Copyright 2000 eMation SECURITY - Controlling Data Access with

Copyright 2000 eMation Overview – Web Security Issues  Publishing process data with a Web Server is a potential security problem, even when restricted to intranets  Allows wide access to process data among plant’s user community  General Web security issues: User authentication Data protection (encryption) Access Control

Copyright 2000 eMation Security  3 Aspects of Security Authentication Access Control Data Protection  uses Web Server and NT security no new administration tasks/tools maps web server security domain to data server / control system domain

Copyright 2000 eMation Web Server Security Basics 1  Authentication Identifies browser via users/password login (once per session) 3 levels for IIS Web Server Anonymous access (no authentication) Basic Authentication (Netscape and IE browsers) NT Challenge/Response (IE only) Browser user mapped to local web server NT account

Copyright 2000 eMation Web Server Security Basics 2  Access Control For IIS, protection via NTFS permissions Can protect directories and individual files Dynamic requests (CGI) run in context of local login account  Data Protection does data exchange over http Allows encryption via SSL (secure socket layer) Built-in IIS feature

Copyright 2000 eMation Access Control Web Browser Web Server Data Server WebAAG CGI Protected Animation Screen Browser fetches protected animation web page and is required to log in. 12 Animation starts a data request. Can access protected Automation Server which runs in the login context as a local user. 3 CGI connects as client to data server. Server checks whether client has permission to read specified tags.

Copyright 2000 eMation Restricting Access by Domain IP Address and Domain Name filtering are available on IIS, but not on Personal Web server.

Copyright 2000 eMation  Read?  Write?  Run Scripts?  Execute programs?  Applies to Everyone IIS Access Control

Copyright 2000 eMation In File Explorer, right click on C:/Inetpub/wwwroot then select the Security tab NTFS Access Control Applies to Each File

Copyright 2000 eMation Web Server Security Basics 1  Authentication Identifies browser via users/password login (once per session) 3 levels for IIS Web Server Anonymous access (no authentication) Basic Authentication (Netscape and IE browsers) NT Challenge/Response (IE only) Browser user mapped to local web server NT account

Copyright 2000 eMation IIS Authentication Choose a Method for Access Control that is Manageable and has Adequate Security

Copyright 2000 eMation Authentication for Each Virtual Directory

Copyright 2000 eMation Data Protection Data Can be Encrypted Between the Browser and the Web Server

Copyright 2000 eMation Controlling access - a simple example  Restricting browser access to process data  3 categories of browser users: Those allowed to view (read) process data Those allowed to view and change data values Everyone else, who are allowed to do neither  For this example, we wish to give 3 users the following access to data: Alice, read-only access Bob, read and write access Charlie, no access

Copyright 2000 eMation Example Users AliceCharlie Web Server Data Server Bob No Access Read Only Read/Write

Copyright 2000 eMation Permissions and the CGI  To control access to data, you use both built-in features of the Microsoft IIS Web Server server permissions.  server can identify the requesting client and determine if that client has permission to read or write process data. In this case the client task is the CGI – the Web Server back- end process that is run to service a browser request.  By default, requests from different browsers run on the server in one guest account. In this case server sees all clients running as the same user.

Copyright 2000 eMation Anonymous Guest Access Web Server Data Server AliceCharlieBobGuest CGI Client

Copyright 2000 eMation Permissions and Authentication  You can turn off anonymous browser access for and WebOPC.  This forces all browser users to log in to an account on the Web Server system. This can be a local account or an account in the same NT domain.  In this case the Web CGI process will run from the local account. server can then identify each client user and apply separate permissions.

Copyright 2000 eMation Authenticated Access Web Server Data Server AliceCharlieBob Alice’s CGI Client Bob’s CGI Client Charlie’s CGI Client

Copyright 2000 eMation Demonstration Setup  The following demo shows how to control access for the 3 example users to a single Web animation page. The web page reads and writes data to the AAG demo server.  Set up: 1.Add user accounts on the NT server 2.Create an animation web page in a separate folder 3.Disable anonymous access to the web page and the CGI 4.Enable permissions in the demo server 5.Map the user accounts to AAG proxy groups. 6.Grant permissions to the AAG proxy groups.

Copyright 2000 eMation Add NT User Accounts  This is done with the NT User Manager.  For this example, add accounts for Alice, Bob and Charlie

Copyright 2000 eMation Create an Animation Page  A simple animation page with several input controls and one output edit box is created in a separate folder as:  /protectedaccess/ readwrite.html

Copyright 2000 eMation Disable Anonymous Access – General  With IIS or PWS V4, use the Internet Service Manager found in “Windows NT 4.0 Option Pack\Microsoft Personal Web Server” menu.

Copyright 2000 eMation Authentication Methods  IIS allows 3 types of Authentication for browser users: Anonymous. No authentication, and all users run locally under the IIS guest account No browser login is required. Basic Authentication. Account login is requested with a username / password prompt displayed in the browser. Users run locally in that account. This method works with both Navigator and IE browsers, but the password is exchanged in the clear. NT Challenge/Response. User login is required. This method works only in IE browsers. The password is not sent across the network. If the browser and server systems are in the same NT domain then the user is automatically authenticated – no login prompt is shown.  Normally, you would disable only Anonymous access. For this demo, we disable NT Challenge/Response as well to show the login taking place.

Copyright 2000 eMation Disable Anonymous Access to Page  Open the default web site and select the folder ‘protectedaccess’  Right-click on the folder and choose ‘Properties’.  Select the ‘Directory Security’ tab in the dialog box and click on the button labeled ‘Edit’ in ‘Anonymous Access and Authentication Control’.  Clear the ‘Allow Anonymous’ and ‘NT Challenge/Response’ checkboxes.

Copyright 2000 eMation Disable Anonymous CGI Access  Open the default web site and select the CGI file ‘aagweb.exe’ from the ‘CGI-bin’ folder.  Right-click on the file and choose ‘Properties’.  Select the ‘File Security’ tab in the dialog box and click on the button labeled ‘Edit’ in ‘Anonymous Access and Authentication Control’.  Clear the ‘Allow Anonymous’ and ‘NT Challenge/Response’ checkboxes.

Copyright 2000 eMation Enable Demo Server Permissions  Set up Demo Server permissions by editing the file ‘demoserv.ini’ in your AAG directory  Add the following lines to the ‘[Params]’ section: ReadPermission=DEMO_READ WritePermission=DEMO_WRITE

Copyright 2000 eMation Map User Accounts to AAG Proxies permissions can be assigned to individual users or to ‘proxy’ users.  A proxy is essentially a way of grouping clients as a single local user. You can then assign permissions to this single local user.

Copyright 2000 eMation Map User Accounts to AAG Proxies  Start the AAG administration tool from the \ Administration” menu. Select the ‘Proxies’ tab.  Select the proxy type ‘One User on One Host’.  Add 2 proxies: User ‘Alice’ on the local host as proxy ‘Reader’ User ‘Bob’ on the local host as proxy ‘ReaderWriter’

Copyright 2000 eMation Grant Permissions  In Administration tool, select the ‘Permissions’ tab.  Choose the permission type ‘Local User’.  Add 3 permissions: User ‘Reader’ with ‘DEMO_READ’ User ‘ReaderWriter’ with ‘DEMO_READ’ User ‘ReaderWriter’ with ‘DEMO_WRITE’

Copyright 2000 eMation Browsing with Read Access  Load the animation page in the browser. You will be prompted to login.  If you login as ‘Alice’ you can view the animation.  However if you attempt to enter a value in the edit box you will get an error message:

Copyright 2000 eMation Browsing with Read/Write Access  Once you login to a web site, you will not be prompted again for the duration of your browser session.  Restart the browser, navigate to the animation page and login as Bob.  Now you will be able to both view the animation and change the tag value.  Notice that demo server knows who the client is:

Copyright 2000 eMation Browsing with No Access  Restart the browser and log in as ‘Charlie’  Attempt to navigate to the animation page. The page will load but no data values will be displayed:

Copyright 2000 eMation Alternative Protection Schemes  Instead of disabling Anonymous Access with the Internet Service Manager, you can also set up protection directly with NTFS file and directory permissions.  This can be done from File Explorer.  In order to do this, you must remove read access for ‘Everyone’, and add access for the NT groups that you wish to allow.

Copyright 2000 eMation For more details… 

Copyright 2000 eMation End Security