[AU_student_iceBook]

I am using dreamweavermx and haven't found anything helpful in the help.

Thanks.

[jasong]

This is mostly a server-side issue. If you are using Apache this is controlled using .htaccess

See http://httpd.apache.org/docs/howto/auth.html for more info.

-- Jason

[AU_student_iceBook]

Thanks for the post. I will look into it.

[AU_student_iceBook]

Any other suggestions? I am not savy enough to pull off the Apache stuff.
Help?

[Synotic]

Originally posted by AU_student_iceBook:
Any other suggestions? I am not savy enough to pull off the Apache stuff.
Help?

What are you stuck on?

[Diggory Laycock]

I'd suggest Apache Protect

[AU_student_iceBook]

Originally posted by Synotic:
What are you stuck on?

This is not a website that I host from my computer, it is from an FTP server.
Is there a way to protect a .html file there?

[benb]

Originally posted by AU_student_iceBook:
This is not a website that I host from my computer, it is from an FTP server.
Is there a way to protect a .html file there?

Not from FTP. You would need control over the server. Or a hosting company that would allow you to do this or will implement it for you.

[AU_student_iceBook]

Originally posted by benb:
Not from FTP. You would need control over the server. Or a hosting company that would allow you to do this or will implement it for you.

bummer. that's what I was afraid of.
Thanks for the help.

[Arkham_c]

Originally posted by AU_student_iceBook:
bummer. that's what I was afraid of.
Thanks for the help.

If you have a cgi-bin, you can probably get it to work.

The basic things you need are:

1) a folder with a .htaccess file

2) a file with usernames/passwords in it, with the passwords encoded using "crypt"

Number (1) is straightforward through ftp. Create a file like this:

Code:
AuthType Basic
AuthName "My Zone"
AuthUserFile /Library/WebServer/users/passwd
Require user somebody

Number (2) is tricky, but only because you need the "crypted" password. There are a lot of ways to get it -- using htpasswd is the preferred way, but you need shell access for that.

If you have a cgi-bin, you could make a CGI like this, which should work:

Code:
#!/usr/bin/perl

$login = "someuser";
$password = "somepass";

@passch = ('a'..'z');
for ($l = 0; $l < 2; $l+=1)
{
    $randnum = int(rand($#passch + 1));
    $salt .= @passch[$randnum];
}
print "Content-type: text/html\n\n";

print join(":",$login,crypt($password, $salt));

Change "someuser" and "somepass" to the right values. Put that in your CGI-BIN. Set it +executable by all. Run it from your web browser. Take the output, and put it in the file referenced by your .htaccess file's AuthUserFile entry.

That should do it.

[step]

dumb question, but would putting a page called secret1.html in a directory that already had an index.html page , and had no other links to it, be accessible in any way other than going directly to it's address name ?
could it turn up in google or someplace?

[sandsl]

Use javascript, not as secure as server side, but better than a hidden file:

http://javascript.internet.com/passwords/

[Arkham_c]

Originally posted by sandsl:
Use javascript, not as secure as server side, but better than a hidden file:

http://javascript.internet.com/passwords/

Neither JavaScript nor hidden files are valid ways to ensure any kind of security. Anyone can get by JavaScript security if they can read JavaScript code. If you want security, it MUST be on the server side.

Basic Auth (as I described implementing above) is secure and simple. If you can't go that route, then use a CGI that throws a 401 status back if the user and password are not supplied. Use the features of the browser!

[AU_student_iceBook]

Originally posted by Arkham_c:
Neither JavaScript nor hidden files are valid ways to ensure any kind of security. Anyone can get by JavaScript security if they can read JavaScript code. If you want security, it MUST be on the server side.

Basic Auth (as I described implementing above) is secure and simple. If you can't go that route, then use a CGI that throws a 401 status back if the user and password are not supplied. Use the features of the browser!

forgive my ignorance, but what is CGI-bin?

[AU_student_iceBook]

Originally posted by sandsl:
Use javascript, not as secure as server side, but better than a hidden file:

http://javascript.internet.com/passwords/

Thanks. This worked for what I needed.
More peace of mind for the client than anything else.