CGIAuth revisited ...

Involved Joined: Feb 08, 2005 Posts: 290 Location: USA

I've read my brains out ... they're (my brains) mush all over these forums! I'm sorry but I really do need help with this one! I have to do the CGIAuth for NukeSentinel. NS is running but I had to comment the 8 lines generated when running the script as shown in the install files. I've done all I can do from what I've read here

http://www.ravenphpscripts.com/postt10543.html and elsewhere. My site is out in limbo (I dare not even allow admins in to register, etc). Please, someone help?

I'm finding all this pretty confusing ... the site is running OK but with those lines commented out I fear NS isn't doing it's job correctly! Pleazzz help so I can get this site live? Thanks!

Posted: Wed Aug 30, 2006 2:43 am

So why did you comment them out?

Are there any points in the instructions which you don't understand?

Posted: Wed Aug 30, 2006 2:45 am

sec, lemme UNcomment em and let ya know what happens ... I forgot already LOL

Posted: Wed Aug 30, 2006 2:56 am

The pw box keeps coming up until the third time when it says Access Denied. I'm putting in the correct pw I'm sure. Even Raven commented on another post that he's not sure why the hash is showing in sentinel? Maybe that's the problem?

*edit* Sorry, error message says: Authorization required (not Access Denied). Seems anytime I try to change .htaccess I get some sort of error ... I had it on 777 but that setting doesn't stick and it ends up back at 644 or something.

Posted: Wed Aug 30, 2006 3:00 am

Can I assume that;
1. your host is using PHP compiled as a module
2. that you can actually use CGIAuth on your server environment
3. that HTTPAuth doesnt work for you

Posted: Wed Aug 30, 2006 3:03 am

1) Yes
2) I dunno ... the option is there in NukeSentinel so I assume so.
3) That option is not available in NukeSentinel, and my host has confirmed I'm not using that ... my PHP is running as a module on apache (apparently).

Site Admin Joined: Jun 04, 2004 Posts: 6433

Admin authentication (in either CGIAuth or HTTPAuth flavor) makes your site more secure. You might check the NukeSentinel manual on this site for more details on how to set it up and use it effectively. Though the manual isn't for the current NukeSentinel version, that function hasn't changed in some time (it continues to work quite effectively).

Since many people have installed and use NukeSentinel effectively, I'm not sure what led to the commenting of part of the installation routine. I'd suggest a quick post in the forums here to ask the question before doing that again.

Posted: Wed Aug 30, 2006 6:25 am

I've already said here above, it's not accepting my username/pw, which I know are correct. Likewise I know the path inside .htaccess is correct so I'm stumpted : o/

Posted: Wed Aug 30, 2006 7:57 am

Then it cannot find your password file. That's defined in your htaccess or NukeSentinel settings.

Posted: Wed Aug 30, 2006 11:47 am

Yep I know but I don't know what to do about it. I know the path in .htaccess is correct, I did the realpath.php script as suggested elsewhere. I know I've got the right username/pw ... I'm at a loss!

Posted: Wed Aug 30, 2006 12:53 pm

OK I finally got it fixed, not sure I should have done this but it works LOL

In the Install instructions for NS you had the option of creating a *NEW* username/pw for Sentinel, I did that at that step for added security. This is what was causing my problem tho. Because in NS Admin Auth List it had something like this:

Admin: Auth Login: Auth Password: Protected:
GodAdmin SentAdmin sentadminpwhere Yes
2ndAdmin 2ndAdmin 2ndadminpwhere Yes

I changed
GodAdmin GodAdmin GodAdminpwhere Yes

Then I clicked the Build CGIAuth file: /xxxx/xxxx/xxxxxx/xxxx/.staccess

I was able to login once I'd corrected the admin settings. The problem seems to be that when you do that step in instructions for creating a Sentinel login/pw that shows up in the Admin section as seen above and that is why I couldn't login ... and yes, I even tried to login using that Sentinel admin username/pw combo and it didn't work ... I had no alternative but to change the settings to the real god admin/pw.

Other steps I did previously were to add this line to before the first < > tags, as suggested elsewhere

PHP_FLAG output_buffering on

Not sure that helped or not.

And made sure there was one blank line at the end of the .htaccess file so Sentinel has a place to add blocked IPs.

Hopefully this helps others. I am abit concerned about not being able to use that secondary Sentinel Admin username/pw ... should I go ahead and add it as a third admin or is it even needed?