Difference between revisions of "Seon Core web interface"

From Seon
Jump to: navigation, search
(→‎Securing with LDAP / ActiveDirectory)
 
(12 intermediate revisions by the same user not shown)
Line 1: Line 1:
 
== Configuration ==
 
== Configuration ==
−
The Seon Core administrative web interface is configured via the file
+
The Seon web interface uses the [[Seon Core main configuration file|global Seon configuration file "<code>/etc/seon.conf</code>"]]. This file is expected in exactly this location. If this is not the case in your environment, please contact Seon support at contact@seon.de.
−
database.inc.php
+
 
−
where the first lines are intersting only:
+
== Securing with password ==
 +
The easiest way to secure the Seon administrative web interface in an Apache environment is to use the authentification method via ".htaccess". There areseveral options available, the two most common ways are shown here.
 +
 
 +
=== Securing with given username and password ===
 +
In the web interface directory (i.e. <code>/var/www/seon</code>) create a textfile named "<code>.htaccess</code>" with this content:
 
<pre>
 
<pre>
−
<?php
+
AuthUserFile /var/www/seon/.htpasswd
−
// Since 21.10.2006, you have two options to configure your web interface:
+
AuthName "Seon"
−
// - by pointing to an Seon configuration file (like "/etc/seon.conf")
+
AuthType Basic
−
// - by typing in the database connection values directly
+
require valid-user
−
// The type of used configuration is defined in the variable "config_type" using either "file" or "direct".
+
</pre>
−
// Using the "file" method only works if the web interface is located at the same host as Seon is running!
+
The path of the "<code>AuthUserFile</code>" should be changed to your Seon administrative web interface directory.
  
−
$config_type="file";
+
Then, you have to create the authentification file using the external tool "<code>htpasswd</code>" and add user(s) to that file. In order to create this user file, use it as follows:
−
// $config_type="direct";
+
seon@seonbox:/var/www/seon$ htpasswd -c /var/www/seon/.htpasswd seon
 +
New password:
 +
Re-type new password:
 +
Adding password for user seon
 +
("<code>seon</code>" is the username).
 +
You can add users to the given password file subsequently by calling this program without the parameter "<code>-c</code>":
 +
seon@seonbox:/var/www/seon$ htpasswd /var/www/seon/.htpasswd username2
 +
New password:
 +
Re-type new password:
 +
Adding password for user username2
  
−
$config_file="/etc/seon.conf";
+
=== Securing with LDAP / ActiveDirectory ===
 +
If you have an LDAP based directory service available (i.e. openLDAP, Microsoft Active Directory, IBM Lotus Notes etc.) you can authenticate users via your centralized user storage.
  
−
// confguration part for direct configuration: just uncomment the following 5 lines and change values as needed
+
Requirements:
−
// $mysql_host = "localhost:3306:/tmp/mysql.sock";
+
*Apache module "<code>ldap</code>" is either compiled in or loaded as module:
−
// $mysql_user = "seon";
+
LoadModule ldap_module /usr/lib/apache2/modules/mod_ldap.so
−
// $mysql_password = "seon";
+
*Apache module "<code>authnz_ldap</code>" is either compiled in or loaded as module:
−
// $DBName = "seon";
+
LoadModule authnz_ldap_module /usr/lib/apache2/modules/mod_authnz_ldap.so
−
// $tableprefix="seon_";
 
  
−
// enable this flag if a user-sight of this web interface is wanted
+
Example configuration file in web interface directory (i.e. <code>/var/www/seon</code>) named "<code>.htaccess</code>":
−
// valid values: true/false
+
<pre>
−
$userview=true;
+
AuthType Basic
 +
AuthName Internal
 +
AuthBasicAuthoritative off
 +
AuthBasicProvider ldap
 +
AuthzLDAPAuthoritative off
 +
AuthLDAPURL ldap://192.168.0.1/OU=ou-seon-admin,DC=de,DC=company,DC=net?sAMAccountName??(objectclass=*)
 +
require valid-user
 +
AuthLDAPBindDN "CN=seon,OU=admins,OU=ou-admins,DC=de,DC=company,DC=net"
 +
AuthLDAPBindPassword "pwd"
 
</pre>
 
</pre>
 +
Explanation of the configuration variables:
 +
*AuthLDAPURL: defines the connectivity of the LDAP server via IP address or hostname, also contains the information where to search for valid users
 +
*AuthLDAPBindDN: configuration of the connecting user who has the permission to search for the given user
 +
*AuthLDAPBindPassword: password of the connecting user defined at "AuthLDAPBindDN"
  
−
== enabling user view ==
+
If you want to allow only a list of special usernames (i.e. "<code>username1</code>", "<code>username2</code>" and "<code>username3</code>"), the line starting with "<code>require </code>" must contain a white-space separated list of these allowed usernames:
−
By setting the variable "<code>$userview</code>" to "<code>true</code>", the following components change:
+
require user username1 username2 username3
−
*the header of the web interface disables interacting with the daemons (starting, stopping, dumping logs etc.)
 
−
*Configuration is viewable, but not changeable
 
−
*CAPI configuration is viewable, but not changeable. Scanning new devices is disabled.
 
−
*OFTP2 cipher suites and their configurations (including variable definitions) are disabled completely.
 
−
*Tools (database backup, license update & overview, automatic certificate generation) are disabled completely.
 
−
*Partner overview only contains basic OFTP parameters and no functionality to create, edit and/or delete entries. Seon Enterprise functionality is disabled. Links to statistics for partners are enabled.
 
−
*Send log doesn't contain links to edit partner parameters any more.
 
−
*Receive log doesn't contain links to edit partner parameters any more.
 
−
*xERP log doesn't contain links to edit partner parameters any more.
 
−
*Script logs doesn't support restarting events any more.
 
−
*Send queue doesn't contain any editing functionality. Creating new entries is disabled. Deleting is disabled. Mass-actions are disabled. Aborting active transfers is disabled. Viewing the progress is enabled.
 
−
*Receive queue has no delete- and abort-functionality. Link to edit partner parameters removed.
 
−
*All additional Seon Enterprise specific links have been removed.
 
−
*all unlinked PHP scripts contain a check for accessibility. In user view mode, the abort with the message "''You are not allowed to view this page!''".
 

Latest revision as of 08:37, 5 September 2012

Configuration

The Seon web interface uses the global Seon configuration file "/etc/seon.conf". This file is expected in exactly this location. If this is not the case in your environment, please contact Seon support at contact@seon.de.

Securing with password

The easiest way to secure the Seon administrative web interface in an Apache environment is to use the authentification method via ".htaccess". There areseveral options available, the two most common ways are shown here.

Securing with given username and password

In the web interface directory (i.e. /var/www/seon) create a textfile named ".htaccess" with this content: 

AuthUserFile /var/www/seon/.htpasswd
AuthName "Seon"
AuthType Basic
require valid-user

The path of the "AuthUserFile" should be changed to your Seon administrative web interface directory.

Then, you have to create the authentification file using the external tool "htpasswd" and add user(s) to that file. In order to create this user file, use it as follows: 

seon@seonbox:/var/www/seon$ htpasswd -c /var/www/seon/.htpasswd seon
New password:
Re-type new password:
Adding password for user seon

("seon" is the username). You can add users to the given password file subsequently by calling this program without the parameter "-c": 

seon@seonbox:/var/www/seon$ htpasswd /var/www/seon/.htpasswd username2
New password:
Re-type new password:
Adding password for user username2

Securing with LDAP / ActiveDirectory

If you have an LDAP based directory service available (i.e. openLDAP, Microsoft Active Directory, IBM Lotus Notes etc.) you can authenticate users via your centralized user storage.

Requirements:

  • Apache module "ldap" is either compiled in or loaded as module:
LoadModule ldap_module /usr/lib/apache2/modules/mod_ldap.so
  • Apache module "authnz_ldap" is either compiled in or loaded as module:
LoadModule authnz_ldap_module /usr/lib/apache2/modules/mod_authnz_ldap.so

Example configuration file in web interface directory (i.e. /var/www/seon) named ".htaccess": 

AuthType Basic
AuthName Internal
AuthBasicAuthoritative off
AuthBasicProvider ldap
AuthzLDAPAuthoritative off
AuthLDAPURL ldap://192.168.0.1/OU=ou-seon-admin,DC=de,DC=company,DC=net?sAMAccountName??(objectclass=*)
require valid-user
AuthLDAPBindDN "CN=seon,OU=admins,OU=ou-admins,DC=de,DC=company,DC=net"
AuthLDAPBindPassword "pwd"

Explanation of the configuration variables:

  • AuthLDAPURL: defines the connectivity of the LDAP server via IP address or hostname, also contains the information where to search for valid users
  • AuthLDAPBindDN: configuration of the connecting user who has the permission to search for the given user
  • AuthLDAPBindPassword: password of the connecting user defined at "AuthLDAPBindDN"

If you want to allow only a list of special usernames (i.e. "username1", "username2" and "username3"), the line starting with "require " must contain a white-space separated list of these allowed usernames: 

require user username1 username2 username3
Retrieved from "https://wiki.seon.de/wiki/index.php?title=Seon_Core_web_interface&oldid=1526"