# Questions about DRb and security

**URL:** <https://www.ruby-forum.com/t/questions-about-drb-and-security/79011>\
**Category:** Ruby\
**Created:** [December 11, 2006, 3:51pm UTC](https://www.ruby-forum.com/t/questions-about-drb-and-security/79011 "2006-12-11T15:51:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![zenzei](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/7bcc69/32.png) [@zenzei](https://www.ruby-forum.com/u/zenzei)\
**Post date:** [December 11, 2006, 3:51pm UTC](https://www.ruby-forum.com/t/questions-about-drb-and-security/79011/1 "2006-12-11T15:51:41Z")

</div>

Hello,

apart from running the DRb server over SSL and with $SAFE = 1, I would  
like  
to add some user authentication to the process. What I was thinking, is  
create a proxy object that would forward the server object if the user  
and  
password is right. Here is a mockup :

class AuthenticationProxy  
def initialize(object, user, pass)  
@object, @user, @pass = object, user, pass  
end

def get\_server\_object(user, pass)  
if user == @user and pass == @pass  
return @object  
else  
raise ‘could not authenticate’  
end  
end  
end

This class would be used in the following context :

require ‘drb’  
ap = AuthenticationProxy.new([1,2,3], ‘someuser’, ‘somepassword’)  
DRb.start\_service(nil, ap)  
DRb.thread.join

As you see, this is very simple, but I’m wondering if this is enough.  
For  
example, how does the client know the reference to [1,2,3]. Could it be  
guessed in some way, so that it could bypass the AuthenticationProxy ?

Please let me know 🙂

Cheers,  
zimbatm

---

<div class="post-metadata">

**Author:** ![zenzei](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/7bcc69/32.png) [@zenzei](https://www.ruby-forum.com/u/zenzei)\
**Post date:** [December 11, 2006, 10:01pm UTC](https://www.ruby-forum.com/t/questions-about-drb-and-security/79011/2 "2006-12-11T22:01:50Z")

</div>

2006/12/11, Pit C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

> Regards,  
> Pit

Good point Pit 🙂 I guess that there are other security issues

---

<div class="post-metadata">

**Author:** ![zenzei](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/7bcc69/32.png) [@zenzei](https://www.ruby-forum.com/u/zenzei)\
**Post date:** [December 11, 2006, 6:18pm UTC](https://www.ruby-forum.com/t/questions-about-drb-and-security/79011/3 "2006-12-11T18:18:05Z")

</div>

Jonas P. schrieb:

> …  
> As you see, this is very simple, but I’m wondering if this is enough. For  
> example, how does the client know the reference to [1,2,3]. Could it be  
> guessed in some way, so that it could bypass the AuthenticationProxy ?

Jonas, I’m no DRb expert, but this client code can get access to the  
real object without authenticating itself:

@proxy = DRbObject.new( nil, URI )  
class \<\< @proxy  
undef\_method :instance\_variable\_get  
end  
@proxy.instance\_variable\_get("@object") # =\> [1, 2, 3]

It is necessary to undefine #instance\_variable\_get for the local @proxy  
object, so that the message is forwarded to the AuthenticationProxy on  
the server side.

Regards,  
Pit

---

<div class="post-metadata">

**Author:** ![zenzei](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/7bcc69/32.png) [@zenzei](https://www.ruby-forum.com/u/zenzei)\
**Post date:** [December 15, 2006, 12:07am UTC](https://www.ruby-forum.com/t/questions-about-drb-and-security/79011/4 "2006-12-15T00:07:24Z")

</div>

On Dec 11, 2006, at 09:50, Jonas P. wrote:

> apart from running the DRb server over SSL and with $SAFE = 1, I  
> would like  
> to add some user authentication to the process. What I was  
> thinking, is  
> create a proxy object that would forward the server object if the  
> user and  
> password is right.

Write a new DRbProtocol that must send user/password first.

–  
Eric H. - removed\_email\_address@domain.invalid - [http://blog.segment7.net](http://blog.segment7.net)

I LIT YOUR GEM ON FIRE!