Internetworkers: http://www.ibiblio.org/internetworkers/

["Stella L." <thumb_nails AT yahoo.com>]

Roger
Actually, this is not a highly secure doc. and thanks
to all the awesome people on this list, i found out
that i need BASIC auth. method (I am running an NT 4).

It has been a great learning experience!
Cheers,
Stella
--- "Austin, Roger" <rda AT rti.org> wrote:
>  Could you restate the question with more
> information? There are a lot
> of "ifs and buts" in the question. It isn't hard to
> limit access, but it
> is a maintenance chore to deal with the stuff
> involved in a secure site.
> SSL is a requirement for most any "real" secure
> site, but you may not be
> asking for that kind of system.
>  Is it an intranet or open to the internet? Is it a
> mixed environment
> (Windows and Macs) or one platform? How secure do
> you want to make it? I
> have found at times that all that was needed was to
> unlink the URL from
> a page and make the "authorized people" bookmark a
> URL. This just means
> that the general population can't see a live link,
> but people could get
> to the page if they guessed the complete URL. This
> is for very low risk
> sites only, for sites which you want authorized
> people to see, but the
> Earth wouldn't stop turning if someone else saw it.
> (e.g., local
> non-profit board activities, personal bookmarks,
> etc.)
>  Steve is correct with NTLM and IE/Mac, it is
> problematic (much hair
> loss with IE4.5/Mac on a project ...) I haven't had
> the stomach to get
> back to test IE5/Mac yet for NTLM support.
>  Roger (in RTP)
> 
> 
> Steven Champeon wrote:
> > 
> > on Mon, May 07, 2001 at 01:08:11PM -0400, Paula
> Paul wrote:
> > > > Or, if you want to use what the rest of the
> Internet has used
> > > > since IIS
> > > > was just a memory leak in Microsoft's eye, you
> could enable Basic auth
> > > > in IIS. Here's a rundown of all the different
> authentication methods
> > > > supported by IIS:
> > >
> > > If you do choose to go with Basic Authentication
> (one of the
> > > authentication methods you can enable on the tab
> used to disable
> > > annonymous access, as described in my earlier
> post), you may want to use
> > > it in conjunction with SSL.  Basic
> Authentication means that the userid
> > > and password will be sent as clear text (thus
> it's better to require
> > > secure HTTP).
> > 
> > Technically, the user/pass combination is sent as
> a Base64-encoded string,
> > not clear text, though Base64 isn't encryption
> (more like a fancy ROT-13)
> > so your advice with respect to SSL is correct, if
> what you're protecting
> > is really worth the hassle.
> > 
> > > Since Basic Authentication ties the
> authentication to a
> > > domain account and password, you may want the
> password encrypted.
> > > If you choose windows integrated authentication,
> the password will also
> > > be tied to a domain account, but it will not be
> sent in clear text.
> > 
> > It will also not be usable in any browser that
> doesn't support NTLM
> > authentication, namely, everything but Internet
> Explorer. I'm not sure
> > if IE5/Mac even supports NTLM. I seem to recall
> problems with IE4.5,
> > at any rate.
> > 
> > In summary, Basic auth is fine for most purposes,
> and can be
> > supplemented by SSL. If you don't want to encrypt
> the entire session,
> > and your audience uses browsers that understand
> Microsoft-proprietary
> > authentication, and you want to bother setting up
> user accounts for
> > all of your Web visitors, and you don't want to
> bother setting up a
> > proprietary database to manage user accounts, you
> can use NTLM.
> 
> ---
> Come and play at the InterNetWorkers Web site! 
> http://www.ibiblio.org/internetworkers/
> You are currently subscribed to internetworkers as:
> thumb_nails AT yahoo.com
> To unsubscribe send a blank email to
$subst('Email.Unsub')


__________________________________________________
Do You Yahoo!?
Yahoo! Auctions - buy the things you want at great prices
http://auctions.yahoo.com/