<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<link rel="stylesheet" href="style.css" type="text/css">
<meta content="text/html; charset=iso-8859-1" http-equiv="Content-Type">
<link rel="Start" href="index.html">
<link rel="previous" href="Netpop.html">
<link rel="next" href="Rpc_key_service.html">
<link rel="Up" href="index.html">
<link title="Index of types" rel=Appendix href="index_types.html">
<link title="Index of exceptions" rel=Appendix href="index_exceptions.html">
<link title="Index of values" rel=Appendix href="index_values.html">
<link title="Index of class attributes" rel=Appendix href="index_attributes.html">
<link title="Index of class methods" rel=Appendix href="index_methods.html">
<link title="Index of classes" rel=Appendix href="index_classes.html">
<link title="Index of class types" rel=Appendix href="index_class_types.html">
<link title="Index of modules" rel=Appendix href="index_modules.html">
<link title="Index of module types" rel=Appendix href="index_module_types.html">
<link title="Uq_gtk" rel="Chapter" href="Uq_gtk.html">
<link title="Equeue" rel="Chapter" href="Equeue.html">
<link title="Unixqueue" rel="Chapter" href="Unixqueue.html">
<link title="Uq_engines" rel="Chapter" href="Uq_engines.html">
<link title="Uq_socks5" rel="Chapter" href="Uq_socks5.html">
<link title="Unixqueue_mt" rel="Chapter" href="Unixqueue_mt.html">
<link title="Equeue_intro" rel="Chapter" href="Equeue_intro.html">
<link title="Uq_ssl" rel="Chapter" href="Uq_ssl.html">
<link title="Uq_tcl" rel="Chapter" href="Uq_tcl.html">
<link title="Netcgi_common" rel="Chapter" href="Netcgi_common.html">
<link title="Netcgi" rel="Chapter" href="Netcgi.html">
<link title="Netcgi_ajp" rel="Chapter" href="Netcgi_ajp.html">
<link title="Netcgi_scgi" rel="Chapter" href="Netcgi_scgi.html">
<link title="Netcgi_cgi" rel="Chapter" href="Netcgi_cgi.html">
<link title="Netcgi_fcgi" rel="Chapter" href="Netcgi_fcgi.html">
<link title="Netcgi_dbi" rel="Chapter" href="Netcgi_dbi.html">
<link title="Netcgi1_compat" rel="Chapter" href="Netcgi1_compat.html">
<link title="Netcgi_test" rel="Chapter" href="Netcgi_test.html">
<link title="Netcgi_porting" rel="Chapter" href="Netcgi_porting.html">
<link title="Netcgi_plex" rel="Chapter" href="Netcgi_plex.html">
<link title="Http_client" rel="Chapter" href="Http_client.html">
<link title="Telnet_client" rel="Chapter" href="Telnet_client.html">
<link title="Ftp_data_endpoint" rel="Chapter" href="Ftp_data_endpoint.html">
<link title="Ftp_client" rel="Chapter" href="Ftp_client.html">
<link title="Nethttpd_types" rel="Chapter" href="Nethttpd_types.html">
<link title="Nethttpd_kernel" rel="Chapter" href="Nethttpd_kernel.html">
<link title="Nethttpd_reactor" rel="Chapter" href="Nethttpd_reactor.html">
<link title="Nethttpd_engine" rel="Chapter" href="Nethttpd_engine.html">
<link title="Nethttpd_services" rel="Chapter" href="Nethttpd_services.html">
<link title="Nethttpd_plex" rel="Chapter" href="Nethttpd_plex.html">
<link title="Nethttpd_intro" rel="Chapter" href="Nethttpd_intro.html">
<link title="Netplex_types" rel="Chapter" href="Netplex_types.html">
<link title="Netplex_mp" rel="Chapter" href="Netplex_mp.html">
<link title="Netplex_mt" rel="Chapter" href="Netplex_mt.html">
<link title="Netplex_log" rel="Chapter" href="Netplex_log.html">
<link title="Netplex_controller" rel="Chapter" href="Netplex_controller.html">
<link title="Netplex_container" rel="Chapter" href="Netplex_container.html">
<link title="Netplex_sockserv" rel="Chapter" href="Netplex_sockserv.html">
<link title="Netplex_workload" rel="Chapter" href="Netplex_workload.html">
<link title="Netplex_main" rel="Chapter" href="Netplex_main.html">
<link title="Netplex_config" rel="Chapter" href="Netplex_config.html">
<link title="Netplex_kit" rel="Chapter" href="Netplex_kit.html">
<link title="Rpc_netplex" rel="Chapter" href="Rpc_netplex.html">
<link title="Netplex_cenv" rel="Chapter" href="Netplex_cenv.html">
<link title="Netplex_intro" rel="Chapter" href="Netplex_intro.html">
<link title="Netshm" rel="Chapter" href="Netshm.html">
<link title="Netshm_data" rel="Chapter" href="Netshm_data.html">
<link title="Netshm_hashtbl" rel="Chapter" href="Netshm_hashtbl.html">
<link title="Netshm_array" rel="Chapter" href="Netshm_array.html">
<link title="Netshm_intro" rel="Chapter" href="Netshm_intro.html">
<link title="Netconversion" rel="Chapter" href="Netconversion.html">
<link title="Netchannels" rel="Chapter" href="Netchannels.html">
<link title="Netstream" rel="Chapter" href="Netstream.html">
<link title="Mimestring" rel="Chapter" href="Mimestring.html">
<link title="Netmime" rel="Chapter" href="Netmime.html">
<link title="Netsendmail" rel="Chapter" href="Netsendmail.html">
<link title="Neturl" rel="Chapter" href="Neturl.html">
<link title="Netaddress" rel="Chapter" href="Netaddress.html">
<link title="Netbuffer" rel="Chapter" href="Netbuffer.html">
<link title="Netdate" rel="Chapter" href="Netdate.html">
<link title="Netencoding" rel="Chapter" href="Netencoding.html">
<link title="Netulex" rel="Chapter" href="Netulex.html">
<link title="Netaccel" rel="Chapter" href="Netaccel.html">
<link title="Netaccel_link" rel="Chapter" href="Netaccel_link.html">
<link title="Nethtml" rel="Chapter" href="Nethtml.html">
<link title="Netstring_str" rel="Chapter" href="Netstring_str.html">
<link title="Netstring_pcre" rel="Chapter" href="Netstring_pcre.html">
<link title="Netstring_mt" rel="Chapter" href="Netstring_mt.html">
<link title="Netmappings" rel="Chapter" href="Netmappings.html">
<link title="Netaux" rel="Chapter" href="Netaux.html">
<link title="Nethttp" rel="Chapter" href="Nethttp.html">
<link title="Netchannels_tut" rel="Chapter" href="Netchannels_tut.html">
<link title="Netmime_tut" rel="Chapter" href="Netmime_tut.html">
<link title="Netsendmail_tut" rel="Chapter" href="Netsendmail_tut.html">
<link title="Netulex_tut" rel="Chapter" href="Netulex_tut.html">
<link title="Neturl_tut" rel="Chapter" href="Neturl_tut.html">
<link title="Netsys" rel="Chapter" href="Netsys.html">
<link title="Netpop" rel="Chapter" href="Netpop.html">
<link title="Rpc_auth_dh" rel="Chapter" href="Rpc_auth_dh.html">
<link title="Rpc_key_service" rel="Chapter" href="Rpc_key_service.html">
<link title="Rpc_time" rel="Chapter" href="Rpc_time.html">
<link title="Rpc_auth_local" rel="Chapter" href="Rpc_auth_local.html">
<link title="Rtypes" rel="Chapter" href="Rtypes.html">
<link title="Xdr" rel="Chapter" href="Xdr.html">
<link title="Rpc" rel="Chapter" href="Rpc.html">
<link title="Rpc_program" rel="Chapter" href="Rpc_program.html">
<link title="Rpc_portmapper_aux" rel="Chapter" href="Rpc_portmapper_aux.html">
<link title="Rpc_packer" rel="Chapter" href="Rpc_packer.html">
<link title="Rpc_transport" rel="Chapter" href="Rpc_transport.html">
<link title="Rpc_client" rel="Chapter" href="Rpc_client.html">
<link title="Rpc_simple_client" rel="Chapter" href="Rpc_simple_client.html">
<link title="Rpc_portmapper_clnt" rel="Chapter" href="Rpc_portmapper_clnt.html">
<link title="Rpc_portmapper" rel="Chapter" href="Rpc_portmapper.html">
<link title="Rpc_server" rel="Chapter" href="Rpc_server.html">
<link title="Rpc_auth_sys" rel="Chapter" href="Rpc_auth_sys.html">
<link title="Rpc_intro" rel="Chapter" href="Rpc_intro.html">
<link title="Rpc_mapping_ref" rel="Chapter" href="Rpc_mapping_ref.html">
<link title="Rpc_ssl" rel="Chapter" href="Rpc_ssl.html">
<link title="Rpc_xti_client" rel="Chapter" href="Rpc_xti_client.html">
<link title="Shell_sys" rel="Chapter" href="Shell_sys.html">
<link title="Shell" rel="Chapter" href="Shell.html">
<link title="Shell_uq" rel="Chapter" href="Shell_uq.html">
<link title="Shell_mt" rel="Chapter" href="Shell_mt.html">
<link title="Shell_intro" rel="Chapter" href="Shell_intro.html">
<link title="Netsmtp" rel="Chapter" href="Netsmtp.html"><title>Ocamlnet 2 Reference Manual : Rpc_auth_dh</title>
</head>
<body>
<div class="navbar"><a href="Netpop.html">Previous</a>
<a href="index.html">Up</a>
<a href="Rpc_key_service.html">Next</a>
</div>
<center><h1>Module <a href="type_Rpc_auth_dh.html">Rpc_auth_dh</a></h1></center>
<br>
<pre><span class="keyword">module</span> Rpc_auth_dh: <code class="code">sig</code> <a href="Rpc_auth_dh.html">..</a> <code class="code">end</code></pre>Diffie-Hellman authentication (AUTH_DH alias AUTH_DES)
<p>
This module implements DH authentication, the simplest form of
Secure RPC. Despite its name, this form of authentication provides
only a medium level of security, see below.
<p>
To use AUTH_DH you need the public-key infrastructure for Secure
RPC. This requires that a special daemon, the so-called <code class="code">keyserv</code>,
runs on both the client's system and the server's system. The task
of <code class="code">keyserv</code> is to store public and private keys. We do not have
a <code class="code">keyserv</code> in Ocamlnet, so you must use the <code class="code">keyserv</code> your system
provides.
(Note that <code class="code">keyserv</code> is often distributed together with NIS+. However,
you can run <code class="code">keyserv</code> without needing to set up NIS+.)
<p>
In order to make a remote call, the keyserv <code class="code">daemon</code> of the client must
know the private key of the client user, and the public key of the
server user. The <code class="code">keyserv</code> daemon of the server must know the public
key of the client user and the private key of the server user.
Note that you can load a key pair into <code class="code">keyserv</code> with the command <code class="code">keylogin</code>.
(This is not necessary for the root user, root's key pair is loaded
at daemon startup time.)
<p>
See the manual pages of your OS
for <code class="code">keyserv</code>, <code class="code">keylogin</code>, <code class="code">keylogout</code>, and <code class="code">/etc/publickey</code>.
<p>
Furthermore, it is strictly necessary that time synchronization is
enabled between the client and the server. The recommended solution
is to synchronize both clocks independently using a time normal
(with NTP). Alternatively, the server can provide a time service on
port 37 ("netdate").
<p>
To identify users, AUTH_DH uses so-called netnames. These have the form
"<osflavor>.<user>@<domain>", where <osflavor> determines the kind of
operating system (usually "unix"), <user> is an identifier for the user,
and <domain> determines where the user identifiers are valid. In UNIX
environments, the netnames are formed like:<ul>
<li>For root users: "unix.<hostname>@<nisdomain>"</li>
<li>For non-privileged users: "unix.<uid>@<nisdomain>". Note that <uid>
is the numeric user ID.</li>
</ul>
The <code class="code">keyserv</code> daemon provides a service <code class="code">net_get</code> that returns the netname of
the calling user. AUTH_DH uses this service to determine the netname
of the current process, but this does not hide netnames from the user
of AUTH_DH:<ul>
<li>The client must know the netname of the server</li>
<li>The server must interpret the netname of the client and decide whether
the client user is authorized or not</li>
</ul>
How secure is AUTH_DH? As pointed out, the security is not the best.<ul>
<li>The chosen prime for DH is too short</li>
<li>It uses DES (56 bits) to encrypt the verifiers</li>
</ul>
The DES weakness can be reduced by changing the conversation key
frequently. This AUTH_DH implementation allows it to specify the maximum
lifetime of a DES key.
<p>
Note that it is hard to attack AUTH_DH without knowing the public key.
So it is best not to make it accessible for third parties.<br>
<hr width="100%">
<pre><span class="keyword">val</span> <a name="VALdomainname"></a>domainname : <code class="type">unit -> string</code></pre><div class="info">
Returns the NIS domain name. The name is determined by calling the
external command <code class="code">domainname</code>.
Note: This function refuses to work for setuid or setgid programs.<br>
</div>
<pre><span class="keyword">val</span> <a name="VALclient_auth_method"></a>client_auth_method : <code class="type">?ttl:int -><br> ?getdeviation:(Unix.inet_addr -> float) -><br> ?key_lifetime:int -><br> ?keyserv:<a href="Rpc_key_service.html#TYPEconnector">Rpc_key_service.connector</a> -> string -> <a href="Rpc_client.auth_method.html">Rpc_client.auth_method</a></code></pre><div class="info">
Creates a new authentication method using AUTH_DH. The passed string
is the netname of the called server.
<p>
Pass the resulting auth_method to <a href="Rpc_client.html#VALset_auth_methods"><code class="code">Rpc_client.set_auth_methods</code></a> to
configure AUTH_DH for an RPC client.
<p>
<br>
</div>
<div class="param_info"><code class="code">ttl</code> : The "time to live" for the network packets. Effectively, this
number is the maximum time deviation the server will tolerate. It
defaults to 60 seconds meaning that it is acceptable if the server
gets the network packet 60/2 seconds before or after the time the packet
is sent by the client.</div>
<div class="param_info"><code class="code">getdeviation</code> : This function is called when the time has to be
resynchronized. The argument is the internet address of the server,
and the expected result is the number of seconds the server is ahead
to the client.
By default, a function is used that connects to the netdate time
service of the server, and compares the time of the client and the
server.
If the clocks can be assumed to always be synchronous, it is safe to
pass <code class="code">fun _ -> 0.0</code> as deviation function.</div>
<div class="param_info"><code class="code">key_lifetime</code> : After this number of seconds the DES key (conversation
key) expires. Default: 3600</div>
<pre><span class="keyword">val</span> <a name="VALserver_auth_method"></a>server_auth_method : <code class="type">?max_sessions:int -><br> ?max_ttl:int -><br> ?key_lifetime:int -><br> ?attack_detector:bool -><br> ?keyserv:<a href="Rpc_key_service.html#TYPEconnector">Rpc_key_service.connector</a> -> unit -> <a href="Rpc_server.auth_method.html">Rpc_server.auth_method</a></code></pre><div class="info">
Pass the result of this function to <a href="Rpc_server.html#VALset_auth_methods"><code class="code">Rpc_server.set_auth_methods</code></a> to
configure AUTH_DH for an RPC server.
<p>
Note that the current implementation of AUTH_DH blocks until the
<code class="code">keyserv</code> responds. For most applications, this is not a big problem,
as <code class="code">keyserv</code> lookups are seldom. Perhaps I will rewrite the code some
day such that <code class="code">keyserv</code> lookups are done in an asynchronous way. (The
<a href="Rpc_server.auth_method.html"><code class="code">Rpc_server.auth_method</code></a> interface allows it already.)
<p>
<br>
</div>
<div class="param_info"><code class="code">max_sessions</code> : The maximum number of authenticated connections the
server can manage. If more clients connect, the lifetime of the
conversation keys will decrease, but the server will still be
functional.</div>
<div class="param_info"><code class="code">max_ttl</code> : The maximum number for the ttl value. The ttl value is
passed by the client, but if it is bigger than <code class="code">max_ttl</code>, the maximum
is used instead.</div>
<div class="param_info"><code class="code">key_lifetime</code> : After this number of seconds the conversation key expires
and must be renewed.</div>
<div class="param_info"><code class="code">attack_detector</code> : Whether an attack detector is to be installed. It
detects if there are many failed connection attempts for a certain
user (more than 10 failures in 10 seconds). If this criterion matches
no more logins are allowed for this user in the current 10 seconds
period.
The detector contains a heuristics that makes it unlikely that
a TCP connection breaks when just a key must be renewed and the server
is currently being attacked.</div>
<div class="param_info"><code class="code">keyserv</code> : The <code class="code">keyserv</code> daemon to use. Defaults to the same default as
<a href="Rpc_key_service.html#VALcreate"><code class="code">Rpc_key_service.create</code></a>.</div>
</body></html>
distrib
>
Mandriva
>
2008.1
>
x86_64
>
media
>
contrib-release
>
by-pkgid
>
535a7a10fe62254ee9ca7e6375f081a9
>
files
>
419
