Mailing List Archive

A generic way to do this would be to allow a routine/program
to be configured to handle authentication.

Pass it arguments of "name" and "password". If it returns 1 then authentication
was succesful, 0 means it failed.
One could then have any authentication system imaginable, and even have
different systems for different regions of the server based on
config/.htaccess information.

This is my first trip into authentication territory, so be gentle if
any of this already exists etc :-)

rob

> From: Rob Hartill <hartill@ooo.lanl.gov>
> Date: Mon, 10 Jul 95 14:59:36 MDT
>
> Is it possible to have authentication based on a simple algorithm ?
>
> In Shambhala, you can write a module which does it however you like.
> (DBM auth is a separate module, for instance, and the rest of the
> server knows nothing about it). However, I'm not sure what security
> the scheme outlined below would offer over simply setting up a group
> account with the standard mechanisms...

AFAIK, existing authentication requires a database of name/passwords.
We don't want to maintain such a database, no matter how simple it is.
We just need a password checker which uses a name->password algorithm.

> If that's no clear, here's an example...
> password = name + 1 (e.g. abcdef -> bcdefg)
>
> So, anyone who knows this rule can get in using any username?

The rule will not be publicised.
We're not trying to make a secure system here, just keep impatient
physicists from polling our site looking for any kind of early info about
papers from their rivals... Our URLs contain a number which increases
for each new paper, so people just keep adding 1 and hitting our server in
the hope that they can find a rival's paper half a day before it is
announced.

We want to be able to let authors test their submissions via the web
(and fix things accordingly) whilst locking out all the impatient spies.

Only the author will be told name/password to use. The algorithm we use
will be simple but "impossible" to crack... nobody will see enough examples
to find a pattern. If it gets cracked, we modify it. Anyone smart
enough to crack the algorithm won't need to spy on their rivals :-)

rob

Also, the cgi-scripts we use will check that the username matches
the paper number - so knowing another name/password pair won't be a
loophole others could use.

rob

From: Rob Hartill <hartill@ooo.lanl.gov>
Date: Mon, 10 Jul 95 14:59:36 MDT

Is it possible to have authentication based on a simple algorithm ?

In Shambhala, you can write a module which does it however you like.
(DBM auth is a separate module, for instance, and the rest of the
server knows nothing about it). However, I'm not sure what security
the scheme outlined below would offer over simply setting up a group
account with the standard mechanisms...

If that's no clear, here's an example...
password = name + 1 (e.g. abcdef -> bcdefg)

So, anyone who knows this rule can get in using any username?

rst

From: Rob Hartill <hartill@ooo.lanl.gov>
Date: Mon, 10 Jul 95 15:14:28 MDT

A generic way to do this would be to allow a routine/program
to be configured to handle authentication.

Call it a "module", and Shambhala has it now... unfortunately, the
interface is a little clunkier right now than it absolutely has to be
(and isn't really written up in the API doc yet).

Pass it arguments of "name" and "password". If it returns 1 then authentication
was succesful, 0 means it failed.
One could then have any authentication system imaginable, and even have
different systems for different regions of the server based on
config/.htaccess information.

This is my first trip into authentication territory, so be gentle if
any of this already exists etc :-)

rob