|
|
Managing Access to Web Content |
One of the responsibilities of web master is determing who has read and/or write access to the departmental web content. This can generally be split into two distinct categories,a controlling who can put up or edit web content, and who can access web content.
The departmental web pages reside on an AFS fileserver, and have available the robust access control of AFS Access Control Lists (ACLs). These ACLs can be used quite effectively to control who has the ability to create, delete, or modify web content.
The nature of the web, however, is such that most content is expected to
be viewable by anyone through the web server. However, there are times
when access to content should be more restricted. ACLs are basically useless
for this purpose, as the web server must have access through the ACLs to
see the page if it is to be presented to anyone over the web, and the AFS
filesystem does not know for whom the web server wants the page. Any access
control of pages presented as web pages requires use of access control
mechanisms inside the web server. These, too, can be configured on a per
directory basis through .htaccess files.
phys:phys-www group), can grant or deny
access to certain groups of users using the fs command.
AFS ACLs act on directories, and all files/web pages within the directory get the same access rights.
fs listacl
command. To use it, just type
fs listacl directory_name
where directory_name is the name of a file or directory. (Note:
AFS ACLs apply to directories only, so if you give a non-directory file name,
the ACLs listed are for the containing directory.) You can abbreviate
listacl to la if desired.
If you have permissions to read the access rights on the directory, the command will list a bunch of Normal rights. Each line will consist of an user or group name (group names contain a colon), followed by a list of letters which give the access rights. The letter codes are:
fs listacl command, any user or group that doesn't show up has
no access.
ls command, but really nothing else. Useful, however, if you want to give them greater
access to some directory below this one (otherwise, they probably cannot see
the directory you wanted to give them rights to).ACLs are additive, so if group phys:a has rl
rights, and group phys:b has wk rights, an user who
is a member of both groups gets rlwk rights.
The other requirement to figuring out what the access on a directory is is figuring out what the groups are. The group names try to be descriptive of the group, but this is not completely possible. Groups starting with the name system are special groups, which generally should not be touched.
All other groups should start with phys:, usually followed
by phys-. You can often see who is in a particular group by
using the pts members command, as in
pts members group_name
where group_name is the name of a group, e.g. phys:phys-www.
Some common groups are:
fs setacl command, as follows:
fs setacl -dir directory -acl group ACLstring
Note that the above command only changes the ACLs on a single directory;
in particular, it will not change the access on subdirectories of that
directory. For newly created directories, this is not generally a problem,
as they will inherit their initial ACL from their parent directory (until
someone manually changes it). For existing directories, you can use the
setacl_tree command. This is run as:
setacl_tree directory group ACLstring
where directory, group, and ACLstring are
the same as above. However, any subdirectories beneath directory
will also get their ACLs changed.
A strong feature of AFS is that anyone can create groups and manage the membership of groups they created. Thus, it really shouldn't be necessary to use usernames instead of groups in ACLs.
To create a new group for web access, anyone in the webmaster's groups
can issue the command:
pts creategroup -name phys:name -owner phys:phys-www
where phys:name is the name of the new group. E.g, to create
a group called phys:webpeople, you would issue the command
pts creategroup -name phys:webpeople -owner phys:phys-www
Note that all groups for web page access shold be owned by phys:phys-www,
and all groups owned by phys:phys-www must start with phys:.
Once a group is created, the owners of the group (for web access groups
these are the webmasters) can list who is in the group, add people to the
group, remove people from the group, or delete the entire group
with the commands:
pts members group
respectively. group is the name of the group (include the leading
phys:), and username is the login name of the user to
add or remove.
pts adduser -user username -group group
pts removeuser -user username -group group
pts delete group
To list all the web access groups that have been created, just issue
the command:
pts listowned phys:phys-www
After creating a group, you need to use the fs setacl or
the setacl_tree to grant members of that group rights to
certain directories, as described above.
 |
Physics Home |
PNCE Info |
UNIX Info |
PC Info |
System Info |
POWL Firstaider |
E-Mail
This page is maintained by the Physics Web Managers: |