You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by "Kaplan, Andrew H." <AH...@PARTNERS.ORG> on 2003/08/15 15:19:53 UTC
[users@httpd] Reposting of Question: Setting Up User Authentication For An Enti
re Site
Reposting of question shown below.
-----Original Message-----
From: Kaplan, Andrew H.
Sent: Friday, August 08, 2003 10:17 AM
To: users@httpd.apache.org
Subject: [users@httpd] Setting Up User Authentication For An Entire Site
Hi there,
I am going to be setting up user authentication for a single site on our web
server. The idea is when a user brings up the website on his/her browser,
he/she will be immediately prompted for a password. Once that is provided, the
user will have access to the various sections of the site that have
been set up. I was planning on using the .htaccess file for the passwords, and
configuring the httpd.conf file so that password authentication will take
place at the root of the Documents directory.
FYI:
Operating System is Mandrake Linux 9.0
Apache version is 2.0.46, and is located in /usr/local/apache
Root directory for documents (including .htm and .html files but not .cgi's) is
/var/www/Documents
Is this the way to go? Thanks.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Reposting of Question: Setting Up User Authentication For An Entire Site
Posted by Robert Andersson <ro...@profundis.nu>.
Kaplan, Andrew H wrote:
> The idea is when a user brings up the website on his/her browser,
> he/she will be immediately prompted for a password. Once that is provided,
> the user will have access to the various sections of the site that have
> been set up. I was planning on using the .htaccess file for the passwords,
> and configuring the httpd.conf file so that password authentication will
take
> place at the root of the Documents directory.
>
> Is this the way to go? Thanks.
Yes, with a few comments.
* Are you satisfied with the very low security inherent in Basic
Authentication? If sensitive information is going to travel the pipe, you
might want to use SSL in addition to Basic Auth.
* If you are going to have a lot (100+) user, it would be wise to use
another method.
* As I see it, there is no reason for using an .htaccess file; configure the
authentication directly in httpd.conf and refer to a password file (which
is not an access file, many seems to mix the two).
Regards,
Robert Andersonn
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Reposting of Question: Setting Up User Authentication
For An Enti re Site
Posted by Joshua Slive <jo...@slive.ca>.
On Fri, 15 Aug 2003, Kaplan, Andrew H. wrote:
> I am going to be setting up user authentication for a single site on our web
> server. The idea is when a user brings up the website on his/her browser,
> he/she will be immediately prompted for a password. Once that is provided, the
> user will have access to the various sections of the site that have
> been set up. I was planning on using the .htaccess file for the passwords, and
> configuring the httpd.conf file so that password authentication will take
> place at the root of the Documents directory.
>
> FYI:
> Operating System is Mandrake Linux 9.0
> Apache version is 2.0.46, and is located in /usr/local/apache
> Root directory for documents (including .htm and .html files but not .cgi's) is
> /var/www/Documents
>
> Is this the way to go? Thanks.
Did you read:
http://httpd.apache.org/docs-2.0/howto/auth.html
In general, directives should not be placed in .htaccess unless you really
need them there. If you really want to protect everything on the site,
put your auth directives in httpd.conf inside a <Location /> </Location>
section.
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org