DOCSLIB.ORG

IMG> Ou Autre Tel Que Présenté Au Fragment 6.1

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
IMG> Ou Autre Tel Que Présenté Au Fragment 6.1 Abstraction de l'autorisation/authentification du code applicatif d'un système web par Jean-Luc Cyr Mémoire présenté à l’Université du Québec à Chicoutimi en vue de l’obtention du grade de Maître ès sciences appliquées (M.Sc.A.) Québec, Canada © Jean-Luc Cyr, 2019 RÉSUMÉ L’implémentation de mesures de sécurité lors du développement d’une application Web comporte des lacunes. En effet, ces fonctions, lorsqu’elles existent, sont souvent développées à chaque nouveau projet avec une approche manquant de structure et de rigueur. Cela induit une forte probabilité d’erreurs. Le point de départ du présent travail a ainsi été de trouver une réponse à la question suivante : « Est-il possible d’extraire les mécanismes d’autorisation et d’authentification du code applicatif d’un système Web? ». Si oui, est-il possible de développer un composant gérant la sécurité qui serait réutilisable et dont le fonctionnement pourrait être validé par des experts dans le domaine ? La prépondérance de l’utilisation du serveur Apache pour livrer le contenu des applications Web sur le marché a orienté la mise en œuvre d’une solution à ce problème. Il a été établi que développer et rendre disponible un module complémentaire pouvant gérer l’authentification d’un utilisateur et ses autorisations pour accéder à différentes ressources applicatives était réalisable. Une documentation pertinente pour sa mise en place à l’intérieur d’un projet de développement applicatif a été rédigée. Dans un premier temps, comme présenté dans tous les gabarits de gestion de la sécurité informationnelle, il a fallu identifier et classifier les différentes ressources contenues dans les logiciels. Dans un second temps, il a fallu définir les utilisateurs qui interagissent avec ces ressources et les permissions associées aux relations entre les utilisateurs et les ressources. Plusieurs méthodologies sont proposées pour définir ces relations. Sur ces bases, un modèle a été défini et appliqué pour conserver l’identification des ressources, des utilisateurs et les relations entre les deux. Ces informations ont servi de base pour développer un module gérant l’accès aux systèmes et la protection des ressources. La gestion de ces informations a été documentée et déléguée aux concepteurs d’application ce qui permettra d’avoir un couplage fort entre l’application, son domaine et la gestion des accès. L’application du modèle, assurée par le module développé, doit être réalisée par des spécialistes en sécurité. TABLE DES MATIÈRES RÉSUMÉ ............................................................................................................................................. ii TABLE DES MATIÈRES .................................................................................................................... iii LISTE DES TABLEAUX .................................................................................................................... vii LISTE DES FIGURES ....................................................................................................................... viii LISTE DES FRAGMENTS DE CODES SOURCES .......................................................................... ix LISTE DES ACRONYMES ET SIGLES .............................................................................................. x REMERCIEMENTS .......................................................................................................................... xiii AVANT-PROPOS ............................................................................................................................ xiv Introduction ............................................................................................................... 1 1.1 Présentation de la problématique ..................................................................................... 2 1.1.1 Failles de sécurité dans les médias ............................................................................... 2 1.1.2 Applications Web .......................................................................................................... 3 1.1.3 Développement de produits ......................................................................................... 3 1.1.4 Systèmes utilisés ........................................................................................................... 4 1.1.5 Constatations de l’OWASP ............................................................................................ 4 1.1.6 Systèmes existants ........................................................................................................ 5 1.2 Objectifs du projet ............................................................................................................. 6 1.3 Méthodologie .................................................................................................................... 7 1.4 Échéancier ......................................................................................................................... 8 1.5 Contribution ...................................................................................................................... 8 État de l’art ................................................................................................................ 9 2.1 Systèmes utilisés sur le marché ....................................................................................... 10 2.1.1 Les serveurs HTTP ....................................................................................................... 10 2.1.2 Les langages de programmation ................................................................................. 12 2.1.3 Les gestionnaires de contenu ...................................................................................... 13 2.1.4 Les systèmes d’exploitation ........................................................................................ 15 2.2 Les standards en sécurité informatique .......................................................................... 15 2.3 Les systèmes Web ........................................................................................................... 17 2.3.1 Fonctionnement global ............................................................................................... 17 2.3.2 Le serveur Apache HTTP .............................................................................................. 19 2.3.3 Le protocole HTTP(S) ................................................................................................... 21 2.4 Gestion de l’authentification ........................................................................................... 24 2.4.1 Système d’exploitation Unix ....................................................................................... 25 2.4.2 Système d’exploitation Windows ................................................................................ 26 2.4.3 Applications natives .................................................................................................... 27 2.4.4 Applications mobiles ................................................................................................... 27 2.4.5 Applications Web ........................................................................................................ 27 2.5 La gestion des autorisations ............................................................................................ 28 2.5.1 Système d’exploitation Unix ....................................................................................... 29 2.5.2 Système d’exploitation Windows ................................................................................ 31 2.5.3 Applications natives .................................................................................................... 31 2.5.4 Applications mobiles ................................................................................................... 31 2.5.5 Applications Web ........................................................................................................ 32 Pistes de solution .................................................................................................... 37 3.1 Hypothèses ...................................................................................................................... 37 3.2 Véhicule pour l’implémentation ...................................................................................... 38 3.3 Possibilités d’authentification ......................................................................................... 38 3.3.1 Basées sur le système d’exploitation .......................................................................... 39 3.3.2 Basées sur les applications existantes ......................................................................... 39 3.3.3 Interactions client-serveur .......................................................................................... 39 3.4 Possibilités d’autorisation ............................................................................................... 40 3.4.1 Basées sur le système d’exploitation .......................................................................... 40 3.4.2 Basées sur les applications existantes ......................................................................... 41 3.4.3 Interactions client-serveur .......................................................................................... 41 3.5 Solution proposée ..........................................................................................................
Load more

Recommended publications
  • An Execution Model for Serverless Functions at the Edge
    An Execution Model for Serverless Functions at the Edge Adam Hall Umakishore Ramachandran Georgia Institute of Technology Georgia Institute of Technology Atlanta, Georgia Atlanta, Georgia ach@gatech:edu rama@gatech:edu ABSTRACT 1 INTRODUCTION Serverless computing platforms allow developers to host single- Enabling next generation technologies such as self-driving cars or purpose applications that automatically scale with demand. In con- smart cities via edge computing requires us to reconsider the way trast to traditional long-running applications on dedicated, virtu- we characterize and deploy the services supporting those technolo- alized, or container-based platforms, serverless applications are gies. Edge/fog environments consist of many micro data centers intended to be instantiated when called, execute a single function, spread throughout the edge of the network. This is in stark contrast and shut down when finished. State-of-the-art serverless platforms to the cloud, where we assume the notion of unlimited resources achieve these goals by creating a new container instance to host available in a few centralized data centers. These micro data center a function when it is called and destroying the container when it environments must support large numbers of Internet of Things completes. This design allows for cost and resource savings when (IoT) devices on limited hardware resources, processing the mas- hosting simple applications, such as those supporting IoT devices sive amounts of data those devices generate while providing quick at the edge of the network. However, the use of containers intro- decisions to inform their actions [44]. One solution to supporting duces some overhead which may be unsuitable for applications emerging technologies at the edge lies in serverless computing.
    [Show full text]
  • The Uch Enmek Example(Altai Republic,Siberia)
    Faculty of Environmental Sciences Institute for Cartography Master Thesis Concept and Implementation of a Contextualized Navigable 3D Landscape Model: The Uch Enmek Example(Altai Republic,Siberia). Mussab Mohamed Abuelhassan Abdalla Born on: 7th December 1983 in Khartoum Matriculation number: 4118733 Matriculation year: 2014 to achieve the academic degree Master of Science (M.Sc.) Supervisors Dr.Nikolas Prechtel Dr.Sander Münster Submitted on: 18th September 2017 Faculty of Environmental Sciences Institute for Cartography Task for the preparation of a Master Thesis Name: Mussab Mohamed Abuelhassan Abdalla Matriculation number: 4118733 Matriculation year: 2014 Title: Concept and Implementation of a Contextualized Navigable 3D Landscape Model: The Uch Enmek Example(Altai Republic,Siberia). Objectives of work Scope/Previous Results:Virtual Globes can attract and inform websites visitors on natural and cultural objects and sceneries.Geo-centered information transfer is suitable for majority of sites and artifacts. Virtual Globes have been tested with an involvement of TUD institutes: e.g. the GEPAM project (Weller,2013), and an archaeological excavation site in the Altai Mountains ("Uch enmek", c.f. Schmid 2012, Schubert 2014).Virtual Globes technology should be flexible in terms of the desired geo-data configuration. Research data should be controlled by the authors. Modes of linking geo-objects to different types of meta-information seems evenly important for a successful deployment. Motivation: For an archaeological conservation site ("Uch Enmek") effort has already been directed into data collection, model development and an initial web-based presentation.The present "Open Web Globe" technology is not developed any further, what calls for a migra- tion into a different web environment.
    [Show full text]
  • Performance Comparison of XHR Polling, Long Polling, Server Sent Events and Websockets
    Thesis no: urn:nbn:se:bth-14497 Performance comparison of XHR polling, Long polling, Server sent events and Websockets Rasmus Appelqvist Oliver Örnmyr Faculty of Computing Blekinge Institute of Technology SE-371 79 Karlskrona Sweden This thesis is submitted to the Faculty of Computing at Blekinge Institute of Technology in partial fulfillment of the requirements for the degree of Bachelor in Software Engineering. Contact Information: Author(s): Rasmus Appelqvist E-mail: [email protected] Oliver Örnmyr E-mail: [email protected] University advisor: Javier Gonzales Huerta PhD Department of Software Engineering Faculty of Computing Internet : www.bth.se Blekinge Institute of Technology Phone : +46 455 38 50 00 SE-371 79 Karlskrona, Sweden Fax : +46 455 38 50 57 i ABSTRACT Context. Many simultaneous clients that connects to a website where the client receives frequent updates from the server will put stress on the server. Selecting a performance efficient technology for sending updates to the client when building the web sites can allow for lesser server hardware requirements which can result in reduced server hardware costs. Knowledge about the difference between the technologies that can solve the problem of updating a client with information from the server is necessary to decide which technology to use to gain performance. Objectives. This study considers what performance factors that affect XHR polling, Long polling, Server sent events and Websockets to allow web application developers to decide on when to use which technology. This study will also try to find out if the performance difference between the compared technologies are noticeable and which one is the best from a performance perspective.
    [Show full text]
  • Release Information Manual Version 8.3.0
    Release Information Manual Version 8.3.0 Table of Contents Preface ...................................................................................................................... 1 About the TerraLens® Platform ...................................................................................... 1 In This Manual ........................................................................................................... 2 Intended Audience ..................................................................................................... 2 1 Product Components ................................................................................................ 3 2 Supported Platforms ................................................................................................ 4 Operating Systems, Compilers, and Programming Languages .................................................. 4 Graphics Hardware and Drivers ...................................................................................... 6 3 New Features ......................................................................................................... 7 TerraLens 8.3.0 ......................................................................................................... 7 DEM GeoTIFFs ......................................................................................................... 7 WMTS MapServer ..................................................................................................... 7 WMTS MapSource....................................................................................................
    [Show full text]
  • Uwsgi Documentation Release 2.0
    uWSGI Documentation Release 2.0 uWSGI Jun 17, 2020 Contents 1 Included components (updated to latest stable release)3 2 Quickstarts 5 3 Table of Contents 33 4 Tutorials 303 5 Articles 343 6 uWSGI Subsystems 375 7 Scaling with uWSGI 457 8 Securing uWSGI 485 9 Keeping an eye on your apps 503 10 Async and loop engines 511 11 Web Server support 525 12 Language support 541 13 Other plugins 629 14 Broken/deprecated features 633 15 Release Notes 643 16 Contact 741 17 Commercial support 743 18 Donate 745 19 Sponsors 747 20 Indices and tables 749 i Python Module Index 751 Index 753 ii uWSGI Documentation, Release 2.0 The uWSGI project aims at developing a full stack for building hosting services. Application servers (for various programming languages and protocols), proxies, process managers and monitors are all implemented using a common api and a common configuration style. Thanks to its pluggable architecture it can be extended to support more platforms and languages. Currently, you can write plugins in C, C++ and Objective-C. The “WSGI” part in the name is a tribute to the namesake Python standard, as it has been the first developed plugin for the project. Versatility, performance, low-resource usage and reliability are the strengths of the project (and the only rules fol- lowed). Contents 1 uWSGI Documentation, Release 2.0 2 Contents CHAPTER 1 Included components (updated to latest stable release) The Core (implements configuration, processes management, sockets creation, monitoring, logging, shared memory areas, ipc, cluster membership and the uWSGI Subscription Server) Request plugins (implement application server interfaces for various languages and platforms: WSGI, PSGI, Rack, Lua WSAPI, CGI, PHP, Go .
    [Show full text]
  • Appb: Apache Perl Modules
    ,appb.27123 Page 764 Thursday, November 18, 2004 12:49 PM APPENDIXAppendix B B Apache Perl Modules Many third-party modules have been written to extend mod_perl’s core functional- ity. They may be distributed with the mod_perl source code, or they may be avail- able from CPAN. In this chapter we will attempt to group these modules based on their functionality. Some modules will be discussed in depth, but others will be touched on only briefly. Since most of these modules are continually evolving, the moment this book is pub- lished much of the information in it will be out of date. For this reason, you should refer to the modules’ manpages when you start using them; that’s where you will find the most up-to-date documentation. We will consider modules in the following groups: Development Modules used mainly during the development process Debugging Modules that assist in code debugging Control and monitoring Modules to help you monitor the production server and take care of any prob- lems as soon as they appear Server configuration Modules used in server configuration Authentication Modules used to facilitate authentication Authorization Modules used to facilitate authorization Access Modules used during the access-verification phase Type handlers Modules used as PerlTypeHandlers 764 This is the Title of the Book, eMatter Edition Copyright © 2004 O’Reilly & Associates, Inc. All rights reserved. ,appb.27123 Page 765 Thursday, November 18, 2004 12:49 PM Trans handlers Modules used as PerlTransHandlers Fixup Handlers Modules used as PerlFixupHandlers
    [Show full text]
  • The Sun Web Developer Pack Tutorial, a Tutorial That Covers Emerging Web Technologies Like Ajax, REST Web Services, and Scripting Language-Based Web Applications
    The SunWeb Developer Pack Tutorial Sun Microsystems, Inc. 4150 Network Circle Santa Clara, CA 95054 U.S.A. Part No: 820–2133 May 2007 Copyright 2007 Sun Microsystems, Inc. 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved. Sun Microsystems, Inc. has intellectual property rights relating to technology embodied in the product that is described in this document. In particular, and without limitation, these intellectual property rights may include one or more U.S. patents or pending patent applications in the U.S. and in other countries. U.S. Government Rights – Commercial software. Government users are subject to the Sun Microsystems, Inc. standard license agreement and applicable provisions of the FAR and its supplements. This distribution may include materials developed by third parties. Parts of the product may be derived from Berkeley BSD systems, licensed from the University of California. UNIX is a registered trademark in the U.S. and other countries, exclusively licensed through X/Open Company, Ltd. Sun, Sun Microsystems, the Sun logo, the Solaris logo, the Java Coffee Cup logo, docs.sun.com, Java, and Solaris are trademarks or registered trademarks of Sun Microsystems, Inc. in the U.S. and other countries. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. in the U.S. and other countries. Products bearing SPARC trademarks are based upon an architecture developed by Sun Microsystems, Inc. The OPEN LOOK and SunTM Graphical User Interface was developed by Sun Microsystems, Inc. for its users and licensees. Sun acknowledges the pioneering efforts of Xerox in researching and developing the concept of visual or graphical user interfaces for the computer industry.
    [Show full text]
  • Database Configuration
    3 The graphs included in this document were run on 3 Magento Enterprise Edition installations of the different catalog sizes detailed above, noted as Magento Enterprise Edition sample data (sd), Magento Enterprise Edition with 10,000 products (10k) and Magento Enterprise Edition with 80,000 products (80k). Each test was executed with 10, 20, 50 and 100 concurrent connections. The figures show both the main page performance and the average performance on abstract customer sessions on the site. Please check the ‘Performance Testing’ section for more details on tools and techniques used. Database Configuration Proper MySQL configuration is one of the most important aspects of configuring any Magento Enterprise Edition environment. Optimizing theMySQL configuration can provide up to a 70% performance boost. An incorrect configuration may result in the web-server spending more time in idle loops waiting to retrieve data from the database. As an additional note, the default MySQL installation, even in later versions, is configured to use far less resources than average hardware can provide. Let's quickly go through the most important directives in the MySQL configuration file, my.cnf, and their recommended values. The formulas that can be used for all the calculations can be found in the template file bundled within a MySQL distribution package. Available Memory Magento Enterprise Edition uses InnoDB as its primary table storage engine type. InnoDB, unlike MyISAM, can use the in-memory buffer pool to cache table indexes and data. Less disk I/O is needed to get data from hard drives when the value of the in- memory buffer pool is set higher.
    [Show full text]
  • The Book of Webmin
    The Book of Webmin Or: How I Learned to Stop Worrying and Love Unix by Joe Cooper The Book of Webmin: Or: How I Learned to Stop Worrying and Love Unix by Joe Cooper Copyright © 2000, , 2001, , 2002 Joe Cooper Documenting system configuration and ongoing system maintenance using the Webmin [http://www.webmin.com/webmin] web based administration tool. Table of Contents Preface ......................................................................................... xii Conventions Used in This Guide ............................................................. xii Who Webmin is For ....................................................................... xiii Who This Book is For ...................................................................... xiv Why a Webmin Book? ...................................................................... xv How to Contact the Author and Errata ....................................................... xvii How to Contact No Starch Press ............................................................ xvii Acknowledgments ........................................................................ xvii 1. Getting and Installing Webmin ................................................................... 1 Where to Download Webmin ................................................................. 1 Installing Webmin ........................................................................... 1 Installing from a tar.gz .................................................................. 1 Installing from an RPM ................................................................
    [Show full text]
  • Julien Danjou
    The Hacker’s Guide to Scaling Python Julien Danjou Julien Danjou <[email protected]> Copyright © 2016-2017 Julien Danjou Revision History Revision 1.0 May 2017 JD First Edition. About this Book Version 1.0 released in 2017. When I released The Hacker’s Guide to Python in 2014, I had no idea that I would be writing a new book so soon. Having worked on OpenStack for a few more years, I saw how it is easy to struggle with other aspects of Python, even after being on board for a while. Nowadays, even if computers are super-fast, no server is fast enough to handle millions of request per second, which is a typical workload we want to use them for. Back in the day, when your application was slow, you just had to optimize it or upgrade your hardware – whichever was cheaper. However, in a world where you may already have done both, you need to be able to scale your application horizontally, i.e., you have to make it run on multiple computers in parallel. That is usually the start of a long journey, filled with concurrency problems and disaster scenarios. Developers often dismiss Python when they want to write performance enhancing, and distributed applications. They tend to consider the language to be slow and not suited to that task. Sure, Python is not Erlang, but there’s also no need to ditch it for Go because of everyone saying it is faster. I would like to make you aware, dear reader, that a language is never slow.
    [Show full text]
  • System Administration with Webmin by Joe Cooper System Administration with Webmin by Joe Cooper Copyright © 2000, , 2001, , 2002 Joe Cooper
    System Administration With Webmin by Joe Cooper System Administration With Webmin by Joe Cooper Copyright © 2000, , 2001, , 2002 Joe Cooper “System Administration With Webmin” documents system configuration and ongoing system maintenance using the Webmin [http://www.webmin.com/webmin] web based administration tool. Table of Contents Preface ......................................................................................... xii Conventions Used in This Guide ............................................................. xii Who Webmin is For ....................................................................... xiii Who This Book is For ...................................................................... xiv Why a Webmin Book? ...................................................................... xv How to Contact the Author and Errata ....................................................... xvii How to Contact No Starch Press ............................................................ xvii Acknowledgments ........................................................................ xvii 1. Getting and Installing Webmin ................................................................... 1 Where to Download Webmin ................................................................. 1 Installing Webmin ........................................................................... 1 Installing from a tar.gz .................................................................. 1 Installing from an RPM ................................................................
    [Show full text]
  • Configuring and Managing MPE/Ix Internet Services Manual # for More Information (HP Part No
    Configuring and Managing MPE/iX Internet Services HP 3000 MPE/iX Computer Systems Edition 4 Manufacturing Part Number: 32650-90897 E0400 U.S.A. April, 2000 Notice The information contained in this document is subject to change without notice. Hewlett-Packard makes no warranty of any kind with regard to this material, including, but not limited to, the implied warranties of merchantability or fitness for a particular purpose. Hewlett-Packard shall not be liable for errors contained herein or for direct, indirect, special, incidental or consequential damages in connection with the furnishing or use of this material. Hewlett-Packard assumes no responsibility for the use or reliability of its software on equipment that is not furnished by Hewlett-Packard. This document contains proprietary information which is protected by copyright. All rights reserved. Reproduction, adaptation, or translation without prior written permission is prohibited, except as allowed under the copyright laws. Restricted Rights Legend Use, duplication, or disclosure by the U.S. Government is subject to restrictions as set forth in subparagraph (c) (1) (ii) of the Rights in Technical Data and Computer Software clause at DFARS 252.227-7013. Rights for non-DOD U.S. Government Departments and Agencies are as set forth in FAR 52.227-19 (c) (1,2). Acknowledgments UNIX is a registered trademark of The Open Group. Windows and Windows NT and registered trademarks of Microsoft Corporation. Hewlett-Packard Company 3000 Hanover Street Palo Alto, CA 94304 U.S.A. © Copyright 1997, 1998, and 2000 by Hewlett-Packard Company 2 Contents 1. Introduction to Internet Services Overview of Internet Services .
    [Show full text]