Question

I've installed out-of-the-box TWiki 4.0.2 and I am attempting to lock it down for private usage. I am quite happy using cookie-based auth, but none of the current support articles appear to discuss a cookie-based secure approach.

I want to be sure that I'm not falsely assuming my TWiki will be secure/private with this approach.

Basically, if I put all the twiki/bin scripts into $TWiki::cfg{AuthScripts}, will this mean that no-one can do anything unless they log in? i.e. is this a certain path to securing my TWiki and all its webs? Are there any twiki/bin scripts I need to keep out of AuthScripts to allow login to work?

thanks! Nathan

Related question and answers

I realise this sounds a bit like an FAQ, but the questions I have read from the Support web (see below) don't seem to address an "all locked down by cookie auth" approach. Questions I have read/looked at are:

• RegisterOnViewRestrictedSite
• AuthenticationScenario
• AuthenticationWithoutHtaccess
• DefaultSecurityIssue
• ForceSecureLogin
• HiddenWebs
• HowToForceSecureLoginForSomeWebs
• SecureAccessToOutside
• SecureAuthenticationWithApache
• UseSSLforAuthenticatedAccess

Environment (not really relevant to this one, I think?

-- NathanBailey - 11 Jun 2006

Answer

If you put all scripts into $TWiki::cfg{AuthScripts}, then nobody can do anything with your TWiki unless she logs in. The only thing you need to consider is that nobody can register himself - RegisterOnViewRestrictedSite has a solution for that (copy the HTML version of the registration page to a static page), in addition you need to exclude register from $TWiki::cfg{AuthScripts}.

The important additional thing to keep in mind is that you need to configure your Apache correctly so that it doesn't serve TWiki data directly. The sample .htaccess pages in the distribution show how to do that: There are Deny from all directives for the data, lib, locale, and templates subdirectories.

-- HaraldJoerg - 11 Jun 2006

Don't forget to put the pub directory under authentication (with the same require valid-user.)

-- PeterThoeny - 12 Jun 2006

Wouldn't it be simpler to use global ACL?

-- MeredithLesly - 12 Jun 2006

Would you care to sketch the ACL solution, just for comparison?

-- SteffenPoulsen - 16 Jun 2006

Also if you need high grade security, I would recomend implementing TWikiAccessControl section "Controlling Access to Attachments".

-- MarcoPoli - 13 Jul 2006