view release on metacpan or  search on metacpan

lib/Arc/Connection/Server.pod  view on Meta::CPAN

=head1 NAME

Arc::Connection::Server - Class to handle one connection on the server side 

=head1 DESCRIPTION

ARC allows non-privileged users to run privileged commands on the server.
The server decides if the user is allowed to run this command through ACL.

This file is a part of the Perl ARCv2 module suite. ARCv2 is a 
rewrite of ARC by R.Toebbicke, CERN, Switzerland in Perl. 

=head1 ABSTRACT

From ARC by R. Toebbicke, modified by me:
User requests are shipped from a client machine to a server using a
SASL-authenticated socket connection. The purpose is to convey
requests such as privileged commands (e.g. AFS, Crontab) to be executed on the
server under appropriate privileges. Given that all privileges are
confined to the server and the server can be programmed as to filter and
check the command to be executed, the client machine can be less trusted
than the server.

Because ARC-v1-Commands are written in perl anyway, implementing the client/server
in perl makes sense. Platform-independence and "easy-to-read" source code are welcome
too. This package provides two perl command line scripts (arcx, arcxd). They can
be used for working with the ARC server from the command line, resp. to start the
server.

=head1 SYNOPSIS

Arc::Connection::Server - Server handle for ARCv2.
This class is called by Arc::Server for each incoming connection.


=head1 Class VARIABLES

=head3 PUBLIC MEMBERS

=over 2

=item commands 

B<Description>: hash of assignment between B<Command Name> and B<Command Class>. See L<Arc::Command>

B<Default value>: undef

=item logfileprefix I<reimplemented from Arc>

B<Default value>: "server"

=item sasl_cb_checkpass 

B<Description>: Callback for SASL (if PLAIN (or equal) mechanisms are used). See Authen::SASL(::Cyrus).

=item sasl_cb_getsecret 

B<Description>: Callback for SASL (if PLAIN (or equal) mechanisms are used). See Authen::SASL(::Cyrus).

B<Default value>: ""

=item sasl_mechanisms 

B<Description>: array of allowed SASL mechanisms

B<Default value>: undef

=back 

=over 2

=item protocol I<inherited from Arc::Connection>

B<Description>: Which protocol is used (0 = ARC/2.0, 1 = ARC/2.1)

B<Default value>: undef

=item service I<inherited from Arc::Connection>

B<Description>: name of the server (for SASL)

B<Default value>: undef

=item timeout I<inherited from Arc::Connection>

B<Description>: timeout for all connections (ARCv2 and command) in seconds

B<Default value>: undef

=back 

=over 2

=item logdestination I<inherited from Arc>

B<Description>: Where should all the log output go to ('stderr','syslog')

B<Default value>: 'syslog'

=item loglevel I<inherited from Arc>

B<Description>: loglevel is combination of bits (1=AUTH,2=USER,4=ERR,8=CMDDEBUG,16=VERBSIDE,32=DEBUG) see _Log method

B<Default value>: 7

=back 

=over 2

=back 

=head3 PROTECTED MEMBERS

=over 2

=item _realm 

B<Description>: Name of the SASL realm, if the user is from the default realm, this is empty

B<Default value>: ""

=back 

=over 2

=item _authenticated I<inherited from Arc::Connection>

B<Description>: Are we authenticated

=item _cmdclientsock I<inherited from Arc::Connection>

B<Description>: IO::Socket for the command connection (encrypted)

B<Default value>: undef

=item _cmdparameter I<inherited from Arc::Connection>

B<Description>: parameter after the command

B<Default value>: undef

=item _connected I<inherited from Arc::Connection>

B<Description>: are we connected

=item _connection I<inherited from Arc::Connection>

B<Description>: IO::Socket for the ARCv2 Connection

B<Default value>: undef

=item _expectedcmds I<inherited from Arc::Connection>

B<Description>: array, which ARCv2 protocol commands are allowed to come next

B<Default value>: undef

=item _select I<inherited from Arc::Connection>

B<Description>: IO::Select for the ARCv2 Connection

B<Default value>: undef

=item _username I<inherited from Arc::Connection>

B<Description>: username extracted from SASL

B<Default value>: "anonymous"

=back 

=over 2

=item _error I<inherited from Arc>

B<Description>: contains the error message

B<Default value>: undef

=item _syslog I<inherited from Arc>

B<Description>: log to syslog or to STDERR

B<Default value>: 1

=back 

=over 2

lib/Arc/Connection/Server.pod  view on Meta::CPAN

B<Returns:> always true


B<Example:>

$arc->Quit();


=item tonne (  ) 

B<Description>: See source code for this method. /dev/null for unwanted output.


=back 

=over 2

=item clean (  ) I<inherited from Arc::Connection>

=item IsConnected (  ) I<inherited from Arc::Connection>

B<Description>: are we connected?


B<Returns:> true, if the ARCv2 control connection is connected, otherwise false


B<Example:>

last unless $arc->IsConnected;


=back 

=over 2

=item DESTROY (  ) I<inherited from Arc>

B<Description>: Destructor


=item IsError (  ) I<inherited from Arc>

B<Description>: User function to get the error msg.


B<Returns:> the error message if any otherwise undef


B<Example:>

unless (my $err = $arc->IsError()) { .. } else { print STDERR $err; }


=item Log ( $facility, ... (message) ) I<inherited from Arc>

B<Description>: Log function.
Logs messages to 'logdestination' if 'loglevel' is is set appropriatly.
loglevel behaviour has changed in the 1.0 release of ARCv2, the "Arc"-class can export
LOG_AUTH (authentication information), LOG_USER (connection information), LOG_ERR (errors), 
LOG_CMD (ARCv2 addition internal command information), LOG_SIDE (verbose client/server-specific
information), LOG_DEBUG (verbose debug information). It possible to combine the 
levels with or (resp. +) to allow a message to appear when not all loglevels are 
requested by the user.
Commonly used for logging errors from application level.


B<Returns:> always false


B<Example:>

return $arc->Log(LOG_ERR,"Message");


=item new ( %hash, key => val, ... ) I<inherited from Arc>

B<Description>: Constructor. 
Initializes the object and returns it blessed.
For all sub classes, please override C<_Init> to check the 
parameter which are passed to the C<new> function. This
is necessary because you are not able to call the the new method of a
parent class, when having a class name (new $class::SUPER::new, does not work.).


B<Returns:> blessed object of the class


B<Example:>

my $this = new Arc::Class ( key => value, key2 => value2 );


=back 

=over 2

=back 

=head3 PROTECTED METHODS

=over 2

=item _Auth (  ) 

B<Description>: send the available SASL mechanisms.
Protocol command: AUTH <comma-seperated list of SASL mechansims>\r\n


B<Returns:> true when succesful, otherwise false


B<Example:>

$this->_Auth();


=item _Authtype (  ) 

B<Description>: tell the client, which SASL mechanism is used.