Files | |
file | auth_lib.c |
This is the implementation of the Authentication Library. | |
file | auth_lib.h |
This is the header for the Authentication Library. | |
Defines | |
#define | AUTH_VALID_MESSAGE "PASSED VERIFICATION" |
#define | AUTH_INVALID_MESSAGE "FAILED VERIFICATION" |
#define | AUTH_PUB_KEY_FILE_EXT ".pub" |
#define | AUTH_MAX_ENCR_MESS_LEN 8.0 |
#define | AUTH_MAX_TEXT_LEN 257 |
#define | AUTH_MAX_MSG_LEN 65536 |
#define | AUTH_SOCK_TIMEOUT 10 |
Functions | |
int | auth_server (int sock, char *pub_key_dir) |
A server process calls this function to authenticate clients that are using this library. | |
int | auth_client (int sock, char *user_name, char *usr_priv_key) |
A client process calls this function to authenticate with a server using this library. |
The process of creating a daemon requires a developer to make many difficult design decisions. One of these decisions is the choice of authentication methods. Most daemons are required to use authentication because they provide data that should only be accessible to select users. There are two major categories of authentication, symmetric and asymmetric. Symmetric authentication bases authentication on a secret shared between client and server. Suppling a password to an FTP server is an example of this. Both the server and the client have to keep track of the client's password, which is the secret. Asymmetric authentication allows the server to authenticate the client without sharing secrets. This method is more secure because there is no secret passing over lines of communication. Public/private key authentication uses this method.
Public/private key encryption is based on the principle that data encrypted with a client's public key can only be decrypted (in a reasonable amount of time) by that client's private key, and vice versa. This process also assumes that the private key is known by the client only.
In order to send a private message to a server, the client should encrypt the message with the server's public key, and then the server decrypts it with its private key.
To authenticate a client, a server sends it a challenge: a string of random bytes. The client then encrypts the challenge using its private key and sends the result back to the server. The server uses the client's public key to decrypt the message. If the resulting message matches the challenge; the client is authenticated.
Alsad provides an implementation of the process described above in the authentication library. The library is divided into two main functions, a server function and a client function. These functions are called by the client and server processes after a TCP connection has been established.
For the two functions of this library to work properly there is some initial setup that must occur. First, any client that the server needs to authenticate must have a public key file in pub_key_dir on the server that corresponds to the user_name supplied. The public key file on the server should be in the format:
<user_name>.pub
The naming convention for priv_key_file is not important because the variable specifies the full path. The public and private keys used in this library are read using the OpenSSL libraries. These libraries must be in place for the authentication library to compile. The library also expects the use of PEM format keys with no pass phrase. These keys are generated by typing the following commands at the shell:
openssl genrsa -out output_file 1024
This command creates a private key file output_file in PEM format that does not require a pass phrase and has a 1024-bit modulus.
In order to create the public key in PEM format, use the following command at the shell:
openssl rsa -in private_key_file -out output_file -pubout
This command will create the public key file output_file in PEM format from the private key found in private_key_file.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
A client process calls this function to authenticate with a server using this library. Programmers should look over the detailed notes for this library to learn what is needed to use this function.
|
|
A server process calls this function to authenticate clients that are using this library. Programmers should look over the detailed notes for this library to learn what is needed to use this function.
|