Register Members List Search Today's Posts Mark Forums Read

Reply
 
Article Options
Protecting forum parts by htaccess
HolyKiller
Join Date: Dec 2006
Posts: 172

by HolyKiller HolyKiller is offline 05 Jan 2010
Rating: (2 votes - 5.00 average)

I just found a thread about protecting Admin Panel via htaccess. It is usable and +1 for the author, but... The thing is, it supports only one login which need to be shared, if you have more admins, or, you want to protect Moderator panel too and have more than one moderator. So after every staff change, you need to change your pass and tell everybody, there is a new password. Second thing, you need to edit existing vbulletin files, so, you probably need to edit them over and over again after every vBulletin update. AND the third thing, that password are plain-text stored, which is not good at all.

Once again, i dont want insult that thread author, but, i just want share my way, how to do it more "sophisticated" AND secure

1) Create a files named .htaccess and .htpasswd
(if you using Windows and get error message, create a htaccess.txt and htpasswd.txt files for now)

2) In htaccess add:

Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

- You need to set a correct path, so, you can get it easilly like this:
2a) Create a new file and add code:

Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

2b) Name that file like info.php and put it INTO your directory which you want to procect (admincp, cpmod, ... etc...)

2c) Open your browser and type path to your info.php file, so something like:
http://www.yoursite.com/forum/admincp/info.php

2d) You get a full information about your php. You need to find (use browser function) a row named SCRIPT_FILENAME and on the right side you can see absolute path to info.php file. Something like this: /var/www/yoursite.com/forum/admincp/info.php

2e) Copy that path into htaccess file and rewrite info.php to .htpasswd. So you actually got this in .htaccess file:


Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

3) Now you need to set up some usernames nad hashed passwords. I recomanded THIS page. It rly helps you. Just insert your username and password (that name and pass, what you want to use for protecting your files) and click on "Create Password". So for example we use username Anton and passsword whiteglass and we get this:


Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

and thats exactly what we need, so we just copy&paste this into .htpasswd file. By the way, you can add more users into .htaccess file. Just generate more name/pass and add them, one on each row. So you can use your own name and pass, and your co-admin another username and password. Or if you protecting your modcp directory, you can create specific login for each moderator

4) Save both files and upload them on your server.

5) Now, try to access your admincp. You shoud get a small window popped up. If not, you did something wrong and you need to start over.


BTW: If you used htaccess.txt and htpasswd.txt names, you need to rename them after upload. The correct names are .htaccess and .htpasswd WITH that DOT on start!

Dont forget to delete that info.php file

Hope it helps

Yea, and sorry for my english, i'm from Czech republic

Holy

Last edited by HolyKiller; 05 Jan 2010 at 23:57..
Views: 12498
Reply With Quote
Comments
  #2  
Old 06 Jan 2010, 00:02
HolyKiller HolyKiller is offline
 
Join Date: Dec 2006
If you already using the second way, make sure you revert your index files back to original vBulletin first
Reply With Quote
  #3  
Old 07 Jan 2010, 04:35
Hornstar's Avatar
Hornstar Hornstar is offline
 
Join Date: Jun 2005
Real name: Matt
Thanks, this way is a little nicer then the current way I am, plus I like how the passwords are not in plain text anymore.
Reply With Quote
  #4  
Old 07 Jan 2010, 14:18
we_are_borg we_are_borg is offline
 
Join Date: Aug 2004
On a small side note never put .htpasswd in a place that is world readable it should go before the directory where you place your webcontent, most systems will allow this or have even a special place for it.

If your lazy like me there is a program called Deadlock that will use a database and normal htaccess and htpasswd files to grant access to it.
Reply With Quote
  #5  
Old 08 Jan 2010, 15:50
abdobasha2004's Avatar
abdobasha2004 abdobasha2004 is offline
 
Join Date: Aug 2008
nice one for users who have no access to make fire walls
__________________
Egypt News website, latest Egyptian news updated instantly.
Reply With Quote
  #6  
Old 14 Sep 2010, 07:29
Shabcool Shabcool is offline
 
Join Date: Jul 2008
Thanks dir
Reply With Quote
  #7  
Old 08 Nov 2010, 13:18
rtyagis rtyagis is offline
 
Join Date: Feb 2009
Nice simple article for new users like me. Anyway thanks.
__________________
PolicyWala | Forum
Reply With Quote
  #8  
Old 17 Sep 2011, 17:59
FReeSTER FReeSTER is offline
 
Join Date: Jun 2006
Thank you mate, I will try this
Reply With Quote
  #9  
Old 23 Sep 2011, 18:07
TheLastSuperman's Avatar
TheLastSuperman TheLastSuperman is offline
 
Join Date: Sep 2008
Real name: Michael Miller Jr
I've always liked these as well:

.htaccess password protect a single File:
http://webdesign.about.com/od/htacce...ord_1_file.htm

.htaccess password protect a Folder:
http://webdesign.about.com/od/htacce...hthtaccess.htm

.htaccess authentication generator:
http://www.htaccesstools.com/htaccess-authentication/

.htaccess password generator:
http://www.htaccesstools.com/htpasswd-generator/
__________________
Daddy Does Dios and Figs!
https://www.linkedin.com/in/thelastsuperman

Search - Use the search feature to find similar issues/answers.
Information - Include screenshots, copy/pasted error codes, url etc.
Fixed - Please return to your thread/post and let us know how it was fixed!
Thanks - For participating! Click the "Like" on a post if someone helped you!
Reply With Quote
  #10  
Old 27 Oct 2012, 03:22
Dorgham's Avatar
Dorgham Dorgham is offline
 
Join Date: May 2012
It is really the best protection for all website owners
Thanks a lot
__________________
AdSense revenue sharing 100% - [ Hanan ]
News, egypt : أخبار مصر - Photo, picture : صور
Reply With Quote
  #11  
Old 24 Mar 2013, 18:00
matrex722's Avatar
matrex722 matrex722 is offline
 
Join Date: Jan 2007
thanks man
nice topic
Reply With Quote
  #12  
Old 01 Jun 2014, 02:47
DNN DNN is offline
 
Join Date: Mar 2011
What you mentioned didn't work, unless the part where it says "/*link.to.your.protected.dir*/" is supposed to have "mywebsite.com/admincp."
Reply With Quote
  #13  
Old 01 Jun 2014, 03:08
ForceHSS's Avatar
ForceHSS ForceHSS is offline
 
Join Date: Apr 2008
This can be done from any cpanel without all this extra work
Reply With Quote
Reply



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Article Options

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


New To Site? Need Help?

All times are GMT. The time now is 15:06.

Layout Options | Width: Wide Color: