Password protection system for web app

[Jegenye 2001 Bt]

Could someone please suggest a very lightweight solution for protecting
directories on a web server? (membership system)

The job is basically this:
An administrator, after logging in via the web, should have the ability to
add/remove users who then could access their own password protected
directories only with their
browsers.

I know this could be easily done with Zope (I know that) and probably with
many other fully blown web application servers like Webware, etc. of which
there are many.
But now all I need some CGI hacks since I don't want to deploy something
heavier that that.

I've searched on www.python.org and Google but I haven't found much.

I found some Perl solutions, which work .htaccess files, and PHP thingies,
but I'd really like to hack on Python scripts but not on this part...
Either HTTP basic authentication or cookie based authentication would do.

Thanks in advance,

Miklós

[Peter Hansen]

Re: Password protection system for web app

Jegenye 2001 Bt wrote:[color=blue]
>
> Could someone please suggest a very lightweight solution for protecting
> directories on a web server? (membership system)
>
> The job is basically this:
> An administrator, after logging in via the web, should have the ability to
> add/remove users who then could access their own password protected
> directories only with their
> browsers.[/color]

That doesn't help. What is *in* these directories? Or do you mean
to use the term in the sense of "folder of files"?

More importantly: how much do you want to protect the contents from
prying eyes? Is this on a local network, and therefore considered
secure from hackers (disregarding the fact that this is never the case)?
Does it need to encrypt data going across the web? After all,
without encryption (and therefore SSL/HTTPS) dozens of people could
intercept your data and read it or the passwords.

Or is the data and application almost totally unimportant, and all
you are trying to do is prevent casual/accidental misuse of one
person's account by another?

-Peter

[Jegenye 2001 Bt]

Re: Password protection system for web app

Yes, folder of files.
No, I doubt any SSL/HTTPS stuff would be needed.
Though the data is not "unimportan t" at all, but I think basic HTTP
authentication (.htaccess files) or cookie based protection would do just
fine.
(Btw, HTTPS is available so that could be used as well, I think. It ought
to work with either of the above, aren't I right?)
All in all, I'm after a quick (and dirty?) solution to Pythonically do the
above job. I guess I could do this relatively quickly but I don't feel like
coding this part at all.
Thanx a lot.

Best,
Miklós


Peter Hansen <peter@engcorp. com> wrote in message
news:3F8C0474.3 3FC602A@engcorp .com...[color=blue]
> Jegenye 2001 Bt wrote:[color=green]
> >[/color]
>
> That doesn't help. What is *in* these directories? Or do you mean
> to use the term in the sense of "folder of files"?
>
> More importantly: how much do you want to protect the contents from
> prying eyes? Is this on a local network, and therefore considered
> secure from hackers (disregarding the fact that this is never the case)?
> Does it need to encrypt data going across the web? After all,
> without encryption (and therefore SSL/HTTPS) dozens of people could
> intercept your data and read it or the passwords.
>
> Or is the data and application almost totally unimportant, and all
> you are trying to do is prevent casual/accidental misuse of one
> person's account by another?
>
> -Peter[/color]

[Andrew Clover]

Re: Password protection system for web app

"Jegenye 2001 Bt" <jegenye2001@fw .hu> wrote:
[color=blue]
> Could someone please suggest a very lightweight solution for protecting
> directories on a web server? (membership system)[/color]

Depends on what the web server is, and how it's set up. The obvious
solution for Apache is to put mod_auth stuff in .htaccess. You can then
let Apache do both the authentication and the directory browsing.
[color=blue]
> An administrator, after logging in via the web, should have the ability to
> add/remove users who then could access their own password protected
> directories only with their browsers.[/color]

This can be done either by having the CGIs update the .htpasswd file
directly, or with a database password backend like mod_auth_mysql.
[color=blue]
> I know this could be easily done with Zope (I know that) and probably with
> many other fully blown web application servers like Webware, etc. of which
> there are many. But now all I need some CGI hacks[/color]

Doing HTTP authentication yourself with CGI has problems. Primarily, that
Apache doesn't pass the Authorization header to your scripts (unless you
recompile it with the SECURITY_HOLE_P ASS_AUTHORIZATI ON switch). With IIS
you also have to be sure to turn all auth features off (anon access only)
and remove the default error page for 403, or auth won't work.
[color=blue]
> Either HTTP basic authentication or cookie based authentication would do.[/color]

If you can only do standard-CGI, without proper config access to the server,
cookie-based auth is probably your easiest solution, yes.

--
Andrew Clover
mailto:and@doxd esk.com

http://www.doxdesk.com/

[Jegenye 2001 Bt]

Re: Password protection system for web app


Andrew Clover <and-google@doxdesk. com> wrote in message
news:2c60a528.0 310141110.604ac c0@posting.goog le.com...[color=blue]
> "Jegenye 2001 Bt" <jegenye2001@fw .hu> wrote:
>[color=green]
> > Could someone please suggest a very lightweight solution for protecting
> > directories on a web server? (membership system)[/color]
>
> Depends on what the web server is, and how it's set up. The obvious
> solution for Apache is to put mod_auth stuff in .htaccess. You can then
> let Apache do both the authentication and the directory browsing.
>[/color]
Yes, it's Apache. (Sorry, I had thought that's obvious from my mentioning
..htaccess files in my original post.) (+Linux, actually)
[color=blue]
>
> This can be done either by having the CGIs update the .htpasswd file
> directly, or with a database password backend like mod_auth_mysql.
>[/color]
And to have some open sourced Python code, which does exactly that, is what
I'd be happy with..
[color=blue]
>
> Doing HTTP authentication yourself with CGI has problems. Primarily, that
> Apache doesn't pass the Authorization header to your scripts (unless you
> recompile it with the SECURITY_HOLE_P ASS_AUTHORIZATI ON switch). With IIS
> you also have to be sure to turn all auth features off (anon access only)
> and remove the default error page for 403, or auth won't work.
>[/color]
Uh, that's valuable input, thanx for telling me. So it seems the
administering script itself cannot be protected that way..
[color=blue][color=green]
> > Either HTTP basic authentication or cookie based authentication would[/color][/color]
do.[color=blue]
>
> If you can only do standard-CGI, without proper config access to the[/color]
server,[color=blue]
> cookie-based auth is probably your easiest solution, yes.
>[/color]
Er, I'd be happy as well with some code which does this...

I really don't feeeeeeeeeeeeel like coding (and testing) this authentication
part at all, I'd just want to throw in some pre-made thinggy. ;)

Thanx a lot,
Miklós


--
Prisznyák Miklós
---
Jegenye 2001 Bt. ( mailto:jegenye2 001@parkhosting .com )
Egyedi szoftverkészíté s, tanácsadás
Custom software development, consulting

http://jegenye2001.parkhosting.com