[Xitami] intranet security

[Francis Turner]

Michael wrote:

>On 25 Mar 2002 at 12:55, Stefan Pantazi wrote:
>
>>Hi,
>>
>>You could have only one, unique URL which points to a CGI (could be
>>anything, console application, LRWP-based, etc) which looks at the IP of the
>>user and then routes the request through the CGI response which is a
>>dynamically generated temporary page with a refresh of 1 second pointing to
>>the to the appropriate URL (either public or private).
>>I hope this helps.
>>
>>Stefan
>>
>
>Stefan is on the right track.  Redirecting by ip is easy esp when you 
>are willing to use cgi and ssi.   There's no need for any time lapse 
>or refresh.
>
>Just create a simple script to redirect based upon ip.  You can 
>easily redirect those outside the intranet one direction and those 
>inside the intranet another direction.
>

You can also do it using Xitami's handy built-in GSL scripting tool. 
Only possible disadvantage is that your HTML docuemtns will probably 
need to have a different extension. But the different extension and the 
addition of a few script lines at the top is all you need.

For example instead of index.htm you have index.dhtm
index.dhtm has the lines like the following tagged onto the front of it

.if defined(REMOTE_USER)
.- do some other validation if you feel like it e.g. check a cookie 
contacined in HTTP_COOKIE
.  define loginOK = 1
.else
.- Assume internal network is 10.1.1.0/24
.  if (substr(REMOTE_IP,,,7) = "10.1.1.")
.    define loginOK = 1
.  endif
.endif
.if (! defined(loginOK))
  Need to Login</TITLE>
  <meta http-equiv="Refresh" content="0; 
URL=http://$(HTTP_HOST:lower)/cgi-bin/ra/login.pl?referer=$(path_info)$(wasloggedin?:)"></HEAD>
  <BODY></BODY></HTML>
.  abort
.endif
<!-- start of  regular page -->

-- 
...if the US Government were ever to get really serious about Internet 
security, the top players in Microsoft's management hierarchy would find 
themselves handcuffed, blindfolded, led onto a tarmac within some obscure 
Air Force base, and shot.
-- Thomas C Greene (http://www.theregister.co.uk/content/55/23223.html)