ExternalVendorCode/tahoe-lafs
1
0
Fork 0
mirror of https://github.com/tahoe-lafs/tahoe-lafs.git synced 2025-03-21 19:25:16 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Updated accounts.url directive per warner's suggestions

Browse Source
This commit is contained in:
Patrick R McDonald 2012-01-19 15:08:18 -05:00 committed by Brian Warner
parent ee9d28f20b
commit 95a9972034
1 changed files with 21 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
docs/frontends/FTP-and-SFTP.rst
View File

@ -76,15 +76,28 @@ the next sections.
accounts.url Directive
======================
The accounts.url directive should point to a secure, preferably
localhost-only service. This makes it harder for attackers to brute force
the password or use DNS poisoning to cause the Tahoe-LAFS gateway to talk
with the wrong server, thereby revealing the username and passwords.
The accounts.url directive allows access requests to be controlled by an
HTTP-based login service, useful for centralized deployments. This was
used by AllMyData to provide web-based file access, where the service
used a simple PHP script and database lookups to map an account email
address and password into a tahoe rootcap. The service will receive a
multipart/form-data POST, just like one created with a <form> and <input>
fields, with three parameters:
Tahoe-LAFS will send the credentials, email address and password to the
URI specified in the accounts.url directive. If the credentials are correct,
the server will return a rootcap string. Otherwise, it returns the string
"0" which means bad username and/or password.
* action: "authenticate" (this is a static string, for backwards
compatibility with the old AllMyData authentication service)
* email: USERNAME (Tahoe has no notion of email addresses, but the
authentication service uses them as account names, so the interface
presents this argument as "email" rather than "username").
* passwd: PASSWORD
And should return a single string that either contains a Tahoe rootcap
(URI:DIR2:...), or "0" to indicate a login failure.
Tahoe-LAFS recommends the service be secure, preferably localhost-only. This
makes it harder for attackers to brute force the password or use DNS
poisoning to cause the Tahoe-LAFS gateway to talk with the wrong server,
thereby revealing the usernames and passwords.
Configuring FTP Access
======================