[ILUG] server to server security and auth.

[HAMILTON,DAVID (HP-Ireland,ex1)]

Sounds like a perfect SSH case to me....
I'm working on a project where we're using lots of SSH tunnels to encrypt
traffic between servers, and it's so easy.
Good Luck,
	David Hamilton.

-----Original Message-----
From: Donncha O Caoimh [mailto:donncha.ocaoimh at tradesignals.com]
Sent: 18 September 2000 10:07
To: ILUG
Subject: [ILUG] server to server security and auth.


Has anyone done any work on communicating between servers using HTTP?
I'm working on providing an API that developers can use to access
various services on Tradesignals.com but has to be as secure as
possible. SSL is a possibility but it's likely that our partners won't
have SSL capable programs on their servers.
Some ideas:
Send username and password with every request. (Really bad I know!)
Generate a one-time password/identifier using a known algorithm+time of
day+password (a bit over the top! we'd have to implement solutions for
our partners..)
Remote server logs in to our server, receives a session ID which is
valid for X hours and uses the session ID in any request for that
period.
Use the IP address of the remote server for auth.

The idea here is that whatever system we use has to be as simple as
possible.
'Course, if I had my way, we'd use SSL or public key
cryptography/authentication.

Comments & ideas welcome!

Donncha.

-- 
Irish Linux Users' Group: ilug at linux.ie
http://www.linux.ie/mailman/listinfo/ilug for (un)subscription information.
List maintainer: listmaster at linux.ie