Fortunately, what you're doing is not nearly as complex as all this.

The first, and most efficient, way of doing this is if you are using =
Apache to establish a .htaccess file to lock a directory.  But if you =
cannot limit yourself to only one directory, or you are not using =
Apache, you can use perl to create a username/password file which uses =
the crypt() function-a one-way hashing function.

You don't have to resort to odd script filenames.  Since the password =
file is encrypted, you don't have to worry about someone stealing =
it-they'd still have to perform a brute force entry (although-if they =
downloaded your password file, then what's stopping them from just =
grabbing anything they want, yes?)

If you want some specific details on how to write such a script, let me =
know, and I'll help you out.  I've written this before.

But I must stress that the .htaccess route is much better because it's =
much quicker to implement, and it's best to separate password checking =
functions from the actual content of your site.

Brian A. Sayrs
Owner, Southwind Solutions


-----Original Message-----
From:	John Murray [SMTP:jmnc(at)lis.net.au]
Sent:	Thursday, August 10, 2000 3:54 PM
To:	ideas(at)creativegenius.ca
Cc:	hwg-techniques(at)hwg.org
Subject:	Re: Implementing Password Protection on a Unix hosted web site. =


Perl script that looks up from a file username and pasword pairs, call =
the
perl script from a form, have some code in the script which changes the
password submitted to check against the password as recorded in the text
file of username/pasword pairs ... it's not rocket science, and I'm sure
NASA has a whole heap of other processes they can lie between the =
password
submission and any other processes that the user gets to use once they =
have
provided their password but ....

Make sure you have a heap of script names in your script folder. Call =
the
password lookup 234bhg4.pl and call a bogus script "passwordcheck.pl" =
that
returns when hit "Welcome - we have a thorough password system - Please
eneter your password". This bogus script then just returns "Now re-enter =
for
time number 2" - just keep iterating the process and incrementing the =
times
through.

234ghg4.pl takes a password, adds a number to it which you have to keep
constant or change the passwords in the actual password file at the same
time as you change the number. That is If I have a password 2468 and the
shift number is 13 then the paswword file will have 2481 as my password.

You make the numbers a little longer, and you can get fancier on your
encryption.

Then you can embody in the returned form heaps more hidden values that =
are
needed to make a script run that takes the user deeper into your =
datafiles.
You know, a <input type=3D"hidden"> that is datetime stamped by the =
server,
and when the form that is the next step the user wants to take is =
submitted
test to see if time is more than 5mins - if it is - password again.

Maybe this is too simple for what you need. It's what I use. I've often
wondered what I was missing out on by doing this myself and delving into
other levels of it. I have a virtual website only though.

When I think it through, I find that I come to the conclusion that other
levels of security can only be variations of what I have put above here. =
I
mean, you have to compare something against something to say yes or no =
to a
request.

John

----- Original Message -----
From: <ideas(at)creativegenius.ca>
To: <hwg-techniques(at)hwg.org>
Sent: Friday, August 11, 2000 6:03 AM
Subject: Implementing Password Protection on a Unix hosted web site.


> Greetings List:
>
> We have a client who's site will be hosted on a UNIX server.  They =
wish to
> password protect access to a particular page on this site.  In the =
past if
> we have been asked to provide this feature we have used Coffee Cup's
> Password Wizard which uses a .class file and encrypted HTML code.
>
> Any ideas ?
>
> Thanks
>
>
>
>
> Simon Rolfe
> Creative Genius Communications
> www.creativegenius.ca
> (613) 566-5506
>
>

• Web Designer Courses
• Off the Shelf Training Courses

HWG hwg-techniques mailing list archives, maintained by Webmasters @ IWA