.0:62443";
    
Now you can configure your tutorial/Webster/security/AccessList.conf file to accept certificates or passwords. User's without a valid certificate are prompted for a user and password. If there is no match in the access list, access is denied.
    # Webster Access List
    # Format:
    #
    #   role,userid; [# comment]
    #
    #   role: a - administrator
    #         b - browser
    #
    #a,d2Vic3RlcjoydG9yaWFs; # webster:2torial
    a,common-name;
    

Copyright © 2014 NodeBrain.org