An Introduction to Security Measures in Apache 2.2 - More on Passwords (Page 4 of 4 )
Instead of using htpasswd to create the passwords file, we need to use htdigest. The creation of a username and password can be achieved with the following command (again in a command prompt set to the Apache bin directory):
htdigest -c C:hidden.digestpasswords "More Secure Protected Area" AuthUser
This time, the username, AuthName and the password are stored. Again the password is encrypted using md5. There is now no warning of basic security in the username and password prompt:
There is one more thing that Apache advises us to add when using the digest method of authentication. Because the digest method is still classed as experimental, there are flaws in the way that different browsers handle it. There is a known issue with Internet Explorer whereby GET requests with a query string are not RFC compliant. In order to allow Apache to work around this issue, it is recommended that the following conditional environment variable be used:
BrowserMatch "MSIE" AuthDigestEnableQueryStringHack=On
Just place this in the <Directory> section containing the digest directives.
SSL would be the next logical step in making connections to Apache even more secure, but unfortunately it is outside of the scope of this article. The Apache documentation provides a wealth of further reading and information, but I hope this article has given you a practical and interesting introduction to the two methods of authentication available to you as an administrator of Apache.
| DISCLAIMER: The content provided in this article is not warranted or guaranteed by Developer Shed, Inc. The content provided is intended for entertainment and/or educational purposes in order to introduce to the reader key ideas, concepts, and/or product reviews. As such it is incumbent upon the reader to employ real-world tactics for security and implementation of best practices. We are not liable for any negative consequences that may result from implementing any information covered in our articles or tutorials. If this is a hardware review, it is not recommended to open and/or modify your hardware. |
/ 3 
