CTS2-LE Security Configuration - Versionsgeschichte

Billig am 17. Januar 2016 um 10:42 Uhr

2016-01-17T10:42:36Z

Billig am 15. Januar 2016 um 15:56 Uhr

2016-01-15T15:56:33Z

Kuhlisch: Simple Access Control mit Beispielkonfiguration NGINX

2015-06-11T14:40:26Z

Simple Access Control mit Beispielkonfiguration NGINX

Kuhlisch: Die Seite wurde neu angelegt: „CTS2-LE standard configuration allows unrestricted read access while administrative functionalities (e. g. loading/updating terminologies) is restricted to reg…“

2015-06-09T10:04:34Z

Die Seite wurde neu angelegt: „CTS2-LE standard configuration allows unrestricted read access while administrative functionalities (e. g. loading/updating terminologies) is restricted to reg…“

Neue Seite

CTS2-LE standard configuration allows unrestricted read access while administrative functionalities (e. g. loading/updating terminologies) is restricted to registered named users. This section describes how to configure these defaut security settings and how enhanced security services (e. g. full access control) may be linked with CTS2-LE.

== Simple Access Control ==

By default each access to administrative HTTP and REST-based services of CTS2-LE is secured by means of the SSL/TLS protocol with a complementary HTTP Basic Authentication. We recommend that you secure your CTS2-LE instance With the help of a reverse proxy server.

The following sample configuration uses [http://nginx.org NGINX] as a proxy.

nginx.conf

<syntaxhighlight lang="bash">
http {
server {
listen 80 default_server;
server_name localhost;

root html;
index index.html index.htm;

location ~ (?:manage|crud) {
rewrite ^ https://$server_name$request_uri? permanent;
}
}

server {
listen 443 ssl;
server_name localhost;
ssl on;
ssl_certificate cert.crt;
ssl_certificate_key cert.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;

root html;
index index.html index.htm;

location / {
rewrite ^ http://$server_name$request_uri? permanent;
}

location ~ (?:manage|crud) {
auth_basic "Managing operations require authentication";
auth_basic_user_file .htpasswd;
}
}
}
</syntaxhighlight>

@@ Zeile 1: / Zeile 1: @@
-CTS2-LE standard configuration allows unrestricted read access while administrative functionalities (e.g., loading/updating terminologies) is restricted to registered named users. This section describes how to configure these default security settings and how enhanced security services (e.g., full access control) may be linked with CTS2-LE.
+CTS2-LE standard configuration allows unrestricted read access while administrative functionalities (e.g., loading/updating terminologies) are restricted <!-- to registered named users -->. This section describes how to configure these default security settings. <!-- and how enhanced security services (e.g., full access control) may be linked with CTS2-LE. -->
 == Simple Access Control ==
@@ Zeile 112: / Zeile 112: @@
 == Advanced Access Control ==
-OAuth etc. <tbc>
+<!-- OAuth etc. -->

← Nächstältere Version		Version vom 15. Januar 2016, 15:56 Uhr
Zeile 112:		Zeile 112:

	== Advanced Access Control ==		== Advanced Access Control ==
−	OAuth etc.	+	OAuth etc. <tbc>

@@ Zeile 1: / Zeile 1: @@
-CTS2-LE standard configuration allows unrestricted read access while administrative functionalities (e. g. loading/updating terminologies) is restricted to registered named users. This section describes how to configure these defaut security settings and how enhanced security services (e. g. full access control) may be linked with CTS2-LE.
+CTS2-LE standard configuration allows unrestricted read access while administrative functionalities (e.g., loading/updating terminologies) is restricted to registered named users. This section describes how to configure these default security settings and how enhanced security services (e.g., full access control) may be linked with CTS2-LE.
 == Simple Access Control ==
-By default each access to administrative HTTP and REST-based services of CTS2-LE is secured by means of the SSL/TLS protocol with a complementary HTTP Basic Authentication. We recommend that you secure your CTS2-LE instance With the help of a reverse proxy server.
+By default each access to administrative HTTP and REST-based services of CTS2-LE is secured by means of the SSL/TLS protocol with a complementary HTTP Basic Authentication. We recommend that you secure your CTS2-LE instance with the help of a reverse proxy server. In case that no security applicance is available you can use an NGINX server instead. Use these instructions for setting up an NGINX instance.
-The following sample configuration uses [http://nginx.org NGINX] as a proxy.
+		root html;
-nginx.conf
+			proxy_set_header Host $host;
-<syntaxhighlight lang="bash">
+			client_max_body_size 10m;
-http {
+			client_body_buffer_size 128k;
-		root   html;
+			proxy_connect_timeout 90;
-		index  index.html index.htm;
+			proxy_send_timeout 90;
-		location ~ (?:manage|crud) {
+			proxy_buffer_size 4k;
-			rewrite ^ https://$server_name$request_uri? permanent;
+			proxy_buffers 4 32k;
+			proxy_busy_buffers_size 64k;
+	}
 	server {
-		listen              443 ssl;
+		listen 443 ssl;
-		server_name         localhost;
-		ssl                 on;
+		server_name dev.test.com;
-		ssl_certificate      cert.crt;
+		ssl on;
-		ssl_certificate_key  cert.key;
+		ssl_certificate cert.crt;
-		ssl_session_cache    shared:SSL:1m;
+		ssl_certificate_key cert.key;
-		ssl_session_timeout  5m;
-		ssl_ciphers  HIGH:!aNULL:!MD5;
+		# Perfect Forward Security
-		ssl_prefer_server_ciphers  on;
+		ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+		ssl_prefer_server_ciphers on;
-		root   html;
+		ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS +RC4 RC4";
-		index  index.html index.htm;
-		location / {
+		location = / {
 			rewrite ^ http://$server_name$request_uri? permanent;
+		}
-		location ~ (?:manage|crud) {
+		location ~ (?:manage|crud|application\.wadl) {
-			auth_basic            "Managing operations require authentication";
+			proxy_pass  http://$server_name:8033;
-			auth_basic_user_file  .htpasswd;
+			proxy_redirect off;
+		}
-−
+	}
+}
 </syntaxhighlight>