access control: is the password transmitted securely?

[cheerful]

When I configure a directory as following

AuthType Basic
AuthName "Restricted Files"
AuthUserFile C:/passwords
Require user foo

Apache will ask user for id/password. Are they transmitted securely? Or are they transmitted as palin text? Anyway to make it secure?

Thanks!

 

[sleipnir214]

This from

http://httpd.apache.org/docs/howto/auth.html#basicworks:

Security caveat

Basic authentication should not be considered secure for any particularly rigorous definition of secure.

Although the password is stored on the server in encrypted format, it is passed from the client to the server in plain text across the network. Anyone listening with any variety of packet sniffer will be able to read the username and password in the clear as it goes across.

Not only that, but remember that the username and password are passed with every request, not just when the user first types them in. So the packet sniffer need not be listening at a particularly strategic time, but just for long enough to see any single request come across the wire.

And, in addition to that, the content itself is also going across the network in the clear, and so if the web site contains sensitive information, the same packet sniffer would have access to that information as it went past, even if the username and password were not used to gain direct access to the web site.

Don't use basic authentication for anything that requires real security. It is a detriment for most users, since very few people will take the trouble, or have the necessary software and/or equipment, to find out passwords. However, if someone had a desire to get in, it would take very little for them to do so.

Basic authentication across an SSL connection, however, will be secure, since everything is going to be encrypted, including the username and password.


Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[cheerful]

How would I be able to set up Apache with SSL? I am running the windows installation version, 2.0

Thanks!

 

[sleipnir214]

I've never set up HTTPS with Apache on Win32. I only run Apache on Linux.

You might also look at Digest Authentication



Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[cheerful]

Got digest working. Thanks!