Overview of the Connection Management System
This system records requests for network service and handles the flow
of work to satisfy those requests.
The current version only deals with requests from students in Hall,
who are required to pay a fee before they get connected.
The normal workflow is thus:
- Student applies for service using the web
- Student sends payment, either by post or as card details on the web
- Payment is processed by designated staff in Computing Services
- Network staff make the connection
- At the end of the paid period, network staff disconnect again
Sometimes, the first two or three stages are handled by Computing Services staff
during Registration Arena.
I 3
At any time during the connection period, the student has the option to
extend the connection to cover the following semester or vacation. This
can be done without payment of a second connection fee provided the
connection is in the `connected' state at the time payment is made.
E 3
Use of the Web
Application through the Web is essential to reduce the queues that
previously built up at the networking office.
To assure all users that their data is secure, we use a `secure webserver'
which causes all data to be encrypted when it passes across the network.
The certificate for this server comes from
Thawte Consulting
who were chosen because their certificates are accepted by a wide range
of Web browsers without special configuration.
All web pages that contain data about users or connections require
a username and password, which are checked against the standard Brunel
system.
Unfortunately there does not seem to be a way to `logout' of a Web site
and make a browser forget a password without having to exit the browser.
The Web server is a standard Apache one
and we are using Perl CGI scripts.
Perl is run in `taint' mode for security, and all data received from
the web is carefully checked.
The Perl code is divided into sections:
- connections.cgi
- This is a very small front-end script that sets parameters and
calls on ConnWeb.pm to do most of the work.
D 4
It is installed set-uid to a management user.
E 4
I 4
It is installed set-uid to a management user (ccmncdm).
E 4
- ConnWeb.pm
- This handles the main CGI processing, calling on other modules for
specific services. Most policy is implemented here, along with page
generation and e-mail generation.
There is no embedded HTML in the Perl scripts: they use template files
to generate all output.
- ConnDB.pm
- This is the interface to the database. It hides the details of
database calls and structure from ConnWeb.pm
(though not as cleanly as I would like!)
Standard Perl DBI calls are used to invoke SQL operations.
- ConnLog.pm
- Logging procedures. Logging is extensive for security and error
diagnosis
I 4
Cron jobs
There are several routine tasks that are done by cron jobs.
Most run as the management user ccmncdm:
- mail-reminders.pl runs twice per week to remind users who have
requested service that they need to send payment before the connection
will be made.
- mail-expiry-reminders.pl runs once per week to remind users whose
connections will expire in the next 30 days that they have the option
to renew the connection.
- make-halls-mailing-list.pl runs every night to update the halls-pc
mailing list.
One cron job runs as the database manager (ccmndb1):
- export-all-tables runs every night to save a text-file version
of every table in the database. Seven sets of files are kept so the
state of the database can be restored to any day in the past week.
E 4
The Database
We use MySQL - an open-source
D 5
relational database. It runs under a separate username from the rest of
E 5
I 5
relational database. It runs on the secure webserver machine
under a separate username from the rest of
E 5
D 4
the system and implements its own security controls. It is set up
E 4
I 4
the system (ccmndb1) and implements its own security controls. It is set up
E 4
to only allow the username running the CGI scripts to access the data.
I 4
If detailed inspection and data tweaking is needed, the mysql
D 5
program should be run as ccmndb1. This should be a last resort, as it is
E 5
I 5
program should be run as ccmndb1 on the secure webserver.
This should be a last resort, as it is
E 5
easy to ruin the consistency of the database with raw SQL commands!
E 4
I 2
Source code
The source code is under /usr/src/local/NET/connections
E 2
Brunel University, Uxbridge, Middlesex UB8 3PH, United Kingdom
Telephone: (01895) 274000 (UK); +44 1895 274000 (International)
Page maintained by Computing Services Networks Group
© Brunel University, August 1999
|