MIT-Mostly (tute.mit.edu) web service

Bruce Lewis DRAFT: June 20, 1997

Contents

1 Functional Overview 2 2 Server Characteristics 2

2.1 Compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 2.2 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 2.3 CPU and Network Loading . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

3 Requirements and Dependencies 2 4 Dependents 2 5 Impacts of Service Failures 2 6 Building 2 7 Installation 3 8 Relocation 3 9 Maintenance and Everything Else 3

1 Functional Overview

There is an HTTP server (http://tute.mit.edu/) that mostly allows connections from MIT hosts, rejecting requests from hosts with names that do not resolve to the ending ”mit.edu”. This server will be able to access files stored in protected directories in the athena.mit.edu AFS cell, not using AFS tokens, but by an AFS group called mitweb that includes the IP address of tute.mit.edu.

2 Server Characteristics

2.1 Compatibility

Because AFS documents are restricted by the server’s IP address, this service cannot coexist with unrestricted web service on the same host.

2.2 Security

The information to be protected is not expected to have bulletproof security. Users of this service

are given caveats at <URL:http://web.mit.edu/cwis/tute/mitmostly2.html>.

2.3 CPU and Network Loading

This server gets fewer hits than the unrestricted server, but each client is more costly because the client’s hostname is looked up.

3 Requirements and Dependencies

This service has all the requirements of web.mit.edu service. In addition, the server’s IP address must be part of the AFS group named mitweb. Type pts mem mitweb

4 Dependents

Dependents may be determined through the advanced search page on the unrestricted web server. Search for url-references containing “tute”.

5 Impacts of Service Failures

Users will not be able to reach MIT-mostly pages.

6 Building

The build process is exactly the same as that of the unrestricted web service.

7 Installation

1. The server’s IP address must be part of the AFS group named mitweb. Type pts mem

     mitweb

2. Follow the installation procedure for unrestricted web service.

3. Remove the HostName and DNSLookups lines from the httpd.conf file.

4. Add the following lines to the httpd.conf file:

HostName        tute.mit.edu
### protection
#
#       Allow only connections from ".mit.edu" hosts.
#       This is suboptimal, because
#         1) it may not cover everything we want, and
#         2) anyone who controls a portion of the reverse-name-resolution
#            space can claim their primary name to be at ".mit.edu".
#       However, it's probably good enough for now.
#
Protection mit-only {
        ServerId        YourProxyName
        Mask            @*.mit.edu
}
Protect * mit-only

8 Relocation

No state information is kept. To migrate, simply follow the installation process on the new server.

9 Maintenance and Everything Else

Same as for unrestricted web service.