Copyright 2000, International Business Machines Corporation and others.
All Rights Reserved.

This software has been released under the terms of the IBM Public
License.  For details, see the LICENSE file in the top-level source
directory or online at http://www.openafs.org/dl/license10.html

AFS Web Security Pack for the Apache Web Server, Version 1.0


Release Notes

I. Introduction

The AFS Web Security Pack is an extension available for selected Web servers
that enables system administrators to provide secure access via a
Web browser to documents stored in the AFS filespace. This document
provides information specific to this release of the AFS Web Security Pack.

Note: Due the long filenames and file extensions used for the AFS Web
Secure distribution files, download of the AFS Web Secure product to
a PC sometimes results in incorrect filenames. Note that all AFS Web
Secure distribution files are g-zipped tar files, even if the *.tar.gz
file extension is lost during the download process.

II. Installation Prerequisites

Note: If you have installed a previous version of the AFS Web Security Pack,
you must first remove the previous version, including any modifications made
to your Apache Web server configuration and runtime configuration files
before installing this version of the product.

Your system must meet the following software and disk space requirements
to install this version of the AFS Web Security Pack.

Operating system:	 Solaris 2.5.1, AIX 4.2x, AIX 4.3, or AIX 4.3.1
Web server:		 Apache 1.2.6 or Apache 1.3.1
AFS (client):		 AFS Client 3.4a
Disk Space:		 650 KB

Note: Due to security considerations, OpenAFS strongly recommends that the
AFS Web Security Pack be used only on a server enabled with Secure Sockets
Layer (SSL).


IV. Known Defects and Limitations

* Due to a preexisting problem in the AFS UNIX product, the Apache
server Fancy Indexing option does not function as expected when AFS
directories are displayed. If the Fancy Indexing option is enabled
on the Apache server, when a user initially browses an ACL-protected
directory (with "system:anyuser l" access), the user is able to see
file details for directories and links, but not for files. Once the
user selects a file and enters a username and password, details for
the files are then displayed. This problem is not caused by the AFS Web
Security Pack or the Apache server, but is due to a defect in the UNIX-based
AFS code. We are working to address this problem and will make an
announcement when a corrected version is available. In the interim,
please be aware of this limitation as you use the AFS Web Security Pack.

*If the AFS Web Security Pack is used on the Apache server version 1.3.1, user
directories cannot be directly accessed through the use of a special character
such as a tilde (~) despite use of the Apache server User Directory directive.

VII. AFS Web Security Pack Documentation

Postscript and HTML versions of the documentation for the AFS Web Security
Pack are available in the doc directory.

VIII. Additional Information about Apache and SSL

The following sites on the World Wide Web provide additional information
about the Apache Web Server and SSL.

* Apache Home Page http://www.apache.org
* Stronghold Home http://www.c2.net
* Stronghold International http://www.int.c2.net
* Apache-SSL Home http://www.apache-ssl.org
* SSLeay FAQ http://www.psy.uq.edu.au:8080/~ftp/Crypto/
