htaccess with password protect only??

[RenoWV]

Is it possible to protect a directory so a person would only have to know either a password or a username to gain access?

I need minimal protection and would like to use htaccess, but don't want the box that requires both username and password -- one or the other would be adequate.

Thanks for any advice...

----------------------------------------

 

[Wishdiak]

RenoWV,

You could always use the same string of characters for both the username & password.

Wishdiak
A+, Network+, Security+, MCSA: Security 2003

http://www.wishdiak.com

 

[RenoWV]

Thanks Wishdiak -- that's the way I'll do it if it turns out (as I expect) that there is no way to only require password access.

Ideally I'd be able to put a "hint" such as "Username & password are the same", but am assuming that the access box that is launched cannot be formatted. If I'm wrong about that, then I'd welcome the correction...

------------------------------------------

 

[Wishdiak]

RenoWV,

I was having DNS server issues earlier, and couldn't get to Apache's site to confirm that both user and pass are required for authentication.

http://httpd.apache.org/docs/howto/auth.html

states that they are both required, but there are probably ways around this (such as writing your own login script in Perl or php).

Wishdiak
A+, Network+, Security+, MCSA: Security 2003

http://www.wishdiak.com

 

[RenoWV]

Hi Wishdiak,

I anticipated that may be the case, so yesterday had posted a question over at the TekTip Perl forum which says in part:

I was hoping I could find something that would allow me to define the common password in the code, upload to the specified folder, chmod to 755, then add "require pass_word_only.pl" to the top of any scripts I wanted to protect within the directory.

The idea here is when the script was called that had the "require passwordonly.pl" line, a password box would launch, and the user would not be able to proceed until they either put in the correct pw or closed the box.

If it turns out that a person has to use both username & pwd, then that will be fine -- I was just hoping that a simpler alternative could be implemented. But if not, that's ok too....

----------------------------------