From: Jonas Pfenniger <zimbatm@...>
Date: 2006-12-11T23:50:43+09:00
Subject: Questions about DRb and security

------=_Part_51423_9540018.1165848639638
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Hello,

apart from running the DRb server over SSL and with $SAFE = 1, I would like
to add some user authentication to the process. What I was thinking, is
create a proxy object that would forward the server object if the user and
password is right. Here is a mockup :

class AuthenticationProxy
  def initialize(object, user, pass)
    @object, @user, @pass = object, user, pass
  end

  def get_server_object(user, pass)
    if user == @user and pass == @pass
      return @object
    else
      raise 'could not authenticate'
    end
  end
end

This class would be used in the following context :

require 'drb'
ap = AuthenticationProxy.new([1,2,3], 'someuser', 'somepassword')
DRb.start_service(nil, ap)
DRb.thread.join

As you see, this is very simple, but I'm wondering if this is enough. For
example, how does the client know the reference to [1,2,3]. Could it be
guessed in some way, so that it could bypass the AuthenticationProxy ?

Please let me know :)

Cheers,
  zimbatm

------=_Part_51423_9540018.1165848639638--