Solved

Password authentication script

Posted on 1997-05-11
4
271 Views
Last Modified: 2013-12-25
I require to get a Username/Password from a user and then use the username for other scripts.  I am on an ISP running BSD Unix. I have set up htaccess in the appropriate secure directories and it work fine, but when I run a script after the user has logged in, the "REMOTE_USER" enviroment variable is always blank, so I have no way of knowing who the user is.  As I am using an ISP, I have no control of the server configuration.
Could I put in a cgi script to replace .htaccess? (Sample please)
Is there any reason why I cannot read "REMOTE_USER"?
 
0
Comment
Question by:ninoc
  • 2
  • 2
4 Comments
 
LVL 5

Accepted Solution

by:
icd earned 50 total points
ID: 1828002
If you don't want to use .htaccess then you *could* use a script but the security will not be so good.

You could pass the username from one script to the next using the GET method. The only drawback is that if you accessed an html document (not generated from a script) you would lose it so all your documents would have to be generated from cgi.

Alternatively put the user name in a cookie which would be available to each page with javascript. Unfortunately not all browsers use cookies and some people even disable them.

If you did not need to be absolutely certain of the user you could use the REMOTE_ADDR to determine who was accessing the page. They would log on, give their name and password which you would verify and record against it (in a log file) the REMOTE_ADDR. When a script is run you obtain the REMOTE_ADDR, look it up in the log file and carry out the appropriate action.

The REMOTE_ADDR will not always be the same for the same person since some systems allocate them to users from a 'pool' of numbers and sometimes different people will have the same REMOTE_ADDR for the same reason. But for the short period of time that a person is browsing your site it will be useful.
0
 
LVL 5

Expert Comment

by:icd
ID: 1828003
If the cgi is as a result of a form, try changing the method. (e.g. from POST to GET) and see what happens. I came across this comment:-

If you only use GET protection for a CGI script, you may be finding that the REMOTE_USER environment variable is not
getting set when using METHOD="POST", obviously because the directory isn't protected against POST.
0
 

Expert Comment

by:ritesh081398
ID: 1828004
One solution to this problem will be to add the accepted username into a temporary file
or a temp variable through a cgi script and use that value as a remote_user
0
 

Expert Comment

by:ritesh081398
ID: 1828005

B00042-patch.correct_user_logging.v2

        [This patch supercedes B00042-patch.correct_user_logging, which I
        managed to screw up!]

Version Apache/0.3

The common logfile's 'user' (3rd) field is meant to contain the user
supplied user-id which matches the value held in .htaccess files.
 
If the file has server-side includes (ie it's a u+x or .shtml file) then
I find that the 'user' entry is recorded as '-', even though a uid/pwd
is required and given for the main including file.
 
This patch changes http_access.c, http_log.c and http_request.c.  Add
        -DLOGUSER
to the Makefile's compile-time flags to change the server's behaviour.
 
Ay.

*** http_auth.c.dist    Tue Mar 28 14:01:46 1995
--- http_auth.c Wed Mar 29 12:51:59 1995
***************
*** 46,51 ****
--- 46,59 ----
      }
  }
 
+
+ #ifdef LOGUSER
+       /* B00042
+        * Keep a copy of the first 'user' id provided for .htaccess
+        */
+       extern char log_user[MAX_STRING_LEN];
+ #endif
+
  void check_auth(security_data *sec, int m, FILE *out) {
      char at[MAX_STRING_LEN];
      char ad[MAX_STRING_LEN];
***************
*** 79,84 ****
--- 87,100 ----
              auth_bong("type mismatch",out);
          uudecode(t,(unsigned char *)ad,MAX_STRING_LEN);
          getword(user,ad,':');
+ #ifdef LOGUSER
+       /* B00042
+        * Keep a copy of the first 'user' id provided for .htaccess
+        */
+       if ( log_user[0] == '\0' ) {
+               strcpy( log_user, user );
+       };
+ #endif
          strcpy(sent_pw,ad);
          if(!get_pw(user,real_pw,out)) {
              sprintf(errstr,"user %s not found",user);
*** http_log.c.dist     Wed Mar 29 12:31:22 1995
--- http_log.c  Wed Mar 29 12:51:55 1995
***************
*** 60,65 ****
--- 60,72 ----
      strcpy(the_request,cmd_line);
  }
 
+ #ifdef LOGUSER
+       /* B00042
+        * Keep a copy of the first 'user' id provided for .htaccess
+        */
+       extern char log_user[MAX_STRING_LEN];
+ #endif
+
  void log_transaction() {
      char str[HUGE_STRING_LEN];
      long timz;
***************
*** 76,82 ****
--- 83,96 ----
      sprintf(str,"%s %s %s [%s %c%02d%02d] \"%s\" ",
              remote_name,
              (do_rfc931 ? remote_logname : "-"),
+ #ifdef LOGUSER
+       /* B00042
+        * Keep a copy of the first 'user' id provided for .htaccess
+        */
+            (log_user[0] ? log_user : "-"),
+ #else
              (user[0] ? user : "-"),
+ #endif
              tstr,
              sign,
              timz/3600,
*** http_request.c.dist Tue Mar 28 13:54:54 1995
--- http_request.c      Wed Mar 29 12:39:29 1995
***************
*** 95,100 ****
--- 95,107 ----
      return 0;
  }
 
+ #ifdef LOGUSER
+       /* B00042
+        * Keep a copy of the first 'user' id provided for .htaccess
+        */
+       char log_user[MAX_STRING_LEN];
+ #endif
+
  void process_request(int in, FILE *out) {
      char m[HUGE_STRING_LEN];
      char w[HUGE_STRING_LEN];
***************
*** 102,107 ****
--- 109,121 ----
      char url[HUGE_STRING_LEN];
      char args[HUGE_STRING_LEN];
      int s,n;
+
+ #ifdef LOGUSER
+       /* B00042
+        * Keep a copy of the first 'user' id provided for .htaccess
+        */
+       log_user[0] = '\0';
+ #endif
 
      get_remote_host(in);
      exit_callback = NULL;
0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

It is a general practice to get rid of old user profiles on a computer  in a LAN environment. As I have been working with a company in a LAN environment where users move from one place to some other place at times. This will make many user profil…
This article is meant to give a basic understanding of how to use R Sweave as a way to merge LaTeX and R code seamlessly into one presentable document.
Learn the basics of while and for loops in Python.  while loops are used for testing while, or until, a condition is met: The structure of a while loop is as follows:     while <condition>:         do something         repeate: The break statement m…
Learn how to match and substitute tagged data using PHP regular expressions. Demonstrated on Windows 7, but also applies to other operating systems. Demonstrated technique applies to PHP (all versions) and Firefox, but very similar techniques will w…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now