Joined: Aug 27, 2002 Posts: 16987 Location: Kansas
Posted:
Mon May 03, 2004 9:50 pm
I have been testing using HTTP Basic Authentication to add a top level security layer for admin access. It requires 2 id and password authentication. You have a private file that contains an id and encrypted password. Then, in admin.php, that file is used to verify top level authentication using HTTP Basic Authentication. Once that is passed, the regular nuke admin functionality kicks in. Here is what the private file (myprivatefile.php) might look like
The beauty is that you can place those files wherever you want and you can name the variables whatever you want. Let me know your thoughts and experiences. Obviously, you can use this technique elsewhere too.
Also, here is a little script to help you md5() your password. You could use whatever hash/crypt routine you wanted as long as you adjust the HTTP Auth code
Code:
<?
echo md5("testpw");
?>
You could also redirect the three strikes and you're out to my hackalert script instead of just 'Get out of here'. It is very flexible
Last edited by Raven on Tue May 04, 2004 1:35 pm; edited 2 times in total
I will have to try this again later, tried it earlier and it didnt work, it displayed the contents of basicauthfile.php above the header when viewing admin.php. Its late though, so I probably messed something up.
Joined: Aug 27, 2002 Posts: 16987 Location: Kansas
Posted:
Tue May 04, 2004 4:24 am
sharlein wrote:
Raven, I have it on my site. The only problem I had was that I had to logout as admin, and then log back on.
That would be true. HTTP Basic Auth requires 1 login per browser session. Meaning, the signon is valid only for the duration of that browser session. If you open up a new instance of the browser it will require a new login. If you were logged in as admin and then added this code, the browser has never seen the HTTP Auth so it will require authorization one time for that browser session.
Nice truely platform independent makes robot and brute force attacks very expensive. Simple cookie traps too which is getting more common all the time.
Joined: Aug 27, 2002 Posts: 16987 Location: Kansas
Posted:
Tue May 04, 2004 5:38 am
Coldy wrote:
Hi!
I've test some different variations, and it works very good!
But i have an other question about this:
Code:
<?
echo md5("testpw");
?>
Should i take this in a new file?
Coldy
Yes. Just save that to a file and call it whatever you want. It is simply a utility to one-way encode your secret password that you will place in your private file. Keep in mind that you could also hide the id and pass in a table and read the table. It's very flexible.
Joined: Aug 27, 2002 Posts: 16987 Location: Kansas
Posted:
Tue May 04, 2004 9:29 am
I'm sure there are many variations on a theme . That's why it becomes a little silly to try to copyright everything and claim you are the first, etc. I have never looked at that application as I tend to write all of my own, for better or worse. And with all the accusations flying around these days, that's all the more reason that I just do my own thing, so to speak. Bob writes very good applications also. You usually won't go wrong with his stuff. The purpose of this thread is to gather feedback on my offering so that I can publish it. That's why I needed to know how your post fit. Thanks.
Joined: Aug 27, 2002 Posts: 16987 Location: Kansas
Posted:
Tue May 04, 2004 10:24 am
As shown here all admins require the same id and password for the initial passcode. This could easily be rewritten to query the authors table and use the nuke adminid/password. With about the same amount of effort, it could be modified to have multiple ids/passwords in the private file.
Joined: Aug 27, 2002 Posts: 16987 Location: Kansas
Posted:
Tue May 04, 2004 11:54 am
Never saw that one either. I've been using/testing/perfecting mine since a least the first of April. As I said, variations on a theme - a two tier approach to security. Mine is written to be platform independent and to be able to resolve cookie issues as well as variable issues.
I can't get it to work properly. On the admin login i get the entire basicauthfile.php on top of the page. I can't login. Does the basicauthfile.php needs to be between <? and ?> ?
I can't get it to work properly. On the admin login i get the entire basicauthfile.php on top of the page. I can't login. Does the basicauthfile.php needs to be between <? and ?> ?
Yeah, thats excactly the same problem I had last night. It also makes the security code show a 404. Thought I had done it wrong to start with, guess not.
Joined: Aug 27, 2002 Posts: 16987 Location: Kansas
Posted:
Tue May 04, 2004 1:17 pm
As I said above, I imagine it's some other security code you have on top of this. Please post everything that is above the require("auth.php") line and I will look at it.
I actually put them in another folder in admin, you said you could put them anywhere didnt you? I just had the contents of basicauthfile displayed in text above the header.
View next topic View previous topic
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
![[Valid RSS]](http://www.ravenphpscripts.com/images/valid-rss.png "Validate my RSS feed"){kind=small}
:: 
::
. That's why it becomes a little silly to try to copyright everything and claim you are the first, etc. I have never looked at that application as I tend to write all of my own, for better or worse. And with all the accusations flying around these days, that's all the more reason that I just do my own thing, so to speak. Bob writes very good applications also. You usually won't go wrong with his stuff. The purpose of this thread is to gather feedback on my offering so that I can publish it. That's why I needed to know how your post fit. Thanks.
