Package: thredds_security_test
=====================THREDDS Security Test=====================Description===========This is a set of tools for testing the security configuration of THREDDS data servers. There arethree tools:thredds_test_url_access::- Determines whether access is available to a single resource specified by URL. An option isprovided to download the resource.thredds_test_catalog_access::- Determines whether access is available to the resources listed in a catalog specified by URL.Optionally, it will recurse through catalog references. Numbers of resources to which access isallowed and/or denied can be specified and a check is made that these match the results.Each service listed in the catalog as applicable to a dataset is tried. For services that havemultiple extensions used to access different types of data or metadata, each extension is tried(by default, this following extensions are tried for OPENDAP services: .html, .dds, .das, .asc,.ascii and .dods).If there is more than one service or service/extension combination available for accessing adataset, and access is found to be possible by some of these but not others, the securityconfiguration will be reported as inconsistent.thredds_test_file_access::- Determines whether access is available to a set of resources specified by URL listed in a file.This is intended to be used to check that files that exist in the THREDDS content directories,but which are not listed in catalogs, are not accessible.Prerequisites=============This has been developed and tested for Python 2.6 compiled with HTTPS support. Earlier Pythonversions do not handle HTTPS proxies.Installation============Installation can be performed using easy_install, e.g.::easy_install thredds_security_test-0.1.0-py2.6.eggRunning=======Each tool has a -h or --help option, which shows the usage and options. Common options are::-h, --help            Show help message and exit.-k FILE, --private-key=FILEPrivate key file - defaults to $HOME/.esg/credentials.pem-c FILE, --certificate=FILECertificate file - defaults to $HOME/.esg/credentials.pem-d, --debug           Print debug information - this may be useful in solving problems with HTTPor HTTPS access to a server.-q, --quiet           Produce minimal output.Specific arguments and options::thredds_test_url_access [options] urlurl                   The URL of the resource the accessibility of which is to be tested-f FILE, --fetch=FILESpecifies a file into which to fetch the resource contents if accessible.thredds_test_catalog_access [options] catalog_urlcatalog_url           The URL of the catalog to test-l, --list-only       Only list datasets in the catalog(s) without checking access.-r, --recurse         Recurse into referenced catalogs. References of the following types arefollowed:o Service with service type 'Catalog' or 'Resolvero Catalog references contained within a catalog-a NUMBER, --expect-allowed=NUMBERNumber of datasets for which access is expected to be allowed. After theaccess checks are made, this number is compared with the number found; ifthey are not the same an error message printed and the tool returns statusvalue 1.-x NUMBER, --expect-denied=NUMBERNumber of datasets for which access is expected to be denied. After theaccess checks are made, this number is compared with the number found; ifthey are not the same an error message printed and the tool returns statusvalue 1.-e SERVICE_EXTENSIONS, --service-extensions=SERVICE_EXTENSIONSA list of service types and and for each a list of extensions to be tried.The format is as in the following:OPENDAP:.html,.dds;OtherSvc:.dat,.ascDefaults to: OPENDAP:.html,.dds,.das,.asc,.ascii,.dods-p PUBLIC_SERVICE_EXTENSIONS, --public-service-extensions=PUBLIC_SERVICE_EXTENSIONSService types and extensions for which public accessis expected, e.g., OPENDAP:.html,.ddsDefaults to: OPENDAP:.htmlThis option is used to prevent access to a dataset being classed asinconsistent if, e.g., the .html resource is publicly accessible but otherresources are not accessible using the account used for testing.-f FORBIDDEN_SERVICE_EXTENSIONS, --forbidden-service-extensions=FORBIDDEN_SERVICE_EXTENSIONSService types and extensions for which no access isexpected, e.g., OPENDAP:.ascThis is of use, e.g., if a security configuration allows access to the .ascresources but not the equivalent .ascii resources.thredds_test_file_access [options] list_file_pathlist_file_path        Path of a file containing a list of URLs, of which the accessibility of eachis to be tested-a NUMBER, --expect-allowed=NUMBERNumber of datasets for which access is expected to be allowed. After theaccess checks are made, this number is compared with the number found; ifthey are not the same an error message printed and the tool returns statusvalue 1.-x NUMBER, --expect-denied=NUMBERNumber of datasets for which access is expected to be denied. After theaccess checks are made, this number is compared with the number found; ifthey are not the same an error message printed and the tool returns statusvalue 1.Return statuses::thredds_test_url_access0 - if the resource is accessible1  -if the resource is not accessiblethredds_test_catalog_access1 - if the expect-allowed and/or expect-denied options were specified and the result did not matchthe option value.2 - if the user interrupted test0 - otherwisethredds_test_file_access1 - if the expect-allowed and/or expect-denied options were specified and the result did not matchthe option value.2 - if the user interrupted test0 - otherwiseScripted Testing================In addition to the command line tools described above, Python test scripts may also be written. Thetests should call any of the functions::thredds_security_test.lib.catalog_access.check_catalogthredds_security_test.lib.file_access.check_filesthredds_security_test.lib.httpget.check_urlSee thredds_security_test.test.test_access.py for an example of usage.