LSTSRV-L Archives

LISTSERV Site Administrators' Forum

LSTSRV-L

Options: Use Monospaced Font
Show Text Part by Default
Show All Mail Headers

Topic: [<< First] [< Prev] [Next >] [Last >>]

Print Reply
Valdis Kletnieks <[log in to unmask]>
Tue, 16 Nov 1999 03:34:42 -0500
text/plain (23 lines)
Has anybody ever gotten the wa.cgi code to use https: SSL connections, and
if so, how did you do it?

We have an "issue" locally in that we *know* that users will insist on
using the same password for Listserv and for all our OTHER
authentication needs.  As a result, some security on those transactions
that use a "personal password" would be very nice.

Cursory examination indicates that wa.cgi seems to have at least SOME
support for it (actually, running 'strings' on the binary found a few
places where "http%s://" is used, hinting it wants to be able to select
http/https.

Complicating matters is the obvious point that we'd want to be
selective, as not ALL calls to wa.cgi require SSL - only the ones we
consider sensitive.  This could get interesting, given the way wa.cgi
drives the "next page" function with heavy use of CGI variables - keep
your eye on the &X= and &Y= all over the place.. ;)

                                Valdis Kletnieks
                                Operating Systems Analyst
                                Virginia Tech

ATOM RSS1 RSS2