.htaccess not encrypting?

[Mors78]

Hi,
I have apache installed on my windows box (i know thats bad but i'm playing) I'm trying to use .htaccess to protect my dir's but I've run into a problem. I create the .htaccess file and .htpasswd file as normal but when i try and log in it refused my password, so, after some playing, I found out that if I type in my encrypted password from the .htpasswd file then it lets me through ??!!

So, if my user name and password of mors/mors look like this in the .htpasswd file
mors:gr53454pft (for example)

At the login screen I try mors/mors, but it doesn't let me in, but if I try mors/gr53454pft then it does??

What am I doing wrong?? Why is it not enrypting it??

Any help appreciated.

Mors

 

[Newposter]

What version of Apache and Windows? I run Apache 1.3.2 on Windows 2K Pro very well - there's no problem doing this.

Did you use .htpasswd.exe to create your password file, or did you just save a text file using Notepad or some such editor? Please provide more details as to how you created .htaccess and .htpasswd, and the .htaccess file would help us help you, also. Newposter
"Good judgment comes from experience. Experience comes from bad judgment."

 

[Mors78]

I'm running 1.3.2 aswell. I used the .htpasswd.exe to create the password file and everything seems to go ok in the .htaccess file aswell, I created that with ultra edit.
It just doesn't seem to unencrypt the .htpasswd file when it reads it. Here's my .htaccess file:

AuthUserFile /phpdev/

http://www/pass/.htpasswd

AuthName "Mors Board authenticate"
AuthType Basic

require valid-user




Any idea's??

Mors

 

[Newposter]

I actually did not encrypt my password file, and was just contemplating doing so for better security. So the .htaccess routine works well for me in Win32 with a straight text password file. Now you've got me wondering if encryption does not work in Win32, even though it is supposed to. Any comments, especially from wullie? Newposter
"Good judgment comes from experience. Experience comes from bad judgment."

 

[Wullie]

Hi Guys,

Encryption does work on Windows but I had to use a different encryption than the windows default.

After you call the htpasswd app, type the following using your own user and pass.

htpasswd -cmb .htpasswd username password

If you have any problems with this, check your error logs and if there are any errors there, post them here.

Hope this helps Wullie

http://www.freshlookdesign.co.uk

http://www.searchit-now.co.uk

http://www.survivorhelp.co.uk

 

[Mors78]

Wullie, thanks for your reply, but when I type in the command you put in above using the cmb switch etc it does nothing but just repeat the options that go with the .exe if yo were to type "htpasswd" alone. e.g:


C:\phpdev\

http://www\pass>htpasswd

-cmb .htpasswd mors mors
Usage: htpasswd [-(c|d)] <passwdfile> <username>
-c: Create password file if it doesn't exist
-d: Delete the specified user


Also, I have checked my error log and it reports this when I try to log in and it wont allow me because it will only accept a raw password:

[Fri May 31 22:05:28 2002] [error] [client xxx.xxx.xxx.xxx] user mors: authentication failure for &quot;/&quot;: password mismatch



Any ideas??

Thanks

Mors

 

[Newposter]

A few things to check here:

1) If you use the -c switch, you must not already have the existing .htpasswd file in that directory. -c creates a new one.

2) I find the -cmb options listed when I do an htpasswd command. -m forces the MD5 format encryption that is supposed to work with Windows. -b uses the password from the command line rather than prompting for it when creating the user. Do you see the full list of options?

It did create the file as requested for me, and the password is encrypted. Newposter
&quot;Good judgment comes from experience. Experience comes from bad judgment.&quot;

 

[Mors78]

Thanks for the help but I've I worked out what had caused my problems-because i'm new to apache, I din't know there was a version of the file in apache\bin, so I downloaded a vers off the net, and it only allowed a couple of switches-must have been an old one.
It now recognises its a windows password and converts it accordingly.
-All's working now.

Thanks for your help

Mors