<!-- SECTION "Protect the manager by Apache" [1098-1708] -->
<h3><aname="protect_the_manager_by_lemonldapng"id="protect_the_manager_by_lemonldapng">Protect the manager by Lemonldap::NG</a></h3>
<!-- SECTION "Protect the Manager by Apache" [1091-1701] -->
<h3><aname="protect_the_manager_by_llng"id="protect_the_manager_by_llng">Protect the Manager by LL::NG</a></h3>
<divclass="level3">
<p>
To protect the manager by Lemonldap::NG, you just have to set this in lemonldap-ng.ini configuration file (section [manager]):
To protect the manager by <acronymtitle="LemonLDAP::NG">LL::NG</acronym>, you just have to set this in <code>lemonldap-ng.ini</code> configuration file (section [manager]):
<p><divclass="noteimportant">Before, you have to create the virtual host manager.your.domain in the manager and set a <ahref="../../documentation/1.0/writingrulesand_headers.html#rules"class="wikilink1"title="documentation:1.0:writingrulesand_headers">rule</a>, else access to the manager will be denied.
<p><divclass="noteimportant">Before, you have to create the virtual host <code>manager.your.domain</code> in the manager and set a <ahref="../../documentation/1.0/writingrulesand_headers.html#rules"class="wikilink1"title="documentation:1.0:writingrulesand_headers">rules</a>, else access to the manager will be denied.
</div></p>
</p>
</div>
<!-- SECTION "Protect the manager by Lemonldap::NG" [1709-2113] -->
<!-- SECTION "Protect the Manager by LL::NG" [1702-2118] -->
<h2><aname="write_good_rules"id="write_good_rules">Write good rules</a></h2>
<divclass="level2">
</div>
<!-- SECTION "Write good rules" [2114-2143] -->
<!-- SECTION "Write good rules" [2119-2148] -->
<h3><aname="order_your_rules"id="order_your_rules">Order your rules</a></h3>
<divclass="level3">
<p>
Rules are applied in alphabetical order (comment and regular expression). The first rule that matches is applied.
</p>
@ -141,16 +142,16 @@ The rule 2 will be applied first, so every authenticated user will access to /pu
Some characters are encoded in URLs by the browser (such as space,…). To avoid problems, Lemonldap::NG decode them using <ahref="http://search.cpan.org/perldoc?Apache2::URI#unescape_url"class="urlextern"title="http://search.cpan.org/perldoc?Apache2::URI#unescape_url"rel="nofollow">http://search.cpan.org/perldoc?Apache2::URI#unescape_url</a>. So write your rules using normal characters.
Some characters are encoded in URLs by the browser (such as space,…). To avoid problems, <acronymtitle="LemonLDAP::NG">LL::NG</acronym> decode them using <ahref="http://search.cpan.org/perldoc?Apache2::URI#unescape_url"class="urlextern"title="http://search.cpan.org/perldoc?Apache2::URI#unescape_url"rel="nofollow">http://search.cpan.org/perldoc?Apache2::URI#unescape_url</a>. So write your rules using normal characters.
@ -246,15 +248,15 @@ See <a href="http://httpd.apache.org/docs/2.2/mod/mod_proxy.html" class="urlexte
Such configuration can have some security problems:
</p>
<ul>
<liclass="level1"><divclass="li"> if a user can access directly to the hidden application, it can bypass Lemonldap::NG protection</div>
<liclass="level1"><divclass="li"> if a user can access directly to the hidden application, it can bypass <acronymtitle="LemonLDAP::NG">LL::NG</acronym> protection</div>
</li>
<liclass="level1"><divclass="li"> if many hidden applications are on the same private network, if one is corrupted (by <acronymtitle="Structured Query Language">SQL</acronym> injection, or another attack), the hacker will be able to access to other applications without using reverse-proxies so it can bypass Lemonldap::NG protection</div>
<liclass="level1"><divclass="li"> if many hidden applications are on the same private network, if one is corrupted (by <acronymtitle="Structured Query Language">SQL</acronym> injection, or another attack), the hacker will be able to access to other applications without using reverse-proxies so it can bypass <acronymtitle="LemonLDAP::NG">LL::NG</acronym> protection</div>
</li>
</ul>
<p>
It is recommended to secure the channel between reverse-proxies and application to be sure that only request coming from the Lemonldap::NG protected reverse-proxies are allowed. You can use one or a combination of:
It is recommended to secure the channel between reverse-proxies and application to be sure that only request coming from the <acronymtitle="LemonLDAP::NG">LL::NG</acronym> protected reverse-proxies are allowed. You can use one or a combination of:
</p>
<ul>
<liclass="level1"><divclass="li"> firewalls (but be careful if more than 1 server is behind the firewall)</div>
@ -266,4 +268,24 @@ It is recommended to secure the channel between reverse-proxies and application
Go in Manager, <code>General parameters</code> » <code>Advanced parameters</code> » <code>Security</code>:
</p>
<ul>
<liclass="level1"><divclass="li"><strong>Username control</strong>: Regular expression used to check user login syntax.</div>
</li>
<liclass="level1"><divclass="li"><strong>Force authentication</strong>: set to 'On' to force authentication when user connects to portal, even if he has a valid session</div>
</li>
<liclass="level1"><divclass="li"><strong>Encryption key</strong>: key used to crypt some data, should not be known by other applications</div>
</li>
<liclass="level1"><divclass="li"><strong>Trusted domains</strong>: domains on which the user can be redirected after login on portal. Set '*' to accept all.</div>
Clément Oudot
15 years ago