Appendix E
Server Management Using HP Support Anywhere
105
By installing user ID and password protection, you can set security down to the
web page level. However, user IDs and passwords are a minimal security solution.
For increased effectiveness, you should consider combining passwords and IDs
with other strategies such as IP restriction and encryption.
IP Address Restriction
Depending on your particular web server configuration, you may be able to use an
IP address scheme to tighten up security. More secure than simple password
locking, IP restriction allows you to secure access to individual web documents, or
to whole directories on a particular web server.
This scheme works by controlling browser access. Only browsers connecting from
certain designated IP (Internet) addresses, IP subnets, or domains are allowed
access. Used alone, this method has drawbacks and can be thwarted by competent
hackers using suitable equipment. Therefore, as a rule, IP address restriction
should be combined with user ID checking (passwords). In this way, confirmation
of a legal user’s name and password can be clearly established first.
Encryption
As an Internet security solution, encryption provides the best overall web security
for the kind of information usually transmitted over the Internet. An encryption
method called "public key cryptography" is one such security option to consider.
In a public key system, you encode the text of a message with one key, and use a
separate key for decoding. In practice, the system is simple. You use one key, the
public key, for encoding, and another, the private key, for decoding.
Typically, the public key is widely distributed. The private key, however, is kept
secret, so that the message can only be decrypted by someone in possession of the
private key.
Using this method of encryption, both the request for a document and the
document itself are encrypted to ensure that a text message can be read only by the
intended recipient.
Netscape’s SSL Encryption
Another effective encryption scheme is called Secure Socket Layer (SSL). SSL is
a technology developed by Netscape that encrypts transactions that use the web-
based HTTP, NNTP, and FTP protocols. SSL allows server authentication
(verifying the server’s identity to the client), encryption of data in transit, and
client authentication (verifying the client’s identity to the server).
