Maintaining HTTP service security

Protecting Web pages

About Web page protection

You can restrict HTTP access, and thereby protect Web pages, by preventing unauthorized users from accessing Web pages. In this way, only specified users or groups can access directories containing the Web pages.

Data ONTAP provides the following two methods of authentication for HTTP access:

Basic
NTLM

You specify the method of authentication to use in the /etc/httpd.access file. Both authentication methods can coexist on a filer, but you can specify only one authentication method per directory in the HTTP subtree.

Basic authentication

You use the following three configuration files to set up the basic authentication for the HTTP service:

/etc/httpd.access
/etc/httpd.passwd
/etc/httpd.group

The /etc/httpd.access file contains the method of authentication, the directories for which you want to restrict access, and the list of users and groups authorized to access these directories.

The /etc/httpd.passwd file contains the encrypted form of the password that a user, specified in the /etc/httpd.access file, uses to gain access to the directories specified in the /etc/httpd.access file. The /etc/httpd.passwd file uses the same format that the /etc/passwd file uses.

The /etc/httpd.group file contains group names and user IDs of the members of each group who are authorized to access the directories specified in the /etc/httpd.access file. The /etc/httpd.group file uses the same format that the /etc/group file uses.

NTLM authentication

You can use Windows Domain Authentication instead of basic authentication for a directory. Data ONTAP uses the Domain Controller (DC) to authenticate users accessing the directories containing the Web pages.

You must specify the directories in the /etc/httpd.access file for which you want the DC to authenticate users.

A user accessing a directory for which NTLM authentication has been set up must specify a domain with the user name. If a domain is not specified, the domain of the filer is assumed as a default. The users can specify the domain in either of the following formats:

user_name@domain_name
domain_name\user_name

Requirement for using NTLM authentication

You must have CIFS running on your filer to use the NTLM authentication for HTTP access.

Advantages of using NTLM authentication

First, if you use Internet Explorer^TM (IE) as your browser, NTLM authentication is a more secure method of authenticating users because user name and password are not sent in clear text over the wire. However, for the Netscape^TM browser, user name and password are sent from the browser to the filer in clear text, providing no additional security.

Second, you do not need to maintain information in the /etc/http.passwd and /etc/http.group files, thus centralizing user administration.