Brunel Logo
blank
line
Home Page


Overview of the Connection Management System

This system records requests for network service and handles the flow of work to satisfy those requests. The current version only deals with requests from students in Hall, who are required to pay a fee before they get connected. The normal workflow is thus:

  1. Student applies for service using the web
  2. Student sends payment, either by post or as card details on the web
  3. Payment is processed by designated staff in Computing Services
  4. Network staff make the connection
  5. At the end of the paid period, network staff disconnect again

Sometimes, the first two or three stages are handled by Computing Services staff during Registration Arena.

At any time during the connection period, the student has the option to extend the connection to cover the following semester or vacation. This can be done without payment of a second connection fee provided the connection is in the `connected' state at the time payment is made.

State Diagram

Use of the Web

Application through the Web is essential to reduce the queues that previously built up at the networking office.

To assure all users that their data is secure, we use a `secure webserver' which causes all data to be encrypted when it passes across the network. The certificate for this server comes from Thawte Consulting who were chosen because their certificates are accepted by a wide range of Web browsers without special configuration.

All web pages that contain data about users or connections require a username and password, which are checked against the standard Brunel system. Unfortunately there does not seem to be a way to `logout' of a Web site and make a browser forget a password without having to exit the browser.

The Web server is a standard Apache one and we are using Perl CGI scripts. Perl is run in `taint' mode for security, and all data received from the web is carefully checked.

The Perl code is divided into sections:

connections.cgi
This is a very small front-end script that sets parameters and calls on ConnWeb.pm to do most of the work. It is installed set-uid to a management user (ccmncdm).
ConnWeb.pm
This handles the main CGI processing, calling on other modules for specific services. Most policy is implemented here, along with page generation and e-mail generation. There is no embedded HTML in the Perl scripts: they use template files to generate all output.
ConnDB.pm
This is the interface to the database. It hides the details of database calls and structure from ConnWeb.pm (though not as cleanly as I would like!) Standard Perl DBI calls are used to invoke SQL operations.
ConnLog.pm
Logging procedures. Logging is extensive for security and error diagnosis

Cron jobs

There are several routine tasks that are done by cron jobs. Most run as the management user ccmncdm:

  • mail-reminders.pl runs twice per week to remind users who have requested service that they need to send payment before the connection will be made.
  • mail-expiry-reminders.pl runs once per week to remind users whose connections will expire in the next 30 days that they have the option to renew the connection.
  • make-halls-mailing-list.pl runs every night to update the halls-pc mailing list.

One cron job runs as the database manager (ccmndb1):

  • export-all-tables runs every night to save a text-file version of every table in the database. Seven sets of files are kept so the state of the database can be restored to any day in the past week.

The Database

We use MySQL - an open-source relational database. It runs on the secure webserver machine under a separate username from the rest of the system (ccmndb1) and implements its own security controls. It is set up to only allow the username running the CGI scripts to access the data.

If detailed inspection and data tweaking is needed, the mysql program should be run as ccmndb1 on the secure webserver. This should be a last resort, as it is easy to ruin the consistency of the database with raw SQL commands!

Source code

The source code is under /usr/src/local/NET/connections


Brunel University, Uxbridge, Middlesex UB8 3PH, United Kingdom
Telephone: (01895) 274000 (UK); +44 1895 274000 (International)

Page maintained by Computing Services Networks Group
© Brunel University, August 1999