docs/htmldocs/using_samba/appa_03.html

   1 <HTML>
   2 <HEAD>
   3 <TITLE>
   4 [Appendix A] A.3 Installing SSLeay</title><META NAME="DC.title" CONTENT=""><META NAME="DC.creator" CONTENT=""><META NAME="DC.publisher" CONTENT="O'Reilly &amp; Associates, Inc."><META NAME="DC.date" CONTENT="1999-11-05T21:41:37Z"><META NAME="DC.type" CONTENT="Text.Monograph"><META NAME="DC.format" CONTENT="text/html" SCHEME="MIME"><META NAME="DC.source" CONTENT="" SCHEME="ISBN"><META NAME="DC.language" CONTENT="en-US"><META NAME="generator" CONTENT="Jade 1.1/O'Reilly DocBook 3.0 to HTML 4.0"></head>
   5 <BODY BGCOLOR="#FFFFFF" TEXT="#000000" link="#990000" vlink="#0000CC">
   6 <table BORDER="0" CELLPADDING="0" CELLSPACING="0" width="90%">
   7 <tr>
   8 <td width="25%" valign="TOP">
   9 <img hspace=10 vspace=10 src="gifs/samba.s.gif"
  10 alt="Using Samba" align=left valign=top border=0>
  11 </td>
  12 <td height="105" valign="TOP">
  13 <br>
  14 <H2>Using Samba</H2>
  15 <font size="-1">
  16 Robert Eckstein, David Collier-Brown, Peter Kelly
  17 <br>1st Edition November 1999
  18 <br>1-56592-449-5, Order Number: 4495
  19 <br>416 pages, $34.95
  20 </font>
  21 <p> <a href="http://www.oreilly.com/catalog/samba/">Buy the hardcopy</a>
  22 <p><a href="index.html">Table of Contents</a>
  23 </td>
  24 </tr>
  25 </table>
  26 <hr size=1 noshade>
  27 <!--sample chapter begins -->
  28
  29 <center>
  30 <DIV CLASS="htmlnav">
  31 <TABLE WIDTH="515" BORDER="0" CELLSPACING="0" CELLPADDING="0">
  32 <TR>
  33 <TD ALIGN="LEFT" VALIGN="TOP" WIDTH="172">
  34 <A CLASS="sect1" HREF="appa_02.html" TITLE="A.2 Requirements">
  35 <IMG SRC="gifs/txtpreva.gif" ALT="Previous: A.2 Requirements" BORDER="0"></a></td><TD ALIGN="CENTER" VALIGN="TOP" WIDTH="171">
  36 <B>
  37 <FONT FACE="ARIEL,HELVETICA,HELV,SANSERIF" SIZE="-1">
  38 <A CLASS="appendix" REL="up" HREF="appa_01.html" TITLE="A. Configuring Samba with SSL">
  39 Appendix A<br>
  40 Configuring Samba with SSL</a></font></b></td><TD ALIGN="RIGHT" VALIGN="TOP" WIDTH="172">
  41 <A CLASS="sect1" HREF="appa_04.html" TITLE="A.4 Setting Up SSL Proxy">
  42 <IMG SRC="gifs/txtnexta.gif" ALT="Next: A.4 Setting Up SSL Proxy" BORDER="0"></a></td></tr></table>&nbsp;<hr noshade size=1></center>
  43 </div>
  44 <blockquote>
  45 <div>
  46 <H2 CLASS="sect1">
  47 <A CLASS="title" NAME="appa-pgfId-985777">
  48 A.3 Installing SSLeay</a></h2><P CLASS="para">
  49 Samba uses the SSLeay package, written by Eric Young, to provide Secure Sockets Layer support on the server side. Because of U.S. export law, however, the SSLeay package cannot be shipped with Samba distributions that are based in the United States. For that reason, the Samba creators decided to leave it as a separate package entirely. You can download the SSLeay distribution from any of the following sites:</p><UL CLASS="itemizedlist">
  50 <LI CLASS="listitem">
  51 <P CLASS="para">
  52 <A CLASS="listitem" NAME="appa-pgfId-985779">
  53 </a><A CLASS="systemitem.url" HREF="ftp://ftp.psy.uq.oz.au/pub/Crypto/SSL/">
  54 ftp://ftp.psy.uq.oz.au/pub/Crypto/SSL/</a></p></li><LI CLASS="listitem">
  55 <P CLASS="para">
  56 <A CLASS="listitem" NAME="appa-pgfId-985781">
  57 </a><A CLASS="systemitem.url" HREF="ftp://ftp.uni-mainz.de/pub/internet/security/ssl">
  58 ftp://ftp.uni-mainz.de/pub/internet/security/ssl</a></p></li><LI CLASS="listitem">
  59 <P CLASS="para">
  60 <A CLASS="listitem" NAME="appa-pgfId-985782">
  61 </a><A CLASS="systemitem.url" HREF="ftp://ftp.cert.dfn.de/pub/tools/crypt/sslapps">
  62 ftp://ftp.cert.dfn.de/pub/tools/crypt/sslapps</a></p></li><LI CLASS="listitem">
  63 <P CLASS="para">
  64 <A CLASS="listitem" NAME="appa-pgfId-985783">
  65 </a><A CLASS="systemitem.url" HREF="ftp://ftp.funet.fi/pub/crypt/mirrors/ftp.psy.uq.oz.au">
  66 ftp://ftp.funet.fi/pub/crypt/mirrors/ftp.psy.uq.oz.au</a></p></li><LI CLASS="listitem">
  67 <P CLASS="para">
  68 <A CLASS="listitem" NAME="appa-pgfId-985784">
  69 </a><A CLASS="systemitem.url" HREF="ftp://ftp.sunet.se/ftp/pub/security/tools/crypt/ssleay">
  70 ftp://ftp.sunet.se/ftp/pub/security/tools/crypt/ssleay</a></p></li></ul><P CLASS="para">
  71 The latest version as of this printing is 0.9.0b. Download it to the same server as the Samba distribution, then uncompress and untar it. You should be left with a directory entitled <I CLASS="filename">
  72 SSLeay-0.9.0b</i>. After changing to that directory, you will need to configure and build the SSL encryption package in the same way that you did with Samba.</p><P CLASS="para">
  73 SSLeay uses a Perl-based <I CLASS="filename">
  74 configure</i> script. This script modifies the Makefile that constructs the utilities and libraries of the SSLeay package. However, the default script is hardcoded to find Perl at <I CLASS="filename">
  75 /usr/local/bin/perl</i>. You may need to change the <I CLASS="filename">
  76 configure</i> script to point to the location of the Perl executable file on your Unix system. For example, you can type the following to locate the Perl executable:</p><PRE CLASS="programlisting"># <CODE CLASS="userinput"><B>which perl</b></code>
  77 /usr/bin/perl</pre><P CLASS="para">
  78 Then modify the first line of the <I CLASS="filename">
  79 configure</i> script to force it to use the correct Perl executable. For example, on our Red Hat Linux system:</p><PRE CLASS="programlisting">
  80 #!/usr/bin/perl
  81 #
  82 # see PROBLEMS for instructions on what sort of things to do
  83 # when tracking a bug -tjh
  84 ...</pre><P CLASS="para">
  85 After that, you need to run the <I CLASS="filename">
  86 configure</i> script by specifying a target platform for the distribution. This target platform can be any of the following:</p><PRE CLASS="programlisting">
  87 BC-16              BC-32              FreeBSD            NetBSD-m86
  88 NetBSD-sparc       NetBSD-x86         SINIX-N            VC-MSDOS
  89 VC-NT              VC-W31-16          VC-W31-32          VC-WIN16
  90 VC-WIN32           aix-cc             aix-gcc            alpha-cc
  91 alpha-gcc          alpha400-cc        cc                 cray-t90-cc
  92 debug              debug-irix-cc      debug-linux-elf    dgux-R3-gcc
  93 dgux-R4-gcc        dgux-R4-x86-gcc    dist               gcc
  94 hpux-cc            hpux-gcc           hpux-kr-cc         irix-cc
  95 irix-gcc           linux-aout         linux-elf          ncr-scde
  96 nextstep           purify             sco5-cc            solaris-sparc-cc
  97 solaris-sparc-gcc  solaris-sparc-sc4  solaris-usparc-sc4 solaris-x86-gcc
  98 sunos-cc           sunos-gcc          unixware-2.0       unixware</pre><P CLASS="para">
  99 For our system, we would enter the following:</p><PRE CLASS="programlisting">
 100 # <CODE CLASS="userinput"><B>./Configure linux-elf</b></code>
 101 CC            =gcc
 102 CFLAG         =-DL_ENDIAN -DTERMIO -DBN_ASM -O3 -fomit-frame-pointer
 103 EX_LIBS       =
 104 BN_MULW       =asm/bn86-elf.o
 105 DES_ENC       =asm/dx86-elf.o asm/yx86-elf.o
 106 BF_ENC        =asm/bx86-elf.o
 107 CAST_ENC      =asm/cx86-elf.o
 108 RC4_ENC       =asm/rx86-elf.o
 109 RC5_ENC       =asm/r586-elf.o
 110 MD5_OBJ_ASM   =asm/mx86-elf.o
 111 SHA1_OBJ_ASM  =asm/sx86-elf.o
 112 RMD160_OBJ_ASM=asm/rm86-elf.o
 113 THIRTY_TWO_BIT mode
 114 DES_PTR used
 115 DES_RISC1 used
 116 DES_UNROLL used
 117 BN_LLONG mode
 118 RC4_INDEX mode          </pre><P CLASS="para">
 119 After the package has been configured, you can build it by typing <CODE CLASS="literal">
 120 make</code>. If the build did not successfully complete, consult the documentation that comes with the distribution or the FAQ at <a href="http://www.cryptsoft.com/ssleay/"><I CLASS="filename">http://www.cryptsoft.com/ssleay/</i></a> for more information on what may have happened. If the build did complete, type <CODE CLASS="literal">
 121 make</code> <CODE CLASS="literal">
 122 install</code> to install the libraries on the system. Note that the makefile installs the package in <I CLASS="filename">
 123 /usr/local/ssl</i> by default. If you decide to install it in another directory, remember the directory when configuring Samba to use SSL.</p><DIV CLASS="sect2">
 124 <H3 CLASS="sect2">
 125 <A CLASS="title" NAME="appa-pgfId-985829">
 126 A.3.1 Configuring SSLeay for Your System</a></h3><P CLASS="para">
 127 The first thing you need to do is to set the <CODE CLASS="literal">
 128 PATH</code> environment variable on your system to include the <I CLASS="filename">
 129 /bin</i> directory of the SSL distribution. This can be done with the following statement:</p><PRE CLASS="programlisting">
 130 PATH=$PATH:/usr/local/ssl/bin</pre><P CLASS="para">
 131 That's the easy part. Following that, you will need to create a random series of characters that will be used to prime SSLeay's random number generator. The random number generator will be used to create key pairs for both the clients and the server. You can create this random series by filling a text file of a long series of random characters. For example, you can use your favorite editor to create a text file with random characters, or use this command and enter arbitrary characters at the standard input:</p><PRE CLASS="programlisting">
 132 cat &gt;/tmp/private.txt</pre><P CLASS="para">
 133 The Samba documentation recommends that you type characters for longer than a minute before interrupting the input stream by hitting Control-D. Try not to type only the characters that are under your fingers on the keyboard; throw in some symbols and numbers as well. Once you've completed the random file, you can prime the random number generator with the following command:</p><PRE CLASS="programlisting">
 134 # ssleay genrsa -rand /tmp/private.txt &gt;/dev/null
 135 2451 semi-random bytes loaded
 136 Generating RSA private key, 512 bit long modulus
 137 ..+++++
 138 .................................+++++
 139 e is 65537 (0x10001)</pre><P CLASS="para">
 140 You can safely ignore the output of this command. After it has completed, remove the series of characters used to create the key because this could be used to recreate any private keys that were generated from this random number generator:</p><PRE CLASS="programlisting">
 141 rm -f /tmp/private.txt</pre><P CLASS="para">
 142 The result of this command is the hidden file .<EM CLASS="emphasis">
 143 rnd</em>, which is stored in your home directory. SSLeay will use this file when creating key pairs in the future.</p></div><DIV CLASS="sect2">
 144 <H3 CLASS="sect2">
 145 <A CLASS="title" NAME="appa-pgfId-985843">
 146 A.3.2 Configuring Samba to use SSL</a></h3><P CLASS="para">At this point, you can compile Samba to use SSL. Recall that in <a href="ch02_01.html"><b>Chapter 2, <CITE CLASS="chapter">Installing Samba on a Unix System</cite></b></a>, we said you have to first run the configure script, which initializes the makefile, before you compile Samba. In order to use SSL with Samba, you will need to reconfigure the makefile:</p><PRE CLASS="programlisting">
 147 ./configure --with-ssl</pre><P CLASS="para">
 148 After that, you can compile Samba with the following commands:</p><PRE CLASS="programlisting"># <CODE CLASS="userinput"><B>make clean</b></code>
 149 # <CODE CLASS="userinput"><B>make all</b></code></pre><P CLASS="para">
 150 If you encounter an error that says the <I CLASS="filename">
 151 smbd</i> executable is missing the file <I CLASS="filename">
 152 ssl.h</i>, you probably didn't install SSLeay in the default directory. Use the configure option <CODE CLASS="literal">
 153 --with-sslinc</code> to point to the base directory of the SSL distribution&nbsp;- in this case, the directory that contains <EM CLASS="emphasis">
 154 include/ssl.h</em>.</p><P CLASS="para">
 155 On the other hand, if you have a clean compile, you're ready to move on to the next step: creating certificates.</p></div><DIV CLASS="sect2">
 156 <H3 CLASS="sect2">
 157 <A CLASS="title" NAME="appa-62097">
 158 A.3.3 Becoming a Certificate Authority</a></h3><P CLASS="para">
 159 <I CLASS="firstterm">
 160 </i>The SSL protocol requires the use of X.509 certificates in the protocol handshake to ensure that either one or both parties involved in the communication are indeed who they say they are. Certificates in real life, such as those use for SSL connections on public web sites, can cost in the arena of $300 a year. This is because the certificate must have a digital signature placed on it by a <I CLASS="firstterm">
 161 certificate authority</i>. A certificate authority is an entity that vouches for the authenticity of a digital certificate by signing it with its own private key. This way, anyone who wishes to check the authenticity of the certificate can simply use the certificate authority's public key to check the signature.</p><P CLASS="para">
 162 You are allowed to use a public certificate authority with SSLeay. However, you don't have to. Instead, SSLeay will allow you to declare yourself a trusted certificate authority&nbsp;- specifying which clients you choose to trust and which clients you do not. In order to do this, you will need to perform several tasks with the SSLeay distribution.</p><P CLASS="para">
 163 The first thing you need to do is specify a secure location where the certificates of the clients and potentially the server will be stored. We have chosen <I CLASS="filename">
 164 /etc/certificates</i> as our default. Execute the following commands as <CODE CLASS="literal">
 165 root</code>: </p><PRE CLASS="programlisting"># <CODE CLASS="userinput"><B>cd /etc</b></code>
 166 # <CODE CLASS="userinput"><B>mkdir certificates</b></code>
 167 # <CODE CLASS="userinput"><B>chmod 700 certificates</b></code></pre><P CLASS="para">
 168 Note that we shut out all access to users other than <CODE CLASS="literal">
 169 root</code> for this directory. This is very important.</p><P CLASS="para">
 170 Next, you need to set up the SSLeay scripts and configuration files to use the certificates stored in this directory. In order to do this, first modify the <I CLASS="filename">
 171 CA.sh</i> script located at <EM CLASS="emphasis">
 172 /usr/local/ssl/bin/CA.sh</em> to specify the location of the directory you just created. Find the line that contains the following entry:</p><PRE CLASS="programlisting">
 173 CATOP=./demoCA</pre><P CLASS="para">
 174 Then change it to:</p><PRE CLASS="programlisting">
 175 CATOP=/etc/certificates</pre><P CLASS="para">
 176 Next, you need to modify the <EM CLASS="emphasis">
 177 /usr/local/ssl/lib/ssleay.cnf</em> file to specify the same directory. Find the entry:</p><PRE CLASS="programlisting">
 178 [ CA_default ]
 179 dir     = ./demoCA             # Where everything is kept</pre><P CLASS="para">
 180 Then change it to:</p><PRE CLASS="programlisting">
 181 [ CA_default ]
 182 dir     =  /etc/certificates   # Where everything is kept</pre><P CLASS="para">
 183 Next, run the certificate authority setup script, <I CLASS="filename">
 184 CA.sh</i>, in order to create the certificates. Be sure to do this as the same user that you used to prime the random number generator above:</p><PRE CLASS="programlisting">
 185 /usr/local/ssl/bin/CA.sh -newca
 186 mkdir: cannot make directory '/etc/certificates': File exists
 187 CA certificate filename (or enter to create)</pre><P CLASS="para">
 188 Press the Enter key to create a certificate for the CA. You should then see:</p><PRE CLASS="programlisting">
 189 Making CA certificate ...
 190 Using configuration from /usr/local/ssl/lib/ssleay.cnf
 191 Generating a 1024 bit RSA private key
 192 .............................+++++
 193 .....................+++++
 194 writing new private key to /etc/certificates/private/cakey.pem
 195 Enter PEM pass phrase:</pre><P CLASS="para">
 196 Enter a new pass phrase for your certificate. You will need to enter it twice correctly before SSLeay will accept it:</p><PRE CLASS="programlisting">
 197 Enter PEM pass phrase:
 198 Verifying password - Enter PEM pass phrase:</pre><P CLASS="para">
 199 Be sure to remember this pass phrase. You will need it to sign the client certificates in the future. Once SSLeay has accepted the pass phrase, it will continue on with a series of questions for each of the fields in the X509 certificate:</p><PRE CLASS="programlisting">
 200 You are about to be asked to enter information that will be
 201 incorporated into your certificate request.
 202 What you are about to enter is what is called a Distinguished
 203 Name or a DN.
 204 There are quite a few fields but you can leave some blank
 205 For some fields there will be a default value,
 206 If you enter '.', the field will be left blank.</pre><P CLASS="para">
 207 Fill out the remainder of the fields with information about your organization. For example, our certificate looks like this:</p><PRE CLASS="programlisting">
 208 Country Name (2 letter code) [AU]:<CODE CLASS="userinput">
 209 <B>
 210 US</b></code>
 211 State or Province Name (full name) [Some-State]:<CODE CLASS="userinput">
 212 <B>
 213 California</b></code>
 214 Locality Name (eg, city) []:<CODE CLASS="userinput">
 215 <B>
 216 Sebastopol</b></code>
 217 Organization Name (eg, company) []:<CODE CLASS="userinput">
 218 <B>
 219 O'Reilly</b></code>
 220 Organizational Unit Name (eg, section) []:<CODE CLASS="userinput">
 221 <B>
 222 Books</b></code>
 223 Common Name (eg, YOUR name) []:<CODE CLASS="userinput">
 224 <B>
 225 John Doe</b></code>
 226 Email Address []:<CODE CLASS="userinput">
 227 <B>
 228 doe@ora.com</b></code></pre><P CLASS="para">
 229 After that, SSLeay will be configured as a certificate authority and can be used to sign certificates for client machines that will be connecting to the Samba server.</p></div><DIV CLASS="sect2">
 230 <H3 CLASS="sect2">
 231 <A CLASS="title" NAME="appa-pgfId-986381">
 232 A.3.4 Creating Certificates for Clients</a></h3><P CLASS="para">
 233 It's simple to create a certificate for a client machine. First, you need to generate a public/private key pair for each entity, create a certificate request file, and then use <EM CLASS="emphasis">
 234 SSLeay</em> to sign the file as a trusted authority.</p><P CLASS="para">
 235 For our example client <CODE CLASS="literal">
 236 phoenix</code>, this boils down to three SSLeay commands. The first generates a key pair for the client and places it in the file <I CLASS="filename">
 237 phoenix.key</i>. The private key will be encrypted, in this case using triple DES. Enter a pass phrase when requested below&nbsp;- you'll need it for the next step:</p><PRE CLASS="programlisting">
 238 # ssleay genrsa -des3 1024 &gt;phoenix.key
 239 1112 semi-random bytes loaded
 240 Generating RSA private key, 1024 bit long modulus
 241 ........................................+++++
 242 .............+++++
 243 e is 65537 (0x10001)
 244 Enter PEM pass phrase:
 245 Verifying password - Enter PEM pass phrase:</pre><P CLASS="para">
 246 After that command has completed, type in the following command:</p><PRE CLASS="programlisting"># <CODE CLASS="userinput"><B>ssleay req -new -key phoenix.key -out phoenix-csr</b></code>
 247 Enter PEM pass phrase:</pre><P CLASS="para">
 248 Enter the pass phrase for the client certificate you just created (not the certificate authority). At this point, you will need to answer the questionnaire again, this time for the client machine. In addition, you must type in a challenge password and an optional company name&nbsp;- those do not matter here. When the command completes, you will have a certificate request in the file <EM CLASS="emphasis">
 249 phoenix-csr.</em></p><P CLASS="para">
 250 Then, you must sign the certificate request as the trusted certificate authority. Type in the following command:</p><PRE CLASS="programlisting"># <CODE CLASS="userinput"><B>ssleay ca -days 1000 -inflies phoenix-csr &gt;phoenix.pem</b></code></pre><P CLASS="para">
 251 This command will prompt you to enter the PEM pass phrase of the <EM CLASS="emphasis">
 252 certificate authority</em>. Be sure that you do not enter the PEM pass phrase of the client certificate that you just created. After entering the correct pass phrase, you should see the following:</p><PRE CLASS="programlisting">
 253 Check that the request matches the signature
 254 Signature ok
 255 The Subjects Distinguished Name is as follows:
 256 ...</pre><P CLASS="para">
 257 This will be followed by the information that you just entered for the client certificate. If there is an error in the fields, the program will notify you. On the other hand, if everything is fine, SSLeay will confirm that it should sign the certificate and commit it to the database. This adds a record of the certificate to the <I CLASS="filename">
 258 /etc/certificates/newcerts</i> directory.</p><P CLASS="para">
 259 The operative files at the end of this exercise are the <EM CLASS="emphasis">
 260 phoenix.key</em> and <EM CLASS="emphasis">
 261 phoenix.pem </em>files, which reside in the current directory. These files will be passed off to the client with whom the SSL-enabled Samba server will interact, and will be used by SSL Proxy.<I CLASS="firstterm">
 262 </i></p></div><DIV CLASS="sect2">
 263 <H3 CLASS="sect2">
 264 <A CLASS="title" NAME="appa-pgfId-986754">A.3.5 Configuring the Samba Server</a></h3><P CLASS="para">
 265 The next step is to modify the Samba configuration file to include the following setup options. These options assume that you created the certificates directory for the certificate authority at <I CLASS="filename">
 266 /etc/certificates </i>:</p><PRE CLASS="programlisting">
 267 [global]
 268         ssl = yes
 269         ssl server cert = /etc/certificates/cacert.pem
 270         ssl server key = /etc/certificates/private/cakey.pem
 271         ssl CA certDir = /etc/certificates</pre><P CLASS="para">
 272 At this point, you will need to kill the Samba daemons and restart them manually:</p><PRE CLASS="programlisting">
 273 # <CODE CLASS="userinput"><B>nmbd -D</b></code>
 274 # <CODE CLASS="userinput"><B>smbd -D</b></code>
 275 Enter PEM pass phrase:</pre><P CLASS="para">
 276 You will need to enter the PEM pass phrase of the certificate authority to start up the Samba daemons. Note that this may present a problem in terms of starting the program using ordinary means. However, you can get around this using advanced scripting languages, such as Expect or Python.</p></div><DIV CLASS="sect2">
 277 <H3 CLASS="sect2">
 278 <A CLASS="title" NAME="appa-pgfId-986870">
 279 A.3.6 Testing with smbclient</a></h3><P CLASS="para">
 280 A good way to test whether Samba is working properly is to use the<EM CLASS="emphasis">
 281  smbclient</em> program. On the Samba server, enter the following command, substituting the appropriate share and user for a connection:</p><PRE CLASS="programlisting">
 282 # <CODE CLASS="userinput"><B>smbclient //hydra/data -U tom</b></code></pre><P CLASS="para">
 283 You should see several debugging statements followed by a line indicating the negotiated cipher, such as:</p><PRE CLASS="programlisting">
 284 SSL: negotiated cipher: DES-CBC3-SHA</pre><P CLASS="para">
 285 After that, you can enter your password and connect to the share normally. If this works, you can be sure that Samba is correctly supporting SSL connections. Now, on to the client setup.  </p></div></div></blockquote>
 286 <div>
 287 <center>
 288 <hr noshade size=1><TABLE WIDTH="515" BORDER="0" CELLSPACING="0" CELLPADDING="0">
 289 <TR>
 290 <TD ALIGN="LEFT" VALIGN="TOP" WIDTH="172">
 291 <A CLASS="sect1" HREF="appa_02.html" TITLE="A.2 Requirements">
 292 <IMG SRC="gifs/txtpreva.gif" ALT="Previous: A.2 Requirements" BORDER="0"></a></td><TD ALIGN="CENTER" VALIGN="TOP" WIDTH="171">
 293 <A CLASS="book" HREF="index.html" TITLE="">
 294 <IMG SRC="gifs/txthome.gif" ALT="" BORDER="0"></a></td><TD ALIGN="RIGHT" VALIGN="TOP" WIDTH="172">
 295 <A CLASS="sect1" HREF="appa_04.html" TITLE="A.4 Setting Up SSL Proxy">
 296 <IMG SRC="gifs/txtnexta.gif" ALT="Next: A.4 Setting Up SSL Proxy" BORDER="0"></a></td></tr><TR>
 297 <TD ALIGN="LEFT" VALIGN="TOP" WIDTH="172">
 298 A.2 Requirements</td><TD ALIGN="CENTER" VALIGN="TOP" WIDTH="171">
 299 <A CLASS="index" HREF="inx.html" TITLE="Book Index">
 300 <IMG SRC="gifs/index.gif" ALT="Book Index" BORDER="0"></a></td><TD ALIGN="RIGHT" VALIGN="TOP" WIDTH="172">
 301 A.4 Setting Up SSL Proxy</td></tr></table><hr noshade size=1></center>
 302 </div>
 303
 304 <!-- End of sample chapter -->
 305 <CENTER>
 306 <FONT SIZE="1" FACE="Verdana, Arial, Helvetica">
 307 <A HREF="http://www.oreilly.com/">
 308 <B>O'Reilly Home</B></A> <B> | </B>
 309 <A HREF="http://www.oreilly.com/sales/bookstores">
 310 <B>O'Reilly Bookstores</B></A> <B> | </B>
 311 <A HREF="http://www.oreilly.com/order_new/">
 312 <B>How to Order</B></A> <B> | </B>
 313 <A HREF="http://www.oreilly.com/oreilly/contact.html">
 314 <B>O'Reilly Contacts<BR></B></A>
 315 <A HREF="http://www.oreilly.com/international/">
 316 <B>International</B></A> <B> | </B>
 317 <A HREF="http://www.oreilly.com/oreilly/about.html">
 318 <B>About O'Reilly</B></A> <B> | </B>
 319 <A HREF="http://www.oreilly.com/affiliates.html">
 320 <B>Affiliated Companies</B></A><p>
 321 <EM>&copy; 1999, O'Reilly &amp; Associates, Inc.</EM>
 322 </FONT>
 323 </CENTER>
 324 </BODY>
 325 </html>