Ryan Lane's Blog

SmoothGallery extension 1.1h released

Ryan Lane — Fri, 13 Aug 2010 02:51:37 +0000

Long trips without internet access seem to get me in a programming mood. I took a six hour car ride and finally updated the SmoothGallery extension to work properly with newer versions of MediaWiki. I closed out a long standing bug with descriptions while I was at it. Here are the changes:

Fixed bug when sgallery was used as a tag
Fixed bug with use of the parser to recursively parse tags
Fixed bug with descriptions. Descriptions can now be displayed, and wikitext can be used in them.

Share:

Requiring SSL client authentication in a user friendly way in Apache

Ryan Lane — Thu, 29 Jul 2010 13:56:34 +0000

Web browsers don’t display very friendly error messages to users when SSL client authentication fails. What most people understand from the error message displayed is “This site doesn’t work for me”. This is a usability failure. Your site should always display useful error messages to your users.

Another common usability failure is to allow users to present multiple client certificates when your site only trusts a certain type of certificate. The user has no idea which certificate they need to present, and they shouldn’t need to. The common solution to this problem is to provide documentation as to which certificate should be used. This is a poor solution.

In this article, I’ll describe how to configure Apache to require SSL client authentication in a polite, usable way.

Politely requiring SSL client authentication

I’m using “require” somewhat loosely here, as that’s the first thing we are going to change in our configuration. When you use the SSLVerifyClient directive with the require value, it really means require. So, how do we get around this?

We change the SSLVerifyClient directive to the optional value. The key is making optional still mean require. Our goal is to redirect users to help documentation when SSL client authentication fails. We can do this by using mod_rewrite and environment variables from mod_ssl. Here’s how to configure this in Apache:

SSLOptions +StdEnvVars
SSLVerifyClient optional
SSLVerifyDepth 3
RewriteEngine On
RewriteCond %{SSL:SSL_CLIENT_VERIFY} !^SUCCESS$
RewriteRule .* /help/ssl-client-auth-required.html [L]

In this configuration, any request that doesn’t have a valid client certificate will be redirected to a help file. Optional, yet required politely. Don’t forget to be polite internationally, if that is a requirement! You should configure Apache to serve the help document based on the user’s language. I’m going to avoid this portion of the topic for now. I’ll go into this in a future article.

Selectively accepting client certificates

If your users have multiple types of client certificates; for email, client authentication, and encryption from different intermediate CAs; for instance; and your application needs a specific type of certificate; then you shouldn’t force your users to guess which certificate is required. There are a few options here:

Provide documentation to educate users on which certificate to choose prior to them accessing the site
Use the above method to educate users when they fail to choose the correct certificate
Use both options 1 and 2
Only allow users to choose the correct certificate by limiting which certificates your site will accept

The obvious choice from a usability perspective is option 4. It is less confusing, requires less documentation to be written and read, and is fairly easy to configure.

The first step is to identify which certificate authorities (CA)s you wish to trust. The next step is to append all of the public CA certificates into a single file. The final step is to configure Apache to use this file to restrict certificates. To configure this in Apache, use the following directive:

SSLCADNRequestFile /etc/pki/tls/certs/client-trust-bundle.cer

Unfortunately, option 4 will only be a viable option if the different certificate types were created by different CAs (which, hopefully, you are doing for security reasons). If you are unable to use option 4, you should use option 3.

Share:

Changed blog content license to CC BY SA

Ryan Lane — Tue, 20 Jul 2010 14:49:35 +0000

Though at some point in time I thought I had already assigned this license to my content, it was not listed on the site. It may have disappeared during a skin upgrade. Anyway, all content on this site is licensed under the Creative Commons Attribution-ShareAlike 3.0 Unported License.

Share:

JSBreadCrumbs 0.5 released

Ryan Lane — Thu, 08 Jul 2010 15:42:05 +0000

JSBreadCrumbs is a MediaWiki extension that will add a trail of navigation breadcrumbs below the navigation tabs.

Another train ride, some more coding… This is a bugfix release. The following has changed since 0.4:

Changed the display of site names to (site name) from site name: to make a visual difference between project namespace, and site name

Hopefully, this will make it clearer that the site name isn’t a namespace, but a different wiki.

To download the extension, do so via the extension distributor on the extension’s page at mediawiki.org.

Share:

JSBreadCrumbs 0.4 released

Ryan Lane — Mon, 05 Jul 2010 11:33:56 +0000

JSBreadCrumbs is a MediaWiki extension that will add a trail of navigation breadcrumbs below the navigation tabs.

I was on the train for a long time yesterday, and got a chance to fix some bugs. This is a feature and bugfix release. The following has changed since 0.3:

Added different site name support (when breadcrumbs are enabled on wiki farms, and they share the same cookie path)
Added support for preferences
- Users can enable/disable bread crumbs
- Users can enable/disable the prepending of site name onto titles
- Users can set the number of bread crumbs to display
Delete cookies on log out
Removed some global preferences (replaced with default user options)
Fixed localization issue with namespaces
Only output Javascript/CSS when using the Vector skin

The usual methods should be used to download. See the extension’s page on mediawiki.org for download options.

Share:

JSBreadCrumbs 0.3 released

Ryan Lane — Tue, 29 Jun 2010 00:57:54 +0000

This is a bugfix release. The following has changed since 0.1:

Display wgTitle instead of wgPage to avoid url encoded titles
Fix issue where wgJSBreadCrumbsMaxCrumbs + 1 number of bread crumbs were shown instead wgJSBreadCrumbsMaxCrumbs
Strip empty title and url when it exists
Change the output of the leading description to look like “Leading description:” instead of “Leading description ” + wgJSBreadCrumbsSeparator, to make it more clear that it isn’t part of the history.
Change the character used to split and join in cookies to ‘|’ since it is illegal in urls and page titles, and therefore is guaranteed to work, unlike using the user overridable separator
Make addResources in JSBreadCrumbs.hooks.php public and static to get rid of php warning
Allow the separator character to be localized
Add preceding string to the breadcrumbs to describe their purpose on initial page load

For more information, see the extension page.

Share:

New MediaWiki extension JSBreadCrumbs 0.1 released

Ryan Lane — Fri, 25 Jun 2010 15:45:28 +0000

JSBreadCrumbs is a simple extension that adds a jQuery based Javascript file and a CSS file to your wiki’s output that will add a trail of navigation breadcrumbs below the navigation tabs. The idea is for a simpler history than your back button that only tracks navigation inside of the wiki. Unlike the browser’s back button, it will only track GET requests, not POSTs, will only show history for your wikis, and will remove duplicate entries from the list.

The breadcrumbs can follow users across wikis in a wiki farm, if those wikis share the same domain. This is the default behavior, but can be changed. The other configurable options are the number of breadcrumbs shown, and the separator between the breadcrumbs.

Since this extension is simply Javascript and CSS, it can be added to your wiki as a gadget, if you use the Gadgets extension.

To get more information, or to download the extension, please see the extension’s page on mediawiki.org.

Share:

LdapAuthentication 1.2c released

Ryan Lane — Thu, 24 Jun 2010 03:09:50 +0000

This is a bugfix release related to the previous 1.2b release. The following has changed:

Fixed issue with single domains, and non-auto-authentication domains being non-operational due to security fix in 1.2b
Fixed another issue with mail me a password not working properly

To download this version, please use the extension distributor (http://www.mediawiki.org/wiki/Special:ExtensionDistributor/LdapAuthentication), select “Development version (trunk)”, and click “Continue”.

Share:

LdapAuthentication 1.2b released – Security fix for register_globals users

Ryan Lane — Wed, 23 Jun 2010 01:27:40 +0000

This release contains a security bugfix for users of register_globals. Most configuration options in the extension did not have default values; this release sets defaults for all configuration globals. Users are recommended to update to this version, or disable register_globals. If you do not have register_globals enabled, you are not affected.

The following has changed since 1.2a:

Fixed issue with group synchronization and nested groups
Added support for exclusion groups in addition to required groups
- Configured via $wgLDAPExcludedGroups; syntax the same as $wgLDAPRequiredGroups
Fixed check for returns with no entries
Added memberOf support
Added patch for getting user’s primary group when using memberOf
Fixed group synchronization issue with memberOf support (patch by Teddy Reed)
Fixed problem with usernames containing parenthesis
Fixed warnings in PHP 5.2.10 when some entries weren’t returned
Fixed issue with $wgLDAPGroupsPrevail
Fixed issue with mail temporary password button when email me a password support was enabled
Added support for non-standard ports
- Configured via $wgLDAPPort – see options documentation
Changed debug to output to a file
- Configured via $wgDebugLogGroups["ldap"] – see options documentation
Added support for modifying LDAP options when connecting
- Configured via $wgLDAPOptions – see options documentation
Added a security fix for register_globals users (seriously, turn register_globals off, if you have it on)

To download this version, please use the extension distributor, select “Development version (trunk)”, and click “Continue”.

Share:

Graphical login into Unix/Linux systems from Cygwin using SSH

Ryan Lane — Mon, 07 Jun 2010 22:57:29 +0000

XDMCP is insecure when used directly, as it is unencrypted, and will send your credentials and all keystrokes and mouse actions over the network in clear text. By default XDMCP is disabled on most recent distros. Thankfully there isn’t any reason to use it!

Instead of using XDMCP, you can use X11 forwarding to run your graphical environments across SSH. Doing so also allows you to log in via smart cards, if your version of SSH has PKCS11 support.

I’ve written a script called remote-graphical-login to make this much easier. Note that this script has smartcard support built in, and may not work properly if the libraries do not exist on your system. In a future version I’ll make this configurable so that it can be used with identity files, or without an agent. Here’s the usage:

Usage: remote-graphical-login.sh [-s session] [-I cardlib] [-l username] [username@][hostname]
        -s      kde or gnome (default)
        -I      coolkey or activclient (default)
        -l      Username to login with
Example: remote-graphical-login.sh -s kde testuser@testhost

There may be a few bugs in the script. Let me know if you run into any.

Update (06/14/10): Fixed some issues in the script. Notably, the X launcher did exactly the opposite of what it was intended to do. If an X server was already running, it would re-use that server. The intended action was for the script to start a new X server on another display number. This is now fixed. Also, an informational message will now be shown to users when they do not specify a username or hostname, mentioning the ability to do so.

Share:

Using ActivClient or Coolkey with SSH for Smart Card Login using Cygwin