| View previous topic :: View next topic |
| Author |
Message |
Shiner_Man
Apprentice
Joined: 09 Mar 2004
Posts: 180
|
 Posted: Thu Jul 01, 2004 8:01 pm Post subject: Apache-Password Protect Directory and Force SSL |
 |
|
I just installed Acid with mysql and snort but I don't want everybody having access to the alert statistics. What I want to do is password protect the acid main page and force it to use ssl.
I read some of th documentation on apache's site but I find it very confusing. Is their an easy way to set this up?
_________________
My Site |
|
| Back to top |
|
 |
Shiner_Man
Apprentice
Joined: 09 Mar 2004
Posts: 180
|
| Posted: Thu Jul 01, 2004 11:25 pm Post subject: |
|
|
Okay after messing around with a bunch of things I figured out how to password protect the directory. Here is what I did.
| Code: | # cd /var/www/localhost/htdocs/acid
# htpasswd2 -c .htpasswd aciduser |
This will create the .htpasswd file and add the user aciduser with a password. Then I created the .htaccess file in the same directory which looks like this:
| Code: | AuthUserFile /var/www/localhost/htdocs/acid/.htpasswd
AuthGroupFile /dev/null
AuthName "ACID Server"
AuthType Basic
require user aciduser |
Then I had to add the following to /etc/apache2/conf/commonapache2.conf:
| Code: |
<Directory /var/www/localhost/htdocs/acid/>
AllowOverride All
</Directory> |
Restart apache:
| Code: | | /etc/init.d/apache2 restart |
and everything works fine.
Two questions. Should the .htaccess and .htpasswd files be saved somewhere else? How can I force this page to only work through ssl?
_________________
My Site |
|
| Back to top |
|
|
MrSpock
n00b
Joined: 13 Jan 2003
Posts: 43
|
| Posted: Fri Jul 02, 2004 9:11 am Post subject: |
|
|
The .htpasswd file shouldn't stay in your web-root, as it may be readable through browser. The .htaccess has to stay exactly in the directory you wonna protect. Make sure the rule for denying read access through apache to that file is denied. (should be if you didn't delete that section)
_________________
If we could change our past,
would that also change who we are? |
|
| Back to top |
|
|
Shiner_Man
Apprentice
Joined: 09 Mar 2004
Posts: 180
|
| Posted: Fri Jul 02, 2004 7:07 pm Post subject: |
|
|
So where is the recommended place to put .htpasswd? In /etc somewhere?
_________________
My Site |
|
| Back to top |
|
|
MrSpock
n00b
Joined: 13 Jan 2003
Posts: 43
|
| Posted: Fri Jul 02, 2004 7:09 pm Post subject: |
|
|
i put it in the root dir of my homedir.
_________________
If we could change our past,
would that also change who we are? |
|
| Back to top |
|
|
Shiner_Man
Apprentice
Joined: 09 Mar 2004
Posts: 180
|
| Posted: Sat Jul 03, 2004 2:06 am Post subject: |
|
|
Okay. I'd rather put it somewhere else like /etc/apache2 since I clean out my home directory often.
_________________
My Site |
|
| Back to top |
|
|
hanj
Veteran
Joined: 19 Aug 2003
Posts: 1500
|
| Posted: Sat Jul 03, 2004 5:39 am Post subject: |
|
|
Assuming you have SSL configured and working on the server, this is how you'd force SSL for that request
In you /etc/apache2/conf/vhosts/vhosts.conf file you'll need to add a entry for acid:
| Code: |
<Directory "/var/www/localhost/htdocs/acid">
RewriteEngine on
RewriteBase /acid/
RewriteCond %{SERVER_PORT} ^80$
RewriteRule ^(.*) https://www.yourdomain.com/acid/ [R]
</Directory>
|
You could optionally add your .htaccess directive within apache confs too... in /etc/apache2/conf/ssl/vhost/vhosts.conf
Add this:
| Code: |
<Directory "/var/www/localhost/htdocs/acid">
# normal SSL stuff here..once again assuming you have it working
# additional directives
AllowOverride None
Options Includes -FollowSymLinks IncludesNoExec
# add auth stuff here
AuthUserFile /somewhere/not/under/webroot/.htpasswd
AuthGroupFile /dev/null
AuthName "ACID Server"
AuthType Basic
<Limit GET>
require user aciduser
</Limit>
</Directory>
|
I hope this helps
hanj |
|
| Back to top |
|
|
BlinkEye
Veteran
Joined: 21 Oct 2003
Posts: 1046
Location: Gentoo Forums
|
| Posted: Sat Oct 23, 2004 9:35 am Post subject: |
|
|
i'm looking for a similar solution since a long time. still, it doesn't work for me. what i want is access a users directory with a login. but i want to be redirected to the secure socket before authenticating, how do i do that?
example: http://foodomain/~myuser -> rewrite to: https://foodomain/~myuser and NOW ask me to authenticate. any idea?
_________________
Easily backup up your system? klick
Get rid of SSH Brute Force Attempts / Script Kiddies klick |
|
| Back to top |
|
|
|
Networking & Security
