|
|
|||||||||
Certificate Authentication Certificates provide the best level of security with Webster. Since Webster is intended for NodeBrain application administrators, it extends the full rights of the native caboodle account for issuing shell commands. For this reason, Webster insists on user authentication, and we strongly recommend that you use certificates for this purpose. If you elect to use passwords for user authentication, then it is very important that you use HTTPS, which requires a server certificate. Configure Server Certificate You obtain a server certificate for Webster the same way you would obtain a server certificate for an Apache web server, or many other applications that use TLS/SSL. You will need the openssl command. Change to the security directory for this section. cd tutorial/Webster/securityStart by generating a private key. (Note: We are using Webster's default file names in this section to avoid having to configure the options that tell Webster to use different names, so use the exact names shown.) openssl genrsa -out ServerKey.pem 1024Then you need to generate a certificate signing request. Enter your server's fully qualified host name as the "Common Name". openssl req -new -key ServerKey.pem -out CertificateRequest.csrNext send the certificate signing request to a certificate authority (e.g. VeriSign) and store the returned certificate as tutorial/Webster/security/ServerCertificate.pem. To save time for this tutorial, let's generate a self signed certificate. cd tutorial/Webster/Security openssl x509 -req -days 90 -in CertificateRequest.csr -signkey ServerKey.pem -out ServerCertificate.pemNow kill your webster2 process and execute webster3. The webster3 script looks like this. #!/usr/bin/nb -d # File: tutorial/Webster/webster3 -rm log/webster.log set log="log/webster.log"; define webster node webster; webster. define uri cell "https://0.0.0.0:62443"; webster. define option cell "cert"; webster. define Authenticate cell "password"; # Default is "yes"Change the URL in your browser to use HTTPS instead of HTTP.
Configuring Client Certificates There are two requirements for using client certificates: 1) you must install a client certificate in your browser, and 2) you must configure Webster to trust the signer of your browser certificate. For this tutorial, we're going to take the easy path. We'll start by making our server certificate our "trusted certificate". This just means we will trust client certificates that have been signed by our server key. We do this by copying our ServerCertificate.pem to a file named TrustedCertificates.pem.
cp ServerCertificate.pem TrustedCertificates.pem openssl genrsa -out browser.key 1024 openssl req -new -key browser.key -out browser.csr openssl x509 -req -days 90 -in browser.csr -signkey ServerKey.pem -out browser.crt openssl pkcs12 -export -in browser.crt -out browser.p12 -inkey ServerKey.pem -name "My Cert"Import browser.p12 into your browser following the instructions for your browser. Now you can kill your webster3 process and run webster4. It looks like this. #!/usr/bin/nb -d # File: tutorial/Webster/webster4 -rm log/webster.log set log="log/webster.log"; define webster node webster("default@0.0.0.0:62443"); webster. define uri cell "https://0.0.0.0:62443";Now you can configure your tutorial/Webster/security/AccessList.conf file to accept certificates or passwords. User's without a valid certificate are prompted for a user and password. If there is no match in the access list, access is denied. # Webster Access List # Format: # # role,userid; [# comment] # # role: a - administrator # b - browser # #a,d2Vic3RlcjoydG9yaWFs; # webster:2torial a,common-name; Copyright © 2014 NodeBrain.org |