.htaccess on Debian

Mondus · 09-23-2005, 03:30 PM

Hi... I've installed my apache server with apt-get install... But now I want to make .htaccess work because I need to password protect a directory... Can anyone guide me through it? I know it's not quite like getting it to work on other distros.. and I haven't been able to find a good guide.... So I'm hoping someone has been doing this before!

slackie1000 · 09-24-2005, 02:55 AM

hi there,
what do you need that it is not written in the APACHE documentation??
regards,
slackie1000

Mondus · 09-24-2005, 03:48 AM

Oh.. sorry... a couple of hours after posting in here.. I got it working.. but I just have a small issue... What security precautions should I take to completely secure the directory... Because, when prompted to login, if a hacker knew my username.. what's going to stop him form just bruteforcing his way into the directory?

slackie1000 · 09-24-2005, 04:01 AM

hi there,

Quote:

Originally posted by Mondus
what's going to stop him form just bruteforcing his way into the directory?

a strong password?

ok, .htaccess is not the strongest way to protect a directory. if someone knows your user, it is still necessary to "guess" your pass.
if you really need something safe, you should get your hands dirty with php.
regards,
slackie1000

Mondus · 09-24-2005, 05:50 AM

And use sessions or what? ..... But I know they have to guess my password.. but what's to stop them from doing it by means of bruteforcing?

slackie1000 · 09-24-2005, 10:58 AM

hi there,

Quote:

Originally posted by Mondus
but what's to stop them from doing it by means of bruteforcing?

short answer: nothing.
it is like ssh. you can not stop it. but there are ways to prevent or make it difficult.
about .htaccess i must again point you to the excellent apache documentation. to give you some ideas, what is possible with .htaccess for example is blocking ips, domains and such things. but you can not prevent a brute force attack. like i wrote before if you have really important content to protect .htaccess is not the solution.
regards,
slackie1000

Mondus · 09-24-2005, 02:31 PM

Quote:

Originally posted by slackie1000
hi there,

short answer: nothing.
it is like ssh. you can not stop it. but there are ways to prevent or make it difficult.
about .htaccess i must again point you to the excellent apache documentation. to give you some ideas, what is possible with .htaccess for example is blocking ips, domains and such things. but you can not prevent a brute force attack. like i wrote before if you have really important content to protect .htaccess is not the solution.
regards,
slackie1000

Ok.. so there are ways to make it difficult... Which ways? Can I for example define a waiting period before a retry login?

Ok, so now we've established that .htaccess is not the best idea... But then what is? What's a good alternative?

slackie1000 · 09-24-2005, 02:35 PM

hi there,
nope. afaik it is not possible to define time periods with .htaccess. l
ike i already wrote you can use a php authentication, where you can define time periods along with other security things..
this can be useful for you.
regards,
slackie1000

Mondus · 09-24-2005, 04:51 PM

Ok.. thanks.. I'll look into that!