Re: Permissions for index.php -- hide MySQL password?

Sergio Trejo schrieb:
> I saw someone also post recently about using a .htaccess file 
> (presumably using Basic Authentication) which is really perhaps not a 
> good idea considering the password gets sent in the clear. Also noticed 
> the suggestion to use mod_auth_mysql. But getting back to the idea of 
> authenticating for access to a PHPWiki instance via the context of 
> .htaccess (or directory context in httpd.conf, etc.) ... what about the 
> possibility of using Digest Authentication (mod_auth_digest)? I know its 
> still considered experimental by Apache since the server doesn't check 
> the nonce reflected by the browser (and for a while there was a problem 
> with browsers not supporting MD5 digest authentication), but most modern 
> day browsers I think are now supporting digest access. Perhaps its 
> overkill to use both digest (such as at the Wiki's root directory such 
> that .htaccess files are not constantly being parsed by httpd for every 
> request in subrealms)? Just an idea perhaps worth contemplating.

You can setup any auth scheme, whatever you want.
But I don't think that http digest auth has wide client support. 
everybody still uses Basic, with the password md5'ed in the header. but 
you need a sniffer to get at these.

What I wrote about .htaccess auth, is that we will include a file-style 
auth scheme, which can be used optionally, similar to basic http auth.
That means, you don't get the browsers popup with user/password, instead 
you can login at the normal phpwiki login page and authenticate against 
any htaccess style file. (username:encrypted_password\n...)
such files are very simple to maintain and easier to setup, than http 
auth, which needs support by the local system administrator.
--
Reini Urban
http://xarch.tu-graz.ac.at/home/rurban/



-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click