----- Forwarded message from Kris Wehner <[EMAIL PROTECTED]> -----
We're starting to host customer web services on an afs-based server, and
are running into some basic stumbling blocks, and we're wondering if anyone
else has come up with a smooth solution to them. Basically, right now,
we've got an ip-based ACL for the web server, and as people need to write
data, we acl their site such that the server can write in the directory
where their data is. We're looking to migrate several hundred more sites
onto this setup, and doing this is going to become impractical once we
start to scale it. The only other solution we saw immediately was giving
the server a token with reauth, but this has the same hazards (sortof like
the problem with nobody owned files on ufs). All thoughts and comments
would be appreciated.
----- End forwarded message -----
We've been running an AFS-based web server for some time.
>From the beginning, we authenticated the server with an AFS token
for a special user (www) which has read access to the web pages.
Users in general do not have access to the web trees --- actually
we have an Apache server doing virtual serving of a dozen virtual
sites. The job that starts the web server gets a token before
starting apache, and the token is renewed by a cgi-bin binary
called regularly by a cron job on another machine, so there's
no need to make any changes to the server itself.
Because the pages are in AFS, the actual server machine(s) have
extremely strict controls, with no telnet or r-commands allowed.
The parts of the web tree to which a user has access are mounted
in the user's own home directory for convenience.
-- Owen
[EMAIL PROTECTED]
