DOCSLIB.ORG

Pontificia Universidad Católica Del Ecuador

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Pontificia Universidad Católica Del Ecuador PONTIFICIA UNIVERSIDAD CATÓLICA DEL ECUADOR FACULTAD DE INGENIERÍA MAESTRÍA EN REDES DE COMUNICACIÓN PERFIL DEL TRABAJO PREVIO LA OBTENCIÓN DEL TÍTULO DE: MÁGISTER EN REDES DE COMUNICACIÓN TEMA: ESTUDIO DE LAS CARACTERÍSTICAS DE SEGURIDAD DE SERVIDORES WEB EN ENTORNOS DE SOFTWARE LIBRE APLICABLES A LA PROTECCIÓN DE SITIOS DINÁMICOS ERNESTO PÉREZ ESTÉVEZ Quito – 2014 Agradecimientos A Linus Torvalds, por haberme ayudado a encontrar un sentido a mi profesión. A Paul Bernal por aclarar miles de dudas y tener paciencia A la mamisa y a los mapases! A mis padres A todos los que me han apoyado, y también a la que no. Tabla de contenidos Capítulo 1 :Introducción......................................................................................................................1 1.1 Antecedentes.............................................................................................................................2 1.2 Justificación..............................................................................................................................3 1.3 Objetivo General.......................................................................................................................5 1.4 Objetivos Específicos...............................................................................................................5 1.5 Alcance......................................................................................................................................6 Capítulo 2 :Marco teórico....................................................................................................................7 2.1 Sitios estáticos y dinámicos......................................................................................................7 2.2 Ataques a sitios dinámicos........................................................................................................9 2.3 Tipos de ataques a sitios dinámicos........................................................................................14 2.4 Descripción de los riesgos presentados..................................................................................14 2.4.1 Fallas de Inyección..........................................................................................................14 2.4.2 Fallas en el manejo de sesión y autenticación.................................................................15 2.4.3 Cross-Site Scripting........................................................................................................16 2.4.4 Referencias inseguras directas a objetos.........................................................................17 2.4.5 Fallas en la configuración...............................................................................................18 2.4.6 Exposición de datos sensitivos........................................................................................18 2.4.7 Falta de control de acceso a funciones............................................................................19 2.4.8 Cross-site Request Forgery.............................................................................................19 2.4.9 Uso de componentes con fallas conocidas......................................................................20 2.4.10 Redirecciones no validadas...........................................................................................20 2.5 Otras técnicas utilizadas..........................................................................................................20 2.5.1 Ejecución de archivos maliciosos...................................................................................21 2.5.2 Filtrado de información y manejo impropio de errores..................................................21 2.6 Análisis de la información obtenida........................................................................................21 2.7 Aprovechamiento de las vulnerabilidades..............................................................................23 2.7.1 Falencias durante la operación por parte del usuario......................................................23 2.7.2 Fallas en el navegador.....................................................................................................23 2.7.3 Falencias en la educación del usuario para el uso de las herramientas...........................23 2.7.4 Falencias en la administración del servidor....................................................................24 2.7.5 Inadecuado manejo de credenciales de acceso al servidor..............................................24 2.7.6 Inadecuado manejo de credenciales de acceso a sistemas de apoyo...............................24 2.7.7 Uso de aplicaciones configuradas por defecto................................................................25 2.7.8 Servidor desactualizado..................................................................................................25 2.8 Falencias en el servidor web...................................................................................................25 2.8.1 Fallas en la programación del servidor o sus componentes............................................25 2.8.2 Configuración inapropiada..............................................................................................26 2.8.3 Fallas de desempeño.......................................................................................................26 2.9 Falencias en la programación de la aplicación.......................................................................26 2.9.1 Código no seguro o no auditado.....................................................................................26 2.9.2 Utilización de código desactualizado..............................................................................26 2.10 Efectos de los ataques a aplicaciones dinámicas..................................................................27 2.10.1 Negación de servicio.....................................................................................................27 2.10.2 Desfiguración................................................................................................................27 2.10.3 Accesos no autorizados.................................................................................................27 2.10.4 Robo de información.....................................................................................................28 Capítulo 3 :Estado del arte de la reacción ante ataques a servidores web.........................................29 3.1 Protecciones a nivel de usuario...............................................................................................29 3.1.1 Navegadores con características de seguridad................................................................29 3.1.2 Plugins de seguridad en navegadores..............................................................................30 3.1.3 Sistemas de detección de amenazas................................................................................30 3.2 Protecciones en la programación............................................................................................31 3.3 Protecciones en el Sistema Operativo.....................................................................................31 3.3.1 Tiempo de soporte...........................................................................................................32 3.3.2 Instalaciones mínimas.....................................................................................................32 3.4 Adecuado particionamiento del disco.....................................................................................33 3.4.2 Eliminando servicios innecesarios..................................................................................36 3.4.3 Actualizaciones...............................................................................................................36 3.4.4 Fortalecimiento al núcleo del sistema.............................................................................38 3.4.5 Aseguramiento de SSH...................................................................................................38 3.4.6 Uso de claves fuertes o sistemas de autenticación no tradicionales................................40 3.5 Protecciones en el servidor web..............................................................................................41 3.5.1 Manejo de Banners..........................................................................................................41 3.5.2 Eliminación de características innecesarias....................................................................42 3.5.3 Restricción de acceso a directorios basados en usuario/clave........................................42 3.5.4 Protecciones contra ataques de negación de servicio......................................................43 3.5.5 Bloqueos ante actividad inusual......................................................................................43 3.5.6 Bloqueos por tipo de navegador......................................................................................43 3.5.7 Sistemas de detección de vulnerabilidades.....................................................................44 3.5.8 Uso de sistemas de monitoreo de cambios......................................................................45 3.5.9 Uso de sistemas de alerta................................................................................................46
Load more

Recommended publications
  • Next Generation Web Scanning Presentation
    Next generation web scanning New Zealand: A case study First presented at KIWICON III 2009 By Andrew Horton aka urbanadventurer NZ Web Recon Goal: To scan all of New Zealand's web-space to see what's there. Requirements: – Targets – Scanning – Analysis Sounds easy, right? urbanadventurer (Andrew Horton) www.morningstarsecurity.com Targets urbanadventurer (Andrew Horton) www.morningstarsecurity.com Targets What does 'NZ web-space' mean? It could mean: •Geographically within NZ regardless of the TLD •The .nz TLD hosted anywhere •All of the above For this scan it means, IPs geographically within NZ urbanadventurer (Andrew Horton) www.morningstarsecurity.com Finding Targets We need creative methods to find targets urbanadventurer (Andrew Horton) www.morningstarsecurity.com DNS Zone Transfer urbanadventurer (Andrew Horton) www.morningstarsecurity.com Find IP addresses on IRC and by resolving lots of NZ websites 58.*.*.* 60.*.*.* 65.*.*.* 91.*.*.* 110.*.*.* 111.*.*.* 113.*.*.* 114.*.*.* 115.*.*.* 116.*.*.* 117.*.*.* 118.*.*.* 119.*.*.* 120.*.*.* 121.*.*.* 122.*.*.* 123.*.*.* 124.*.*.* 125.*.*.* 130.*.*.* 131.*.*.* 132.*.*.* 138.*.*.* 139.*.*.* 143.*.*.* 144.*.*.* 146.*.*.* 150.*.*.* 153.*.*.* 156.*.*.* 161.*.*.* 162.*.*.* 163.*.*.* 165.*.*.* 166.*.*.* 167.*.*.* 192.*.*.* 198.*.*.* 202.*.*.* 203.*.*.* 210.*.*.* 218.*.*.* 219.*.*.* 222.*.*.* 729,580,500 IPs. More than we want to try. urbanadventurer (Andrew Horton) www.morningstarsecurity.com IP address blocks in the IANA IPv4 Address Space Registry Prefix Designation Date Whois Status [1] -----
    [Show full text]
  • Environmental Protection Commission[567]
    IAC 5/19/21 Environmental Protection[567] Analysis, p.1 ENVIRONMENTAL PROTECTION COMMISSION[567] Former Water, Air and Waste Management[900], renamed by 1986 Iowa Acts, chapter 1245, Environmental Protection Commission under the “umbrella” of the Department of Natural Resources. TITLE I GENERAL CHAPTER 1 OPERATION OF ENVIRONMENTAL PROTECTION COMMISSION 1.1(17A,455A) Scope 1.2(17A,455A) Time of meetings 1.3(17A,455A) Place of meetings 1.4(17A,455A) Notification of meetings 1.5(17A,455A) Attendance and participation by the public 1.6(17A,455A) Quorum and voting requirements 1.7(17A,455A) Conduct of meeting 1.8(17A,455A) Minutes, transcripts, and recordings of meetings 1.9(17A,455A) Officers and duties 1.10(17A,455A) Election and succession of officers 1.11(68B) Sales of goods and services CHAPTER 2 PUBLIC RECORDS AND FAIR INFORMATION PRACTICES (Uniform Rules) 2.1(17A,22) Adoption by reference CHAPTER 3 SUBMISSION OF INFORMATION AND COMPLAINTS—INVESTIGATIONS 3.1(17A,455B) Adoption by reference CHAPTER 4 AGENCY PROCEDURE FOR RULE MAKING 4.1(17A) Adoption by reference CHAPTER 5 PETITIONS FOR RULE MAKING 5.1(17A) Adoption by reference CHAPTER 6 DECLARATORY ORDERS 6.1(17A) Adoption by reference CHAPTER 7 RULES OF PRACTICE IN CONTESTED CASES 7.1(17A) Adoption by reference CHAPTER 8 CONTRACTS FOR PUBLIC IMPROVEMENTS AND PROFESSIONAL SERVICES 8.1(17A) Adoption by reference CHAPTER 9 DELEGATION OF CONSTRUCTION PERMITTING AUTHORITY 9.1(455B) Scope 9.2(455B,17A) Forms 9.3(455B) Procedures 9.4(455B) Criteria for permitting authority at local public
    [Show full text]
  • Comparison of Web Server Software from Wikipedia, the Free Encyclopedia
    Create account Log in Article Talk Read Edit ViewM ohrisetory Search Comparison of web server software From Wikipedia, the free encyclopedia Main page This article is a comparison of web server software. Contents Featured content Contents [hide] Current events 1 Overview Random article 2 Features Donate to Wikipedia 3 Operating system support Wikimedia Shop 4 See also Interaction 5 References Help 6 External links About Wikipedia Community portal Recent changes Overview [edit] Contact page Tools Server Developed by Software license Last stable version Latest release date What links here AOLserver NaviSoft Mozilla 4.5.2 2012-09-19 Related changes Apache HTTP Server Apache Software Foundation Apache 2.4.10 2014-07-21 Upload file Special pages Apache Tomcat Apache Software Foundation Apache 7.0.53 2014-03-30 Permanent link Boa Paul Phillips GPL 0.94.13 2002-07-30 Page information Caudium The Caudium Group GPL 1.4.18 2012-02-24 Wikidata item Cite this page Cherokee HTTP Server Álvaro López Ortega GPL 1.2.103 2013-04-21 Hiawatha HTTP Server Hugo Leisink GPLv2 9.6 2014-06-01 Print/export Create a book HFS Rejetto GPL 2.2f 2009-02-17 Download as PDF IBM HTTP Server IBM Non-free proprietary 8.5.5 2013-06-14 Printable version Internet Information Services Microsoft Non-free proprietary 8.5 2013-09-09 Languages Jetty Eclipse Foundation Apache 9.1.4 2014-04-01 Čeština Jexus Bing Liu Non-free proprietary 5.5.2 2014-04-27 Galego Nederlands lighttpd Jan Kneschke (Incremental) BSD variant 1.4.35 2014-03-12 Português LiteSpeed Web Server LiteSpeed Technologies Non-free proprietary 4.2.3 2013-05-22 Русский Mongoose Cesanta Software GPLv2 / commercial 5.5 2014-10-28 中文 Edit links Monkey HTTP Server Monkey Software LGPLv2 1.5.1 2014-06-10 NaviServer Various Mozilla 1.1 4.99.6 2014-06-29 NCSA HTTPd Robert McCool Non-free proprietary 1.5.2a 1996 Nginx NGINX, Inc.
    [Show full text]
  • Master Thesis
    MASTER THESIS TITLE: Analysis and evaluation of high performance web servers MASTER DEGREE: Master in Science in Telecommunication Engineering & Management AUTHOR: Albert Hidalgo Barea DIRECTOR: Rubén González Blanco SUPERVISOR: Roc Meseguer Pallarès DATE: July 13 th 2011 Title: Analysis and evaluation of high performance web servers Author: Albert Hidalgo Barea Director: Rubén González Blanco Supervisor: Roc Meseguer Pallarès Date: July 13 th 2011 Overview Web servers are a very important tool when providing users with requested content on the Internet. Usage of the Internet is growing day-by-day, making those software applications essential. In the first part of the thesis, the web server world will be introduced to the reader, by giving a brief explanation of some of the available technologies as well as different dynamic protocols. Also, as there are different web servers available in the market, during this report it will be chosen the best performing ones. So, it will be presented a comparative chart between all of them in order to show the most important features of each one. Defining the scenario and the test cases is mandatory. For this reason, it is described the used hardware and software used to perform those benchmarks. The hardware is maintained equal during the whole test process, in order to let web server’s performance gaps to their internal architecture. Operating system and benchmarking tools are also described and given some examples. Furthermore, test cases are chosen to show some strengths and weakness of each web server, enabling us to compare the relative performance between them. Finally, the last part of the report consists on presenting the obtained results during the benchmark process, as well as presenting some lessons learned during the curse of the whole thesis, summing-up with some conclusions.
    [Show full text]
  • Containers in the Enterprise Avoiding the Kobayashi Maru Agenda
    Containers in the Enterprise Avoiding the Kobayashi Maru Agenda • Containers Bring Change • An Approach • Required Software • Processes • Cultural Changes • Additional Concerns • Lessons Learned Why This Talk? • Containers are great • You’re here • How do we get it home? • Especially in large organizations Container Adoption is Crazy Fast • Containers are being adopted at a faster rate than public cloud • AWS turned 10 years old this year, with 57% of companies using it • Docker turned 3 years old this year, already has 27% penetration • Last year it had 13% • If the migration to cloud was hard for large organizations, how easy will the migration to containers be? • Approach varies based Change is Hard on group size • Old roles and rituals may no longer make sense • Messengers may get shot Group Size Affects Approach Small Groups / Startups Enterprise Roles People wearing multiple hats Specific roles established Change Appetite Open to change; easy to convince Many other changes happening; change fatigue Change Pace Easy to establish acceptable speed Likely acceptedspeed: glacial Communication Have a standup Exercise in herding cats Fear Low embarrassment if failure; change Fear of making mistakes can be very high or die Containers: Going from RaBBit Ears to CaBle • In traditional model, software choices typically restricted • Push to use similar platforms (and versions) across enterprise • Ease of operations: easy • “I know apache” • In container model, software choices are vastly increased • Developers can have programming language of
    [Show full text]
  • HOW to SETUP a FASTCGI LAMP STACK on CARAMBOLA Lighttpd PHP5 → Http.Lighttpd Is a Lightweight and Very flexible Web Server with Lots of Additional Modules Available
    HOW TO SETUP A FASTCGI LAMP STACK on CARAMBOLA Lighttpd PHP5 → http.lighttpd is a lightweight and very flexible web server with lots of additional modules available. (you don't need to do the next step with my firmware (http://dwaver.wordpress.com/2013/03/12/compile-firmware-flash-carambola-virtualbox-vm-firmware-image-usb- stick-support-download/) because it's all pre compiled opkg update opkg install lighttpd lighttpd-mod-cgi Symbol: PACKAGE_lighttpd-mod-cgi [=n] │ │ Prompt: lighttpd-mod-cgi.............................................. CGI module │ │ Defined at tmp/.config-package.in:29084 │ │ Depends on: PACKAGE_lighttpd [=n] │ │ Location: │ │ -> Network │ │ -> Web Servers/Proxies │ │ -> lighttpd........................... A flexible and lightweight web server (PACKAGE_lighttpd [=n]) │ │ Selects: PACKAGE_libc [=y] && PACKAGE_librt [=y] && PACKAGE_libpthread [=y] Edit vim /etc/lighttpd/lighttpd.conf # lighttpd configuration file # ## modules to load # all other module should only be loaded if really neccesary # - saves some time # - saves memory server.modules = ( <- also remove # here!!! "mod_rewrite", "mod_redirect", "mod_alias", "mod_auth", # "mod_status", # "mod_setenv", "mod_fastcgi", # "mod_proxy", # "mod_simple_vhost", # "mod_cgi", # "mod_ssi", # "mod_usertrack", # "mod_expire", # "mod_webdav" ) <- also remove # here!!! search for: fastcgi module #### fastcgi module ## read fastcgi.txt for more info fastcgi.server = ( ".php" => ( "localhost" => ( "socket" => "/tmp/php- fastcgi.socket", "bin-path" => "/usr/bin/php- cgi" ) ) ) search
    [Show full text]
  • The Buildroot User Manual I
    The Buildroot user manual i The Buildroot user manual The Buildroot user manual ii Contents I Getting started 1 1 About Buildroot 2 2 System requirements 3 2.1 Mandatory packages.................................................3 2.2 Optional packages...................................................4 3 Getting Buildroot 5 4 Buildroot quick start 6 5 Community resources 8 II User guide 9 6 Buildroot configuration 10 6.1 Cross-compilation toolchain............................................. 10 6.1.1 Internal toolchain backend.......................................... 11 6.1.2 External toolchain backend.......................................... 11 6.1.2.1 External toolchain wrapper.................................... 12 6.2 /dev management................................................... 13 6.3 init system....................................................... 13 7 Configuration of other components 15 8 General Buildroot usage 16 8.1 make tips....................................................... 16 8.2 Understanding when a full rebuild is necessary................................... 17 8.3 Understanding how to rebuild packages....................................... 18 8.4 Offline builds..................................................... 18 8.5 Building out-of-tree.................................................. 18 The Buildroot user manual iii 8.6 Environment variables................................................ 19 8.7 Dealing efficiently with filesystem images...................................... 19 8.8 Graphing the dependencies
    [Show full text]
  • Secure by Default-The Case Of
    Secure by default – the case of TLS Martin Stanek Department of Computer Science Comenius University [email protected] Abstract Default configuration of various software applications often neglects security objectives. We tested the default configuration of TLS in dozen web and application servers. The results show that “secure by default” principle should be adopted more broadly by developers and package maintain- ers. In addition, system administrators cannot rely blindly on default security options. Keywords: TLS, secure defaults, testing. 1 Introduction Security often depends on prudent configuration of software components used in a deployed system. All necessary security controls and options are there, but one have to turn them on or simply start using them. Unfortunately, the “If it ain’t broke, don’t fix it” philosophy or a lack of expertise wins sometimes. The technology is deployed in a default configuration or configuration that fulfills (mostly functional) requirements with as few changes as possible. Secure by default is a well known security principle, see e.g. [4]: Technology which is Secure by Default has the best security it can without you even knowing it’s there, or having to turn it on. We should aim to provide software packages with safe defaults and turning them to less secure config- uration should require a deliberate effort, see e.g. [5]: There are many ways to deliver an “out of the box” experience for users. However, by default, the experience should be secure, and it should be up to the user to reduce their security – if they are allowed. arXiv:1708.07569v1 [cs.CR] 24 Aug 2017 The Transport Layer Security (TLS) and its predecessor Secure Socket Layer (SSL) are widely used protocols for ensuring confidentiality and integrity of transported data, as well as one or two-sided authentication of communicating parties.
    [Show full text]
  • Tambahan Pertemuan 13 E Commerce
    Dwi Hartanto, S,.Kom 10/06/2012 Macam ‐ macam Web Server diantanya: 1. Apache HTTP Web Server Apache Web Server ‐ The HTTP Web Server Proyek Apache HTTP Server adalah upaya untuk mengembangkan 1. Apache Tomcat dan memelihara server HTTP open source untuk sistem operasi 2. Microsoft windows Server 2003 Internet Information Services (IIS) modern termasuk UNIX dan Windows NT. Tujuan dari proyek ini 3. Lighttpd adalah untuk menyediakan server yang aman, efisien dan dapat 4. Sun Java System Web Server diperluas yang menyediakan layanan HTTP disinkron dengan HTTP 5. Xitami Web Server standar saat ini. 6. Zeus Web Server Namun web yang terkenal dan yang sering digunakan adalah Apache dan Microsoft Internet Information Service (IIS). E Commerce Pertemuan 13 1 Dwi Hartanto, S,.Kom 10/06/2012 3. Abyss Web Server 2. Virgo Web Server Abyss Web Server memungkinkan Anda untuk meng-host situs web Anda pada Virgo Web Server dari EclipseRT adalah sepenuhnya aplikasi berbasis server komputer sendiri. Abyss Web Server mendukung koneksi keamanan SSL/TLS Java bbbierbasismoddlul yang dirancang untuk menjjlalank an aplikasi Java (HTTPS) sert a b erb agai t ek nol ogi web . Ab yss W eb S erver j uga d apat enterprise dan Spring‐powered aplikasi dengan tingkat fleksibilitas yang menjalankan aplikasi web PHP, Perl, Python, ASP, ASP.NET dan Ruby on Rails canggih yang dapat didukung oleh database seperti MySQL, SQLite, MS SQL tinggi dan kehandalan. Ia menawarkan platform sederhana namun Server, MS Access atau Oracle. komprehensif untuk mengembangkan, menyebarkan dan perusahaan jasa aplikasi Java. 4. Cherokee Web Server Cherokee adalah sebuah inovatif, kaya akan fitur dan mudah untuk mengkonfigurasi Web Server open source.
    [Show full text]
  • Dab-Rc3-Manifest.Pdf
    Printed by dl9pf Jul 24, 17 13:10 changes_chinook_3.0.0_dab_3.99.3.txt Page 1/64 added projects : meta−altera at revision 4364dbfcb600da82ecdfc4797f112d187e40f1c3 meta−boundary at revision d44ee8f58d841cf13fbe63dab271344e2b9ba6db meta−freescale at revision fa774ad7fb797957601a8c9fee45af453fea34b7 meta−freescale−3rdparty at revision 1879485e63ce369292c89b5902ff6df13509090b meta−freescale−distro at revision cd5c7a2539f40004f74126e9fdf08254fd9a6390 meta−renesas−rcar−gen3 at revision 4fa88fc2e452dd1ca5992cb605b3cd1823ee5316 meta−updater at revision 45c155a67d3532ad32342fc512e8bf6341ab9e5d removed projects : meta−amb at revision ef3495bb8d6543709f6d1f7b657cb894d32c1757 meta−fsl−arm at revision e2254e7b2ded0c2b66b1226f879b3a6d52037b2d meta−fsl−arm−extra at revision e95f4ae61fdaf6452d6dfa9cb59dbdf9cdf73c99 meta−rcar at revision e15ae276da312d71e016e2b30d2414b4c02ecbf8 changed projects : meta−agl changed from fb57dd647f577b5df40380c6f3996443bbe0cf8b to refs/tags/dab/3.99.3 [−] fb57dd6 Apply bluetooth/smack patches also to rpi kernel [−] 5dbfea7 dra7xx−evm: Fix issue with bluetooth pairing [−] fc9db17 Add entry for official pi touchscreen over DSI port [−] b674ca4 Ensure the codename is in OVERRIDES [−] 5c82102 meta−oic: Hotfix to support aarch64 for DragonBoard−410c [−] 0723edd linux−raspberrypi: add ENABLE_CMA options to kernel command line [−] 0a42053 50_local.conf.inc: Enable CMA within the raspberrypi3 template [−] 7b1d649 rpi−config: add configurable CMA low and high water marks [−] d81c329 Set defaultbranch to chinook in gitreview [+] 4307ed5
    [Show full text]
  • We4authors Factsheet
    We4Authors Factsheet Matrix of most spread CMS across European public sector websites. January 2019. Elaborated by: Martin Alvarez (CTIC) Revised by: Jose Usero (Funka) Table of contents Matrix of most spread CMS across European public sector websites. January 2019. ..... 1 Executive summary .......................................................................................................... 2 Introduction ..................................................................................................................... 2 Scope and obJective ..................................................................................................... 2 General obJectives and vision ...................................................................................... 2 Methodology of work ................................................................................................... 3 Matrix definition .............................................................................................................. 3 Websites analysed and identified CMSs ....................................................................... 3 CMS features analysed ................................................................................................. 5 Matrix of most spread CMS in the EU28 public sector ..................................................... 7 Conclusion ...................................................................................................................... 10 Disclaimer We4Authors is the acronym of “Pilot on WEb accessibility
    [Show full text]
  • BTP Stage - I 4Th Report
    BTP Stage - I 4th Report Sandeep Prasad 03D05011 s [email protected] March 18, 2013 Introduction Two main components of Clicker architecture are web-server and database-server. For our architecture we will assume Linux as the operating system. In this report we will inspect various features of web-servers. Mapping of features of web-server and requirements of Clicker will assist in narrowing down of list of web-servers appropriate for Clicker software. Requirements of Clicker Software In current architecture the requirements that are taken accounted for are 1. Multiple concurrent sessions: One login and corresponding logout from web server is considered as one session, session is between user and web server. 2. Multiple concurrent connections: One login and corresponding logout from database server is considered as one connection. Connection is between web server and database server. Features of Web-Server Mentioned below are some of the features that a web-server is supposed to provide 1. basic access authentication: A method for HTTP user agent to provide a username and password when making a request 2. digest access authentication: applying function to password before sending it over the network, unlike basic access authentication which sends plain text 3. mode: Web-server can be either kernel-mode or user mode. 1 Kernel-mode Kernel mode web-server is implemented into OS kernel, servers like TUX on GNU/Linux or Microsoft IIS on windows are example of kernel-mode server. Ker- nel mode server can use all the hardware resources it needs such as non-paged memory, CPU time-slices, network adapters, buffer, etc directly, thus they usually work faster.
    [Show full text]