Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

i have a server running apache2 in a debian lenny.

something strange happen with the folders protected by .htaccess.

basically, if you put a wrong password but formed by the_correct_password + _more_chars it let you enter. if you put the incorrect password in other way, of course it tells forbidden.

so i ask, is this behavior correct? if you put a correct password first + any other chars let you enter? how can i make apache check for a exactly correct password and not a correct password in the beginning of the entered password.

i hope i have explained the problem in the more clear way :)

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Are you storing the passwords in the classic "crypt" DES format (14 characters long, a-z, A-Z, 0-9, "." and/or "/" characters, like: "papAq5PwY/QQM", with no $ signs in the encrypted password)?

If you are, that would explain it. That format is limited to 8 characters, so anything past 8 characters gets ignored. If the correct password is 8 (or more) characters, adding more characters at the end won't make a difference.

To fix it, use MD5 or SHA to store the passwords instead. If you're using the "htpasswd" command, add "-m" or "-s" to your options when you set the password.

share|improve this answer
    
you are right ! many thanks for the help :D –  shadow_of__soul Sep 13 '10 at 0:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.