Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Password authentication script

Posted on 1997-05-11
4
Medium Priority
?
313 Views
Last Modified: 2013-12-25
I require to get a Username/Password from a user and then use the username for other scripts.  I am on an ISP running BSD Unix. I have set up htaccess in the appropriate secure directories and it work fine, but when I run a script after the user has logged in, the "REMOTE_USER" enviroment variable is always blank, so I have no way of knowing who the user is.  As I am using an ISP, I have no control of the server configuration.
Could I put in a cgi script to replace .htaccess? (Sample please)
Is there any reason why I cannot read "REMOTE_USER"?
 
0
Comment
Question by:ninoc
  • 2
  • 2
4 Comments
 
LVL 5

Accepted Solution

by:
icd earned 100 total points
ID: 1828002
If you don't want to use .htaccess then you *could* use a script but the security will not be so good.

You could pass the username from one script to the next using the GET method. The only drawback is that if you accessed an html document (not generated from a script) you would lose it so all your documents would have to be generated from cgi.

Alternatively put the user name in a cookie which would be available to each page with javascript. Unfortunately not all browsers use cookies and some people even disable them.

If you did not need to be absolutely certain of the user you could use the REMOTE_ADDR to determine who was accessing the page. They would log on, give their name and password which you would verify and record against it (in a log file) the REMOTE_ADDR. When a script is run you obtain the REMOTE_ADDR, look it up in the log file and carry out the appropriate action.

The REMOTE_ADDR will not always be the same for the same person since some systems allocate them to users from a 'pool' of numbers and sometimes different people will have the same REMOTE_ADDR for the same reason. But for the short period of time that a person is browsing your site it will be useful.
0
 
LVL 5

Expert Comment

by:icd
ID: 1828003
If the cgi is as a result of a form, try changing the method. (e.g. from POST to GET) and see what happens. I came across this comment:-

If you only use GET protection for a CGI script, you may be finding that the REMOTE_USER environment variable is not
getting set when using METHOD="POST", obviously because the directory isn't protected against POST.
0
 

Expert Comment

by:ritesh081398
ID: 1828004
One solution to this problem will be to add the accepted username into a temporary file
or a temp variable through a cgi script and use that value as a remote_user
0
 

Expert Comment

by:ritesh081398
ID: 1828005

B00042-patch.correct_user_logging.v2

        [This patch supercedes B00042-patch.correct_user_logging, which I
        managed to screw up!]

Version Apache/0.3

The common logfile's 'user' (3rd) field is meant to contain the user
supplied user-id which matches the value held in .htaccess files.
 
If the file has server-side includes (ie it's a u+x or .shtml file) then
I find that the 'user' entry is recorded as '-', even though a uid/pwd
is required and given for the main including file.
 
This patch changes http_access.c, http_log.c and http_request.c.  Add
        -DLOGUSER
to the Makefile's compile-time flags to change the server's behaviour.
 
Ay.

*** http_auth.c.dist    Tue Mar 28 14:01:46 1995
--- http_auth.c Wed Mar 29 12:51:59 1995
***************
*** 46,51 ****
--- 46,59 ----
      }
  }
 
+
+ #ifdef LOGUSER
+       /* B00042
+        * Keep a copy of the first 'user' id provided for .htaccess
+        */
+       extern char log_user[MAX_STRING_LEN];
+ #endif
+
  void check_auth(security_data *sec, int m, FILE *out) {
      char at[MAX_STRING_LEN];
      char ad[MAX_STRING_LEN];
***************
*** 79,84 ****
--- 87,100 ----
              auth_bong("type mismatch",out);
          uudecode(t,(unsigned char *)ad,MAX_STRING_LEN);
          getword(user,ad,':');
+ #ifdef LOGUSER
+       /* B00042
+        * Keep a copy of the first 'user' id provided for .htaccess
+        */
+       if ( log_user[0] == '\0' ) {
+               strcpy( log_user, user );
+       };
+ #endif
          strcpy(sent_pw,ad);
          if(!get_pw(user,real_pw,out)) {
              sprintf(errstr,"user %s not found",user);
*** http_log.c.dist     Wed Mar 29 12:31:22 1995
--- http_log.c  Wed Mar 29 12:51:55 1995
***************
*** 60,65 ****
--- 60,72 ----
      strcpy(the_request,cmd_line);
  }
 
+ #ifdef LOGUSER
+       /* B00042
+        * Keep a copy of the first 'user' id provided for .htaccess
+        */
+       extern char log_user[MAX_STRING_LEN];
+ #endif
+
  void log_transaction() {
      char str[HUGE_STRING_LEN];
      long timz;
***************
*** 76,82 ****
--- 83,96 ----
      sprintf(str,"%s %s %s [%s %c%02d%02d] \"%s\" ",
              remote_name,
              (do_rfc931 ? remote_logname : "-"),
+ #ifdef LOGUSER
+       /* B00042
+        * Keep a copy of the first 'user' id provided for .htaccess
+        */
+            (log_user[0] ? log_user : "-"),
+ #else
              (user[0] ? user : "-"),
+ #endif
              tstr,
              sign,
              timz/3600,
*** http_request.c.dist Tue Mar 28 13:54:54 1995
--- http_request.c      Wed Mar 29 12:39:29 1995
***************
*** 95,100 ****
--- 95,107 ----
      return 0;
  }
 
+ #ifdef LOGUSER
+       /* B00042
+        * Keep a copy of the first 'user' id provided for .htaccess
+        */
+       char log_user[MAX_STRING_LEN];
+ #endif
+
  void process_request(int in, FILE *out) {
      char m[HUGE_STRING_LEN];
      char w[HUGE_STRING_LEN];
***************
*** 102,107 ****
--- 109,121 ----
      char url[HUGE_STRING_LEN];
      char args[HUGE_STRING_LEN];
      int s,n;
+
+ #ifdef LOGUSER
+       /* B00042
+        * Keep a copy of the first 'user' id provided for .htaccess
+        */
+       log_user[0] = '\0';
+ #endif
 
      get_remote_host(in);
      exit_callback = NULL;
0

Featured Post

[Webinar] Cloud and Mobile-First Strategy

Maybe you’ve fully adopted the cloud since the beginning. Or maybe you started with on-prem resources but are pursuing a “cloud and mobile first” strategy. Getting to that end state has its challenges. Discover how to build out a 100% cloud and mobile IT strategy in this webinar.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This tutorial will discuss fancy secure registration forms, with AJAX technology support. In this article I assume you already know HTML and some JS. I will write the code using WhizBase Server Pages, so you need to know some basics in WBSP (you mig…
In this tutorial I will show you how to provide a dynamic RTF document on your website generated with data from your database. For this tutorial you will need Microsoft Word or WordPad, WhizBase and Microsoft Access. In this tutorial I will show …
Learn the basics of modules and packages in Python. Every Python file is a module, ending in the suffix: .py: Modules are a collection of functions and variables.: Packages are a collection of modules.: Module functions and variables are accessed us…
The viewer will learn how to look for a specific file type in a local or remote server directory using PHP.
Suggested Courses

972 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question