From: eldy <>
Date: Sun, 31 Mar 2002 02:07:18 +0000 (+0000)
Subject: Added new parameter AllowAccessFromWebToAuthenticatedUsersOnly.
X-Git-Tag: AWSTATS_4_0_BETA~18
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=82700f1df290e6469e0780e419bd0c2f3fe51573;p=thirdparty%2FAWStats.git
Added new parameter AllowAccessFromWebToAuthenticatedUsersOnly.
---
diff --git a/docs/awstats_changelog.txt b/docs/awstats_changelog.txt
index 3e9d8d95..1eff2895 100644
--- a/docs/awstats_changelog.txt
+++ b/docs/awstats_changelog.txt
@@ -12,6 +12,9 @@ AWStats Changelog
- Unresolved ip are now processed like resolved one.
- Added icons in browsers chart.
- Personalized log format can also have tab separator (not only space).
+- New ways to manage security/privacy with updated docs and new parameters:
+ AllowAccessFromWebToAuthenticatedUsersOnly
+ AllowAccessFromWebToFollowingAuthenticatedUsers
- New feature: Added mark on "grabber browsers" in browsers chart.
- New feature: Added average files size in Pages/URL report chart.
- New feature: You can put dynamic environnement variables into config file.
@@ -23,9 +26,9 @@ AWStats Changelog
- New parameter: ShowLinksToWhoIs
- New parameter: LinksToWhoIs
- New parameter: StyleSheet
-- New tool: A log format converter common2combined.pl
- New option: -staticlinks to build static links in report page (to use
AWStats with no web servers).
+- New tool: A log format converter common2combined.pl
- Fixed: wrong size of bar in "average" report when average value was < 1.
- Fixed: pb of "Error: Not same number of records" when using some version
of mod_perl.
diff --git a/docs/awstats_config.html b/docs/awstats_config.html
index d02cf96f..5ce36934 100644
--- a/docs/awstats_config.html
+++ b/docs/awstats_config.html
@@ -59,6 +59,8 @@ it with its value when reading it), follow the example:
OPTIONAL SETUP SECTION (Not required but increase AWStats features)
+- AllowAccessFromWebToAuthenticatedUsersOnly
+
- AllowAccessFromWebToFollowingAuthenticatedUsers
- CreateDirDataIfNotExists
- SaveDatabaseFilesWithPermissionsForEveryone
- PurgeLogFile
@@ -919,7 +921,8 @@ it with its value when reading it), follow the example:
color_TableRowTitle="FFFFFF" # Table row title font color (Default = "FFFFFF")
color_TableBGRowTitle="ECECEC" # Background color for row title (Default = "ECECEC")
color_TableBorder="ECECEC" # Table border color (Default = "ECECEC")
-
color_text="000000" # Color of main body text (Default = "000000")
+
color_text="000000" # Color of text (Default = "000000")
+
color_textpercent="606060" # Color of text for percent values (Default = "606060")
color_titletext="000000" # Color of text title within colored Title Rows (Default = "000000")
color_weekend="EAEAEA" # Color for week-end days (Default = "EAEAEA")
color_link="0011BB" # Color of HTML links (Default = "0011BB")
diff --git a/docs/awstats_security.html b/docs/awstats_security.html
index 5b14f5e3..27d8a5af 100644
--- a/docs/awstats_security.html
+++ b/docs/awstats_security.html
@@ -38,7 +38,8 @@ The most common things you would like to do is to prevent user xxx (having a sit
statistics of user yyy (having a site www.yyy.com).
This is example of possible way of working:
-
+
+
1) VERY HIGHLY SECURED
Policy:
You have several different config/domains owned by different users and you want to build statistics for each
@@ -55,10 +56,10 @@ be securely viewed by correct allowed users only (or sent by mails).
If users have a command line access (telnet) on statistics server, you must set correct permissions on AWStats
database files. Set all AWStats database files (built by the update process) for config/domain1 to have read/write
for user1 (or an admin user) and NO read and NO write permissions for any other users.
-Then, check that the SaveDatabaseFilesWithPermissionsForEveryone is set 0 in your config/domain files.
+Then, check that the SaveDatabaseFilesWithPermissionsForEveryone parameter is set 0 in your config/domain files.
If AWStats database files for config/domain1 are read protected, only allowed users can see statistics for config/domain1.
If AWStats database files for config/domain1 are write protected, only allowed users can update statistics for config/domain1.
-
+
2) HIGHLY SECURED
Policy:
@@ -87,30 +88,21 @@ for each domain to say which config file to use for a particular domain.
When using AWStats as a CGI with the following URL 'http://mydomain.com/cgi-bin-awstats/awstats.pl', AWStats
will use the config file called awstats.myconfigvalueformydomain.conf to choose which statistics used,
even if a visitor try to force the config file with the URL 'http://mydomain.com/cgi-bin-awstats/awstats.pl?config=xxx'.
-
+
3) MEDIUM SECURED
-!!! This policy is not possible yet as the use of file awstatsusers is not yet developed. !!!
Policy:
-You have several config/domain and several users. You want to specify (using a awstatsusers file) which user can see
-or update dynamically statistics for each config/domain.
+You have several config/domain and several users. You want to specify which user can see or update dynamically
+statistics for each config/domain.
Advantage:
Statistics are dynamic. High level of manageability.
Disadvantage:
AWStats database files must be readable by anonymous web server user, so if an experimented user can have an access to
-the server where AWStats database files are stored, he will be able to install and run a hacked version
-of AWStats that does not check permissions into the awstatsusers file and see/update from other config files.
+the server where AWStats database files are stored, he can succeed in installing and running a "hacked" version
+of AWStats that ignores value of parameter AllowAccessFromWebToAuthenticatedUsersOnly.
How:
-awstats.pl file must be saved in a web protected realm to allow awstats to get the username from
-when running as CGI.
-Then you must create the text file awstatsusers. This file is a text file with several records that contains
-two fields separated by a ";". First field is the user name allowed to read statistics from a browser.
-Second field is a list (separated by comma ",") of all visible config/domain allowed for this user.
-Example of awstatsusers file:
-user1;*
-user2;www.domain2.com
-user3;www.domain3a.com,www.domain3b.com
-
+awstats.pl file must be saved in a web protected realm to force a visitor to enter its username/password
+to access AWStats CGI program.
Example of directives you can add into Apache to have awstats.pl in a web protected realm:
<Files "awstats.pl">
AuthUserFile /path/to/.passwd
@@ -120,14 +112,15 @@ AuthType Basic
require valid-user
</Files>
-And save the awstatsusers file in the DirData directory (directory where AWStats save its database) and put on this file "read only"
-permissions for everyone.
-
+Then edit each config/domain file you want to be protected to set AllowAccessFromWebToAuthenticatedUsersOnly to 1.
+You can also edit list of authorized users in the AllowAccessFromWebToFollowingAuthenticatedUsers parameter.
+
+
4) LOW SECURED
Policy:
-Same as 3 with no use of awstatsusers.
-This is the most common way of working for all users that have only one hosts
-and don't want to have restricted accounts to manage.
+You have only one hosts or several hosts or users but you don't need to manage particular permissions
+for your different config/domain statistics.
+This is the most popular way of working as this requires no particular setup.
Advantage:
Setup is very easy (No need of particular setup). Statistics are dynamic.
Disadvantage:
diff --git a/wwwroot/cgi-bin/awstats.model.conf b/wwwroot/cgi-bin/awstats.model.conf
index 22979e39..9d9eb1f9 100644
--- a/wwwroot/cgi-bin/awstats.model.conf
+++ b/wwwroot/cgi-bin/awstats.model.conf
@@ -77,7 +77,7 @@ LogFile="/var/log/httpd/mylog.log"
#
LogFormat=1
-# If you want to have informations on domains/countries visitors, you must ask
+# If you want to have information on domains/countries visitors, you must ask
# AWStats to make reverse DNS lookup (if not already done in your log file).
# If you set DNSLookup to 1, don't forget that reverse DNS lookup decrease
# seriously AWStats time processing.
@@ -128,7 +128,7 @@ SiteDomain=""
# Put here all other possible domain names, addresses or virtual host aliases
# someone can use to access your site. Try to keep only the minimum number of
-# possible names/adresses to have the best performances.
+# possible names/addresses to have the best performances.
# You can repeat the "SiteDomain" value in this list.
# Use space between each value and put a backslash before each dot.
# This parameter is used to analyze referer field in log file and to help
@@ -140,14 +140,14 @@ HostAliases="www.myserver.com x.y.z.w localhost 127.0.0.1"
# When this parameter is set to 1, AWStats add a button on report page to
# allow to "update" statistics from a web browser. Warning, when "update" is
-# made from a browser, AWStats is runned as a CGI by the web server user
+# made from a browser, AWStats is ran as a CGI by the web server user
# defined in your web server (user "nobody" by default with Apache, "IUSR_XXX"
# with IIS), so the "DirData" directory and all already existing history files
# (awstatsMMYYYY[.xxx].txt) must be writable by this user. Change permissions
# if required.
# Warning: Update process can be long so you might experience "time out"
# browser errors if you don't launch AWStats enough frequently.
-# When set to 0, update is only made when AWStats is runned from the command
+# When set to 0, update is only made when AWStats is ran from the command
# line interface (or a task scheduler).
# Possible values: 1 or 0
# Default: 0
@@ -161,21 +161,42 @@ AllowToUpdateStatsFromBrowser=0
# OPTIONAL SETUP SECTION (Not required but increase AWStats features)
#-----------------------------------------------------------------------------
+# The following two parameters allow you to protect a config file to be used
+# by your AWStats program called from a browser only if web user has been
+# authenticated. Your AWStats program must be in a web protected "realm" (With
+# Apache, you can use .htaccess files to do so. With other web servers, see
+# your server setup manual).
+# Possible values: 1 or 0
+# Default: 0
+#
+AllowAccessFromWebToAuthenticatedUsersOnly=0
+
+# This parameter give the list of all authorized authenticated users to view
+# statistics for this domain/config file. This parameter is used only if
+# AllowAccessToAuthenticatedUsersOnly is set to 1.
+# Example: "user1 user2"
+# Default: ""
+#
+AllowAccessFromWebToFollowingAuthenticatedUsers=""
+
# If the "DirData" directory (see above) does not exists, AWStats return an
-# error. However, you can ask AWStats to create it. This option can be used by
-# some Web Hosting Providers that has defined a dynamic value for DirData (for
-# example DirData="/home/__REMOTE_USER__").
+# error. However, you can ask AWStats to create it.
+# This option can be used by some Web Hosting Providers that has defined a
+# dynamic value for DirData (for example DirData="/home/__REMOTE_USER__") and
+# don't want to have to create a new directory each time they add a new user.
# Possible values: 1 or 0
# Default: 0
#
CreateDirDataIfNotExists=0
-# In most case, AWStats is used as a cgi program. So AWStats process is runned
+# In most case, AWStats is used as a cgi program. So AWStats process is ran
# by default web server user (nobody for Unix, IUSR_xxx for IIS/Windows,...).
-# To avoid permission problems between update process often runned by an admin
-# user (root for Unix, Administrator for Windows,...), AWStats save its
-# database files by default with read and write for everyone. You can set this
-# parameter to 0, if you want AWStats to keep default process user permission.
+# To make use easier and avoid permission problems between update process
+# (run by an admin user) and CGI process (ran by a low level user), AWStats
+# save its database files with read and write for everyone.
+# If you have experience on managing security policies (Web Hosting Provider),
+# you should set this parameter to 0. AWStats will keep default process user
+# permissions on its files.
# Possible values: 1 or 0
# Default: 1
#
@@ -188,7 +209,7 @@ SaveDatabaseFilesWithPermissionsForEveryone=1
# you can launch AWStats as soon as you want, even with this parameter to 0.
# With 0, no purge is made, so you must use a scheduled task or a web server
# that make this purge frequently.
-# With 1, the purge of the log file is made each time AWStats is runned.
+# With 1, the purge of the log file is made each time AWStats is ran.
# This parameter doesn't work with IIS (This web server doesn't let its log
# file to be purged).
# Possible values: 1 or 0
@@ -539,7 +560,8 @@ color_TableBG="CCCCDD" # Background color for table (Default = "CCCCDD")
color_TableRowTitle="FFFFFF" # Table row title font color (Default = "FFFFFF")
color_TableBGRowTitle="ECECEC" # Background color for row title (Default = "ECECEC")
color_TableBorder="ECECEC" # Table border color (Default = "ECECEC")
-color_text="000000" # Color of main body text (Default = "000000")
+color_text="000000" # Color of text (Default = "000000")
+color_textpercent="606060" # Color of text for percent values (Default = "606060")
color_titletext="000000" # Color of text title within colored Title Rows (Default = "000000")
color_weekend="EAEAEA" # Color for week-end days (Default = "EAEAEA")
color_link="0011BB" # Color of HTML links (Default = "0011BB")
diff --git a/wwwroot/cgi-bin/awstats.pl b/wwwroot/cgi-bin/awstats.pl
index 26d95e6b..911fbf3e 100644
--- a/wwwroot/cgi-bin/awstats.pl
+++ b/wwwroot/cgi-bin/awstats.pl
@@ -21,7 +21,7 @@ use vars qw(%DomainsHashIDLib @RobotsSearchIDOrder_list1 @RobotsSearchIDOrder_li
#-------------------------------------------------------
# Defines
#-------------------------------------------------------
-my $VERSION="4.0 (build 59)";
+my $VERSION="4.0 (build 60)";
# ---------- Init variables -------
my $Debug=0;
@@ -62,7 +62,7 @@ my $nowtime = my $nowweekofmonth = my $nowdaymod = my $nowsmallyear = 0;
my $nowsec = my $nowmin = my $nowhour = my $nowday = my $nowmonth = my $nowyear = my $nowwday = 0;
my $tomorrowtime = my $tomorrowsmallyear = 0;
my $tomorrowsec = my $tomorrowmin = my $tomorrowhour = my $tomorrowday = my $tomorrowmonth = my $tomorrowyear = my $tomorrowwday = 0;
-my ($BarHeight,$BarWidth,$DebugResetDone,$Expires,
+my ($AllowAccessFromWebToAuthenticatedUsersOnly,$BarHeight,$BarWidth,$DebugResetDone,$Expires,
$CreateDirDataIfNotExists, $KeepBackupOfHistoricFiles, $MaxLengthOfURL,
$MaxNbOfDomain, $MaxNbOfHostsShown, $MaxNbOfKeywordsShown, $MaxNbOfLoginShown,
$MaxNbOfPageShown, $MaxNbOfRefererShown, $MaxNbOfRobotShown,
@@ -110,6 +110,7 @@ my $TotalPages = my $TotalHits = my $TotalBytes = 0;
# ---------- Init arrays --------
my @Message=();
my @HostAliases=();
+my @AllowAccessFromWebToFollowingAuthenticatedUsers=();
my @OnlyFiles = my @SkipDNSLookupFor = my @SkipFiles = my @SkipHosts = ();
my @DOWIndex=();
my @RobotArrayList = my @RobotsSearchIDOrder = ();
@@ -498,7 +499,6 @@ sub Read_Config_File {
if ($param =~ /^DirCgi/) { $DirCgi=$value; next; }
if ($param =~ /^DirIcons/) { $DirIcons=$value; next; }
if ($param =~ /^DNSLookup/) { $DNSLookup=$value; next; }
- if ($param =~ /^AllowToUpdateStatsFromBrowser/) { $AllowToUpdateStatsFromBrowser=$value; next; }
if ($param =~ /^SiteDomain/) {
$value =~ s/\\\./\./g; $value =~ s/([^\\])\./$1\\\./g; $value =~ s/^\./\\\./; # Replace . into \.
$SiteDomain=$value; next;
@@ -509,7 +509,14 @@ sub Read_Config_File {
foreach my $elem (@felter) { push @HostAliases,$elem; }
next;
}
+ if ($param =~ /^AllowToUpdateStatsFromBrowser/) { $AllowToUpdateStatsFromBrowser=$value; next; }
# Read optional setup section
+ if ($param =~ /^AllowAccessFromWebToAuthenticatedUsersOnly/) { $AllowAccessFromWebToAuthenticatedUsersOnly=$value; next; }
+ if ($param =~ /^AllowAccessFromWebToFollowingAuthenticatedUsers/) {
+ my @felter=split(/\s+/,$value);
+ foreach my $elem (@felter) { push @AllowAccessFromWebToFollowingAuthenticatedUsers,$elem; }
+ next;
+ }
if ($param =~ /^CreateDirDataIfNotExists/) { $CreateDirDataIfNotExists=$value; next; }
if ($param =~ /^SaveDatabaseFilesWithPermissionsForEveryone/) { $SaveDatabaseFilesWithPermissionsForEveryone=$value; next; }
if ($param =~ /^PurgeLogFile/) { $PurgeLogFile=$value; next; }
@@ -819,6 +826,7 @@ sub Check_Config {
if ($DNSLookup !~ /[0-1]/) { error("Error: DNSLookup parameter is wrong. Value is '$DNSLookup' (should be 0 or 1)"); }
if ($AllowToUpdateStatsFromBrowser !~ /[0-1]/) { $AllowToUpdateStatsFromBrowser=0; }
# Optional setup section
+ if ($AllowAccessFromWebToAuthenticatedUsersOnly !~ /[0-1]/) { $AllowAccessFromWebToAuthenticatedUsersOnly=0; }
if ($CreateDirDataIfNotExists !~ /[0-1]/) { $CreateDirDataIfNotExists=0; }
if ($SaveDatabaseFilesWithPermissionsForEveryone !~ /[0-1]/) { $SaveDatabaseFilesWithPermissionsForEveryone=1; }
if ($PurgeLogFile !~ /[0-1]/) { $PurgeLogFile=0; }
@@ -2421,7 +2429,22 @@ if ($Debug) { debug("YearRequired=$YearRequired MonthRequired=$MonthRequired",2)
&html_head;
# Security check
-if ($UpdateStats && (! $AllowToUpdateStatsFromBrowser) && ($ENV{"GATEWAY_INTERFACE"})) {
+if ($AllowAccessFromWebToAuthenticatedUsersOnly && $ENV{"GATEWAY_INTERFACE"}) {
+ debug("REMOTE_USER is ".$ENV{"REMOTE_USER"});
+ if (! $ENV{"REMOTE_USER"}) {
+ error("Error: Access to statistics is only allowed from an authenticated session to authenticated users.");
+ }
+ if (@AllowAccessFromWebToFollowingAuthenticatedUsers) {
+ my $userisinlist=0;
+ foreach my $key (@AllowAccessFromWebToFollowingAuthenticatedUsers) {
+ if ($ENV{"REMOTE_USER"} eq $key) { $userisinlist=1; last; }
+ }
+ if (! $userisinlist) {
+ error("Error: User ".$ENV{"REMOTE_USER"}." is not allowed to access statistics of this domain/config.");
+ }
+ }
+}
+if ($UpdateStats && (! $AllowToUpdateStatsFromBrowser) && $ENV{"GATEWAY_INTERFACE"}) {
error("Error: Update of statistics is not allowed from a browser.");
}