Coming up in part 2...

Linux/Unix VPN Client

SSH Tunnels

Authenticated access

to Cambridge web resources

to E-journals

Other things

Linux/Unix VPN Client

See http://www-uxsup.csx.cam.ac.uk
/misc/CambridgeVPNLinux.html

SSH Tunnels

SSH supports 'port forwarding'

Useful for creating secure 'tunnels'

But also changes apparent origin

SSH Tunnels

SSH supports 'port forwarding'

Useful for creating secure 'tunnels'

But also changes apparent origin

Basic forwarding

ssh -L 7654:ppsw.cam.ac.uk:25 jw35@mnementh.csi.cam.ac.uk

Basic forwarding

ssh -L 7654:ppsw.cam.ac.uk:25 jw35@mnementh.csi.cam.ac.uk

PuTTY can do this too

PuTTY can do this too

Not this!!!

(nor the -g option of ssh)

Simple web forwarding

ssh -L 7654:www.cam.ac.uk:80 jw35@mnementh.csi.cam.ac.uk

Simple web forwarding

ssh -L 7654:www.cam.ac.uk:80 jw35@mnementh.csi.cam.ac.uk

Forwarding a proxy connection

ssh -L 7654:wwwcache.cam.ac.uk:8080 jw35@mnementh.csi.cam.ac.uk

Forwarding a proxy connection

ssh -L 7654:wwwcache.cam.ac.uk:8080 jw35@mnementh.csi.cam.ac.uk

Securing the insecure

ssh -L 5900:localhost:5900 jw35@mnementh.csi.cam.ac.uk

Problems with all this

Tricky to get right and hard for naive users

Need a tunnel endpoint

Own system

Department system

CUS

linux.pwf.cam.ac.uk (perhaps, perhaps not)

Best as an ad-hoc fix?

Authenticated access

All this reliance on IP addresses is foolish

too restrictive

too lax

If we want to limit access to particular people then you have to identify the people

Our web-based resources

Raven

“A centrally-managed, password based
authentication system for web applications”

Central server

Web browser/web application plugins

Gives you a CRSid on which you can base decisions

Explicit users

LoadModule ucam_webauth_module \
modules/mod_ucam_webauth.so

AACookieKey afef845ce49666ab04b36976a

<Directory "/users_only">
AuthType WebAuth
Require user jw35 jml4 rjd4

</Directory>

Restriction by group

LoadModule ucam_webauth_module \
modules/mod_ucam_webauth.so

AACookieKey afef845ce49666ab04b36976a

<Directory "/groups-only">
AuthType WebAuth

AuthGroupFile groups
Require group cs-staff

</Directory>

Restriction by group

LoadModule ucam_webauth_module \
modules/mod_ucam_webauth.so

AACookieKey afef845ce49666ab04b36976a

<Directory "/groups-only">
AuthType WebAuth

AuthGroupFile groups
Require group cs-staff

</Directory>

cs-staff: jw35 jml4 rjd4

friends: spqr1 abc99

groups:

Any Raven user

LoadModule ucam_webauth_module \
modules/mod_ucam_webauth.so

AACookieKey afef845ce49666ab04b36976a

<Directory "/raven-only">
AuthType WebAuth
Require valid-user

</Directory>

'cam-only' for the 21st century?

LoadModule ucam_webauth_module \
modules/mod_ucam_webauth.so

AACookieKey afef845ce49666ab04b36976a

<Directory "/cam-only">
AuthType WebAuth
Require valid-user

Order allow,deny
Allow from .cam.ac.uk
Satisfy any

</Directory>

E-journals

ERL

Athens-based resources

Athens passwords
http://www.lib.cam.ac.uk/electronicresources/athens.htm

The rest

Everything else

Raven is web browser only

Usenet News

<your service here>

If you have been, thanks for listening

Opportunities for remote access to Cambridge resources

Slides from the second-half of a Techlink seminar on 24th November 2004

2004-11-23T12:01:14