You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Neal Rhodes <ne...@mnopltd.com> on 2011/10/04 14:44:43 UTC
[users@httpd] Could Apache login support CAPTCHA and lockout?
We have bunches of web applications which use the regular Apache login
protection, and they won't run unless REMOTE_USER is set by the Apache
login.
<Limit GET>
require valid-user
</Limit>
<Limit POST PUT DELETE>
require valid-user
</Limit>
AuthName O-Visitor
AuthUserFile /usr/appl/cgi/.htpasswd
AuthType Basic
Looking at improving security, it would seem that it would be much
harder to conduct brute-force attacks on these systems if we could
configure Apache login to do two things:
A. Present the CAPTCHA style validation prompt as part of the
login, to make it difficult for scripted attacks to proceed;
B. Lockout an individual username in the .htpasswd file after X
failed login attempts.
Are there flavors of linux apache which have modules to provide this?
Neal Rhodes
MNOP Ltd
Re: [users@httpd] Could Apache login support CAPTCHA and lockout?
Posted by Mark Montague <ma...@catseye.org>.
On October 9, 2011 17:39 , Neal Rhodes <ne...@mnopltd.com> wrote:
> One would suppose from the responses that using .htpasswd and Basic
> Auth is really a lousy approach to security, since an attacker can
> just wail away indefinitely trying repeatedly, unless one configured
> something like fail2ban to cut off repeated attempts. I was just
> looking to improve on that if possible.
Actually, Basic Auth is a lousy approach to security because:
- It uses passwords, which are susceptible to being stolen (keyloggers,
social engineering attacks) or being guessed. Additionally, most users
are bad at choosing strong passwords and will re-use passwords between
multiple sites.
- The hashed passwords are stored on the web server and are readable by
the web server process. If the web server is compromised, the attacker
can copy the .htaccess file and brute-force the passwords offline (e.g.,
using rainbow tables).
- The username and password are sent from the web browser to the web
server in Base 64 format. If either web server or the network are
compromised, the attacker can intercept passwords directly. (Even if
HTTPS is used for all authenticated pages).
- As you mentioned, there is no way to log out short of the user closing
(or resetting/sanitizing) their web browser.
- The user interface for Basic Auth in most web browsers is poor, with
limited opportunity to customize the authentication process.
Better alternatives include:
- SPNEGO
- one-time passwords (including both sequence-based and time-based
"token" implementations such as HOTP/OATH)
- web single-sign-on systems, particularly those which centralize all
handling of passwords and which are designed to remain uncompromised
even if one of the web servers using it becomes compromised
- client X.509 certificates (either in the web browser or on a hardware
token)
- passwords combined with any of the above for multi-factor authentication.
Of course, many of these require special things of end users and their
computers which may not be feasible except in controlled "enterprise
like" environments.
--
Mark Montague
mark@catseye.org
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Could Apache login support CAPTCHA and lockout?
Posted by Neal Rhodes <ne...@mnopltd.com>.
Yes, thank for the responses and clarification. True the Basic Auth
isn't really a login, as there is no logout per se.
One would suppose from the responses that using .htpasswd and Basic Auth
is really a lousy approach to security, since an attacker can just wail
away indefinitely trying repeatedly, unless one configured something
like fail2ban to cut off repeated attempts. I was just looking to
improve on that if possible.
On Thu, 2011-10-06 at 22:54 +0200, Jeroen Geilman wrote:
> On 2011-10-04 14:44, Neal Rhodes wrote:
>
> > We have bunches of web applications which use the regular Apache
> > login protection,
>
>
> Do you mean HTTP Basic Auth, as defined in RFC 2616 ?
>
>
> > and they won't run unless REMOTE_USER is set by the Apache login.
> >
> >
> > <Limit GET>
> > require valid-user
> > </Limit>
> >
> > <Limit POST PUT DELETE>
> > require valid-user
> > </Limit>
> >
> > AuthName O-Visitor
> > AuthUserFile /usr/appl/cgi/.htpasswd
> >
> > AuthType Basic
> >
>
>
>
> Yes, this is HTTP Basic AUTH.
> It says so right there.
>
>
>
> > Looking at improving security, it would seem that it would be much
> > harder to conduct brute-force attacks on these systems if we could
> > configure Apache login to do two things:
>
>
> You can't.
> There is no "login", just an Authorization: header which has to be
> sent for every page that requires it.
>
>
> > A. Present the CAPTCHA style validation prompt as part of
> > the login, to make it difficult for scripted attacks to
> > proceed;
> > B. Lockout an individual username in the .htpasswd file
> > after X failed login attempts.
>
>
> Actual login-ness (a state of logged in being different from a state
> of not being logged in) must be achieved through non-HTTP means,
> possibly supported by HTTP features such as cookies.
>
>
>
> --
> J.
Re: [users@httpd] Could Apache login support CAPTCHA and lockout?
Posted by Jeroen Geilman <je...@adaptr.nl>.
On 2011-10-04 14:44, Neal Rhodes wrote:
> We have bunches of web applications which use the regular Apache login
> protection,
Do you mean HTTP Basic Auth, as defined in RFC 2616 ?
> and they won't run unless REMOTE_USER is set by the Apache login.
>
> <Limit GET>
> require valid-user
> </Limit>
>
> <Limit POST PUT DELETE>
> require valid-user
> </Limit>
>
> AuthName O-Visitor
> AuthUserFile /usr/appl/cgi/.htpasswd
>
> AuthType Basic
>
Yes, this is HTTP Basic AUTH.
It says so right there.
> Looking at improving security, it would seem that it would be much
> harder to conduct brute-force attacks on these systems if we could
> configure Apache login to do two things:
You can't.
There is no "login", just an Authorization: header which has to be sent
for every page that requires it.
> A. Present the CAPTCHA style validation prompt as part of the
> login, to make it difficult for scripted attacks to proceed;
> B. Lockout an individual username in the .htpasswd file after X
> failed login attempts.
>
Actual login-ness (a state of logged in being different from a state of
not being logged in) must be achieved through non-HTTP means, possibly
supported by HTTP features such as cookies.
--
J.
Re: [users@httpd] Could Apache login support CAPTCHA and lockout?
Posted by Devraj Mukherjee <de...@gmail.com>.
Hi Neal,
I have used http://authmemcookie.sourceforge.net/ previously to create
a form based authentication for web sites.
The form can be in any scripting language Apache supports so CAPTCHA
should be easy to implement.
On Tue, Oct 4, 2011 at 11:44 PM, Neal Rhodes <ne...@mnopltd.com> wrote:
> We have bunches of web applications which use the regular Apache login
> protection, and they won't run unless REMOTE_USER is set by the Apache
> login.
>
> <Limit GET>
> require valid-user
> </Limit>
>
> <Limit POST PUT DELETE>
> require valid-user
> </Limit>
>
> AuthName O-Visitor
> AuthUserFile /usr/appl/cgi/.htpasswd
>
> AuthType Basic
>
>
> Looking at improving security, it would seem that it would be much harder to
> conduct brute-force attacks on these systems if we could configure Apache
> login to do two things:
>
> A. Present the CAPTCHA style validation prompt as part of the login, to make
> it difficult for scripted attacks to proceed;
> B. Lockout an individual username in the .htpasswd file after X failed login
> attempts.
>
> Are there flavors of linux apache which have modules to provide this?
>
>
> Neal Rhodes
> MNOP Ltd
>
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org