Write your own Linux server part two

David M Williams
Monday, 20 August 2007 21:18

Business IT - Open Source

Security and debugging

Given this daemon creates user accounts you will appreciate it must be protected from being used by others who do not have genuine authority to do so. We must take some steps to protect it. In this case, the best form of protection is isolation from external networks. However, we do take some steps in the program code to provide protection by obscurity.

Specifically, when the client first connects, the daemon merely echoes the date and time to appear like a harmless service. The connecting client must now pass a secret password to the server to proceed. This is defined in dwserv.h as follows:

#define SECRET_PASSWORD "allyourbasearebelongtous"

Of course, a client program (like a PHP form on an intranet) needs to have the secret password (in order to pass it to the server). So, if you change the password in the server, then you must change it in the client as well.

To provide some further security, the server does not return any messages to the client apart from error messages and output of requests to return all the e-mail aliases or groups for a given login ID. This is unlike more chatty protocols like SMTP which even provides help!

Despite being so mute, to aid in debugging, a log file can be switched on which will track all connections made and commands issued. A command-line flag can turn this on, but the best way is described in the following section.

Launching the daemon at system startup

The server is a 24-hour process, designed to just run and respond to requests as they are received. For this reason, it is best if the server can be set running at system start-up time.

A script, 99dwsvr, is included which can be placed in the /etc/rc2.d directory hierarchy. In this directory one finds shell programs that set server processes running at startup - just like ours. The programs also terminate server processes when the system is shutting down or changing run-level. The scripts all work in a consistent fashion - giving them a parameter of start starts the process; giving a parameter of stop stops the process.

Our shell script does just this. It also lets some important flags be set easily, such as the port number, and whether to turn logging on or not.

DWSERV_DIR=.

# Edit the following to change the port number that dwserv
# runs at. Any client program must specify this port number to connect.
PORT=5000

# Edit the following to increase or decrease the connection queue. This
# probably need not be touched unless dwserv is expected to
# receive many simultaneous connections.
QLEN=5

# Turn on or off logging - use 'on' or 'off'
LOG=on

# Edit the following to specify where the logfile is to be stored - this
# will only take effect if logging is switched on (above).
LOGFILE=/tmp/dwsvr.log

# Edit the following to specify if verbose logging should be performed.
# This will create a larger log file but will give much more information
# about what is happening - use 'yes' or 'no'
VERBOSE=yes

All you need to do with 99dwsvr is copy it into the /etc/rc2.d directory area. Your Linux server will call it, itself, when necessary. You can also call it manually to start and stop the server by executing either ./99dwsvr start or ./99dwsvr stop like so

# ./99dwsvr start
dwserv running
# ./99dwsvr stop
dwserv stopped