Carel c.pCO, Руководство пользователя, Страница: 51 / 64

51
ENG
c.pCO sis tem a + 0300057EN re l. 1.2 - 29.05.2017
9. ACCESS MANAGEMENT FOR IP SERVICES
c.pCO controllers integrate a Web Server and a FTP Server:
•
Web server: used to access the files (HTML pages, images, JavaScript
code, etc.) stored under the /HTTP/ directory of the public partition in
the file system. These pages can show dynamic contents generated
by CGI calls (Common Gateway Interface), managed by the controller
firmware in order to read/write variables of the application and create
logs and custom dynamic pages. These pages are accessed in a LAN by
using a browser, entering the c.pCO controller IP address or hostname;
•
FTP server: used to access the public partition in the file system, to
read, edit, create and delete files and directories, including web pages.
FTP can also be used to transfer a .ap1 file, for example, to update the
image of the operating system or the application program. The files are
accessed using an FTP client, such as “FileZilla”.
For protecting the contents of the public file system against unauthorised
access, the system administrator can create different users, and assign
each user different access profiles, differentiated for each service and
adapted to the individual directory.
Access configuration is performed in two steps
1.
create users in c.design;
2. create authorisation files in the directories of the public file system
that need to be protected.
9.1 Accounts management
c.pCO does not have any account configured by default, consequently
the entire public file system has read/write access to the default user
(“anonymous”) and web access without authentication. This simplifies
the operations for first installation of the application program and web
pages via FTP/HTTP protocol. Subsequently, accounts can be created
so as to restrict access to the public file system. The accounts who can
access the IP services are created in c.design. Open c.design and access
the configuration editor.
Fig. 9.a
Click “c.pCO Config. Editor”: the user configuration page will be shown.
Enter the user name and password and confirm by clicking “Add user” for
each new user.
Fig. 9.b
Example: the following three users have been created:
User name Password
dave davepasswd
bryan bryanpasswd
ron ronpasswd
Select the directory where the application program files are located and
click “Upload” to load these accounts into the c.pCO controller.
Note:
•
max number of users: 5;
•
max number of characters in the user name: 15;
•
max number of characters in the password: 15;
•
in addition to the users saved in the database, the FTP server retains
the default user, called “anonymous”. This special user allows public
access to certain directories and to new c.pCO controllers without any
users configured. The anonymous user does not require authentication
(any password can be entered) and access will be restricted to the
directories that have no authorisation files (ftaccess, as illustrated
below).
The authorisation files contain a list of users who can access the current
directory. Only the users listed in the authorisation file can access the
corresponding directory.
Note: an authorisation file only prevents access to the files in the
directory where this is located, and not the files in any sub-directories. To
disable access to the various sub-directories, the authorisation file needs
to be copied to each of these.
The authorisation file is a simple text file, called:
•
“htaccess”, when it authorises users of web server services;
•
“ftaccess”, when it authorises users of FTP server services.
A uthorisation file structure
The authorisation file contains a list of user names who are authorised to
access the directory in question, one on each line. There is no extension
(e.g. ".txt”).
Example: the authorisation file for the three users created previously will
have the following layout, and be called “ftaccess” or “htaccess”.
ftaccess/htaccess
dave
bryan
ron
Whenever a user needs to access a file (web) or directory (FTP), the
following procedure is applied to grant/deny access:
1.
verify whether the authorisation file (htaccess or ftaccess) exists in the
requested directory. If no file exists, access is granted;
2.
if the file exists, this is opened and read sequentially to check whether the
user making the request is included in the list; if not, access is denied;
3.
if the user is included in the authorisation file, the system looks up the
user name in the user database. If not found, access is denied;
4.
if the user is known, authentication by password is required; if the
password is correct, access is granted.