Sounds like a perfect SSH case to me....
I'm working on a project where we're using lots of SSH tunnels to encrypt
traffic between servers, and it's so easy.
From: Donncha O Caoimh [mailto:donncha.ocaoimh at tradesignals.com]
Sent: 18 September 2000 10:07
Subject: [ILUG] server to server security and auth.
Has anyone done any work on communicating between servers using HTTP?
I'm working on providing an API that developers can use to access
various services on Tradesignals.com but has to be as secure as
possible. SSL is a possibility but it's likely that our partners won't
have SSL capable programs on their servers.
Send username and password with every request. (Really bad I know!)
Generate a one-time password/identifier using a known algorithm+time of
day+password (a bit over the top! we'd have to implement solutions for
Remote server logs in to our server, receives a session ID which is
valid for X hours and uses the session ID in any request for that
Use the IP address of the remote server for auth.
The idea here is that whatever system we use has to be as simple as
'Course, if I had my way, we'd use SSL or public key
Comments & ideas welcome!
Irish Linux Users' Group: ilug at linux.iehttp://www.linux.ie/mailman/listinfo/ilug for (un)subscription information.
List maintainer: listmaster at linux.ie
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!