Requiring SSL client authentication in a user friendly way in Apache

pki

Web browsers don’t display very friendly error messages to users when SSL client authentication fails. What most people understand from the error message displayed is “This site doesn’t work for me”. This is a usability failure. Your site should always display useful error messages to your users.

Another common usability failure is to allow users to present multiple client certificates when your site only trusts a certain type of certificate. The user has no idea which certificate they need to present, and they shouldn’t need to. The common solution to this problem is to provide documentation as to which certificate should be used. This is a poor solution.

No Comments

Changed blog content license to CC BY SA

Uncategorized

Though at some point in time I thought I had already assigned this license to my content, it was not listed on the site. It may have disappeared during a skin upgrade. Anyway, all content on this site is licensed under the Creative Commons Attribution-ShareAlike 3.0 Unported License.

No Comments

JSBreadCrumbs 0.5 released

MediaWiki

JSBreadCrumbs is a MediaWiki extension that will add a trail of navigation breadcrumbs below the navigation tabs.

Another train ride, some more coding… This is a bugfix release. The following has changed since 0.4:

  • Changed the display of site names to (site name) from site name: to make a visual difference between project namespace, and site name

Hopefully, this will make it clearer that the site name isn’t a namespace, but a different wiki.

To download the extension, do so via the extension distributor on the extension’s page at mediawiki.org.

No Comments

JSBreadCrumbs 0.4 released

MediaWiki

JSBreadCrumbs is a MediaWiki extension that will add a trail of navigation breadcrumbs below the navigation tabs.

I was on the train for a long time yesterday, and got a chance to fix some bugs. This is a feature and bugfix release. The following has changed since 0.3:

  • Added different site name support (when breadcrumbs are enabled on wiki farms, and they share the same cookie path)
  • Added support for preferences
    • Users can enable/disable bread crumbs
    • Users can enable/disable the prepending of site name onto titles
    • Users can set the number of bread crumbs to display
1 Comment

JSBreadCrumbs 0.3 released

MediaWiki

This is a bugfix release. The following has changed since 0.1:

  • Display wgTitle instead of wgPage to avoid url encoded titles
  • Fix issue where wgJSBreadCrumbsMaxCrumbs + 1 number of bread crumbs were shown instead wgJSBreadCrumbsMaxCrumbs
  • Strip empty title and url when it exists
  • Change the output of the leading description to look like “Leading description:” instead of “Leading description ” + wgJSBreadCrumbsSeparator, to make it more clear that it isn’t part of the history.
  • Change the character used to split and join in cookies to ‘|’ since it is illegal in urls and page titles, and therefore is guaranteed to work, unlike using the user overridable separator
1 Comment

New MediaWiki extension JSBreadCrumbs 0.1 released

MediaWiki

JSBreadCrumbs is simple extension that adds a jQuery based Javascript file and a CSS file to your wiki’s output that will add a trail of navigation breadcrumbs below the navigation tabs. The idea is for a simpler history than your back button that only tracks navigation inside of the wiki. Unlike the browser’s back button, it will only track GET requests, not POSTs, will only show history for your wikis, and will remove duplicate entries from the list.

The breadcrumbs can follow users across wikis in a wiki farm, if those wikis share the same domain. This is the default behavior, but can be changed. The other configurable options are the number of breadcrumbs shown, and the separator between the breadcrumbs.

No Comments

LdapAuthentication 1.2c released

LDAP, MediaWiki

This is a bugfix release related to the previous 1.2b release. The following has changed:

  • Fixed issue with single domains, and non-auto-authentication domains being non-operational due to security fix in 1.2b
  • Fixed another issue with mail me a password not working properly

To download this version, please use the extension distributor (http://www.mediawiki.org/wiki/Special:ExtensionDistributor/LdapAuthentication), select “Development version (trunk)”, and click “Continue”.

2 Comments

LdapAuthentication 1.2b released – Security fix for register_globals users

LDAP, MediaWiki

This release contains a security bugfix for users of register_globals. Most configuration options in the extension did not have default values; this release sets defaults for all configuration globals. Users are recommended to update to this version, or disable register_globals. If you do not have register_globals enabled, you are not affected.

The following has changed since 1.2a:

  • Fixed issue with group synchronization and nested groups
  • Added support for exclusion groups in addition to required groups
    • Configured via $wgLDAPExcludedGroups; syntax the same as $wgLDAPRequiredGroups
  • Fixed check for returns with no entries
  • Added memberOf support
1 Comment

Graphical login into Unix/Linux systems from Cygwin using SSH

Cygwin, Red Hat, Solaris, Ubuntu, pki

XDMCP is insecure when used directly, as it is unencrypted, and will send your credentials and all keystrokes and mouse actions  over the network in clear text. By default XDMCP is disabled on most recent distros. Thankfully there isn’t any reason to use it!

Instead of using XDMCP, you can use X11 forwarding to run your graphical environments across SSH. Doing so also allows you to log in via smart cards, if your version of SSH has PKCS11 support.

3 Comments

Adding gmond as a service in Cygwin

Cygwin

If for some reason you have Windows running as part of a cluster, like as a node in a Selenium Grid, it is nice to be able to monitor it. A frequently used monitoring suite for clusters is Ganglia. Ganglia, unfortunately, doesn’t have a native Windows binary. Thankfully, it can be compiled and installed in Cygwin. The instructions for doing so are included in the Ganglia tarball (in README.WIN). Instructions that aren’t included are how to run gmond as a Windows service.

After installing Ganglia, you can add gmond as a Windows service by doing the following:

No Comments
« Older Posts