Re: [PyCS-devel] New feature in CVS: shell tool for administrative commands - please comment on this

[Phillip P. <pp...@my...>]

Sounds interesting!

Sorry ... I'm in the middle of moving house right now, so don't have a
lot of time to experiment.  I like the idea though; it sounds very handy.

I'd like a way to make it so the midnight rollover can happen without
needing to use a crontab entry ... although that shouldn't be too hard
to retrofit.  Once PyCS has a built-in scheduler, we can get it to
call the rollover function at the right time without needing to break
anything else.

Thanks!
Phil.

On Wed, Nov 13, 2002 at 02:32:04PM +0100, Georg Bauer wrote:
> Hi!
> 
> I just checked in a new XML/RPC handler and a small tool that connects to
> this. It's a bit more complicated this time, so the description will be
> longer.
> 
> Files I created:
> 
> pycsAdmin.py: administrative functions that are available through XML/RPC
> pycsadm.py: simple tool that just uses the above interface
> pycs_tokens.py: helper functions for a challenge/response auth module
> 
> How does it work?
> 
> pycsAdmin connects to the pycsAdmin.* namespace in the XML/RPC interface.
> It gives out mostly two functions: "challenge" and "execute".
> 
> "challenge" just returns you a cryptographic challenge you have to use on
> calling other functions. This challenge is written in the filesystem to
> the RUNDIR of the PyCS, too. This function gets no parameters.
> 
> "execute" executes a command with parameters. It get's three parameters: a
> cryptographic token, the command name and a list of parameter values.
> 
> The token is constructed with the pycs_token.createToken function. It just
> takes the given challenge, creates an empty SHA1 context, and updates that
> with both the challenge and the password. The token is both the challenge
> and the hexdigest of the context (as a list).
> 
> The server now check wether it's own password using the given challenge
> gives the same response and check wether there is a remembered challenge
> of the given name. If there is a remembered challenge, it is deleted so
> that no other call can use this challenge.
> 
> Complicated? Yep, a bit. But it works. It gives the following nice results:
> 
> - the password is never sent over the line
> - challenges can't be sniffed, as they are one-time-only
> - challenges can't be predicted, as they are built from several aspects
> - since it uses XML/RPC, the client can run everywhere (even inside Radio)
> - since everything still goes through the server, functions can savely
> change data in Metakit
> - since the client stores it's password in a hidden and protected
> passwordlist, you can set the client up via crontab to do regular stuff
> - since you only can call defined functions, even if the password is
> compromised you won't open up your whole server, only the admin interface
> 
> It has the following drawbacks:
> 
> - the server needs to store the password in clear, so you have to protect
> it with unix rights (restrict the config to 700). The server checks wether
> the mode is 700, so this might not work on windows!
> 
> I just checked in everything and started to hack at additional functions
> that I need (for example the autodisable after inactivity will be coded
> using this tool, so I just can put the tool into the crontab of the pycs
> user, as will be the "shuffle hitstoday to hitsyesterday tool). Especially
> the problem with checking the rights of pycs.conf to be 700 might not work
> with non-unix systems, so somebody could check that with Windows and tell
> me - I only use Unix for servers, sorry. If the check doesn't work you can
> still use all the server provides, you just can't use pycsadm.py, that's
> all.
> 
> As allways, if you just ignore the stuff and don't change anything, PyCS
> will behave as before and you won't open up some holes, so it is safe to
> ignore this :-)