Web Security

- The principle of least privilege is used to provide more security to the computer programs.

- The principle allows the designing of the program such that any unauthorized access is not allowed and only the person who owns the program will be able to access it.

- The services provided should be able to access only those products that need the services.

- Web servers that are involved in responding the queries of the web users provide only accessing to the HTML files that will serve the purpose of the programs.

- Computer programs should be made such that it provides secure features of logging into the program with proper authentication.

- The valet keys are used to provide more security by not letting the processes to use the more resources then allowed.

- The valet keys allow the use of the resources that is necessary for the process to finish the job.

- Valet keys also limit the use of accesses that is being made on the system by the process.

- Valet keys lock the resources until the demand is being done to provide them to any process.

- The valet key system can’t be accessed as it is also remains locked by the system and the permission is given to only those who remain the owners of it.

- Least privilege principles ensure that the process gets only the limited resources at the beginning.

- The process will have only that many resources that will allow it to finish a task or job in a given time.

- The principle defines the use of Valet keys that is to ensure the security of the system by locking the processes with limited number of resources.

- The web should be given access to only HTML files to remain more secure on the Internet and all should be secure.

- The user should be given the permission only to do their job and should be provided with that many resources only.

- SimpleWebServer provides the storage space for the files that can be stored having the permissions with them.

- System administrator can run the SimpleWebServer by only having the elevated privileges.

- Elevated privileges allow the users not to access the web server and just access the system that is given to them and the process that they have permission of.

- Using the special privileges the users can’t access any files on the system that is not allowed for them to access.

- The sensitive documents can be controlled using the directory structure of the system of the tree.

GET ../../../../etc/shadow HTTP/1.0

- GET is the method that is used to access the files from the server it works the same way like PUT.

- GET method allows the information to be taken from the web server and send it to the user’s browser.

- The directory /etc/ consists of a shadow file that is having the special privileges and only accessible that is having the permissions.

- /etc/shadow consists of all the passwords and usernames that can be accessed and made changes to.

- The file 1.0 of HTTP can be specified by the constructor FileReader and it can attempt to open the file.

- Fail safe stances are used to provide the security in case of any failure occurs in the system.

- Fail safe stances works on the same principle of elevators and it always have a backup planned in case of system failure.

- The security can be breached in case of firewall of the system fails and it doesn’t allow any traffic to come.

- The security issues can be for the user who is intended to access the resources of the system and by default the access is being denied.

- There is a level of security being provided in case the system fails or one or more components fails in the system.

- Fail-safe approach defines the level that divides the security such that it is safe even in case the system is failed.

- The fail safe approach doesn’t allow an attacker to take the advantage by breaking in the system and crashes out.

- This approach allows the web server to perform the routines even if the system runs out of the memory in case of any attack.

- The system in attacks doesn’t skip the access to the control check or it doesn’t skip serving any document requested.

- Fail safe approach can force the web server to run of the memory and have a DoS attack.

- Infinite file consists of random bits of code that is stored in /dev/random file used to generate the cryptographic keys.

- Infinite file consists of the source of infinite data that can be used to provide the response in easy manner.

- Web server consists of the file that is received by the server in this format GET //dev/random HTTP/1.0.

- Web server provides the continuous data that can be read from /dev/random/ before the web server can run out of the memory.

- The server crashes out in case it runs out of the memory due to the infinite file type and it is very essential in case of the web security.

- Web servers can be infiltrated using the command shell by an attacker to read the HTML files that is getting transferred.

- If the set-uid scripts are not proper and bad then the infiltration can happen by the attacker.

- The processes are not given proper permissions so that the password can be changed by using the “passwd” command to change the password of the system.

- This also authenticates the user for accessing the system and the files on it containing the data.

- The program that is used in the operating system doesn’t follow the principle of least privilege and lead to security issues.

- The infinite file error can be solved when the data will be read continuously from the file.

- The error can be solved by using the keys that provide only the resources that are required.

- The following program is as follows:

osw.write ("HTTP/1.0 200 OKnn");

while (c != -1) {

sb.append((char)c);

c = fr.read();

}

osw.write (sb.toString());

- This converts the requested file in such a way that if the file exists it shows the messages as ok otherwise it shows an error.

- Limited file access is to be given to the file to remove the error from the infinite file type.

- Security features are very essential in the system as it provides an overall security of the system by applying the patches and the services that keeps the unwanted access away.

- The security features included are as follows:

- Use of algorithms in relation to, the security and the system to, solve the problem of the security.

- Use of SSL or any encryption method to, protect the system from intrusion or any other attack.

- Use of SSL in the SimpleWebServer that doesn’t provides the protection against the DoS attack and doesn’t allow the accessing to, be done using the /etc/shadow.

- The secure by default provides the automatic security scripts and applications that save the system from any intrusion.

- This includes the hardening of the system in which all the unnecessary services becomes off by default.

- These allow the process to use fewer resources and allow the process to run in their own shell within their own assigned memory.

- It enables fewer features that explain that if more features are enabled then the chances of being exploited are more with less security is being provided.

- System uses the policy of secure by default to secure the programs and application from unwanted access.

- Secure socket layer is used to provide the security protocol used by the Internet to provide an easy access to the websites.

- It provides a way to validate or identify the website by creating the information file and making the accessing possible.

- It creates an encrypted connection that provides the sending of the data from one source to another using the SSL.

- SSL provides a way to ensure that the security is being provided to the transaction and the data in use.

- The lock is used to display the browsers connection is closed or opened on the secure channel of SSL or TLS.

- SimpleWebServer Object includes the steps that need to be followed to properly use it. The steps are as follows:

- The initialization of the variable takes place that holds the port number for the web server.

- The initialization allows the web server to listen on the port number that is being defined.

- The web server receives the communication through the port that is being mentioned using the object.

- ServerSocket is initialized to establish the connection so that web server and the client can interact with each other.

- This involves redirecting of the content from one place to another only when the sockets on both the sides are opened.