nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

iw-mount and security

groo

On windows, with the y:\ drive on Teamsite 6.0 a network user is prompted for credentials before being allowed to view files, which is good. You can lock users out who should not even see your site.

Can you lock out http://server:81/iw-mount? currently it is open to all users to read.

Find more posts tagged with

Comments

Johnny

If you only use this port through teamsite virtualization (iwproxy), you can close that port off to all except to the localhost.

I'm pretty sure (someone please correct me) that the teamsite proxy service (iwproxy) is the only the service that needs to access your custom webserver. The client never needs to directly access it.

This would be some sort of server admin task on windows... either windows itself or through IIS (or whatever web server you are running)

John Cuiuli

Johnny

You also have this option to filter authenticated users, so that they can only preview what they have read access to.

I'm not sure exactly what release this became available, this is from a 6.5 configuration.


[iwproxy_access_control_enabled]
#
# By default, iwproxy allows any authenticated TeamSite user to view any file in
# TeamSite.  This section allows the administator to specify files for which
# iwproxy should verify the user's ability to read the file from the file
# system.
#
# For instance, the example below implements the following policy:
#
#   1)  All users should be able to read any document on the intranet, except
#       for files in the "/hr/" directory, which require specific read access.
#   2)  All users should be able to read any document on the internet site.
#   3)  For all other branches, iwproxy should check to make sure the current
#       user has read access.
#
#_default=yes
#_regex=^/iw-mount/dc/main/intranet/(((WORKAREA|EDITION)/[^/]+)|STAGING)/hr/=yes
#_regex=^/iw-mount/dc/main/intranet/(((WORKAREA|EDITION)/[^/]+)|STAGING)/=no
#_regex=^/iw-mount/dc/main/www%20external/(((WORKAREA|EDITION)/[^/]+)|STAGING)/=no
#

John Cuiuli

groo

Disabling IPs other than the servers seems to work.
I will try the proxy settings also....

fiquebem

We're running TS 6.1 on Solaris 5.8. We are using iPlanet 6.0 (with the Redirector Module for the SSI installed) as the "Customer Web Server" (on port 81).

We have webserver_uid=nobody in /etc/iw.cfg. Wonder whether that (webserver_uid) makes any difference now that "iwui" is in the picture.

I created a private workarea that's not accessible to the world (its permissions are 2770). Then I created a file in it that was readable only to the owner (myself).

Nonetheless, another user is able to access this file via http://mydomain:81/iw-mount/... (but not via the TS GUI nor a direct, port 80 URL). I'm trying to understand how is that possible. How can the user "nobody" (I guess) view a file via port 81 that the user "nobody" can't access via the file system interface?

Could the Redirector Module be the reason why there's no security?

The iPlanet processes running are:

nobody 17524 17523 0 Feb 24 ? 0:00 ../../bin/https/bin/Cgistub -f /tmp/https-iw-ab0d1119/.cgis
root 9238 1 0 Feb 24 ? 0:00 ./uxwdog -d /opt/iplanet/servers/https-iw/config
nobody 17523 9240 0 Feb 24 ? 0:00 ../../bin/https/bin/Cgistub -f /tmp/https-iw-ab0d1119/.cgis
nobody 9240 9239 2 Feb 24 ? 487:08 ns-httpd -d /opt/iplanet/servers/https-iw/config
root 9239 9238 0 Feb 24 ? 0:02 ns-httpd -d /opt/iplanet/servers/https-iw/config
nobody 17525 17523 0 Feb 24 ? 0:00 ../../bin/https/bin/Cgistub -f /tmp/https-iw-ab0d1119/.cgis

(Disabling access to port 81 from outside the localhost is something we can look into, but first I'd like to understand what's going on.)

Many thanks,

S.