Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Our intranet use mod_ldap to authenticate users to our internal Active Directory server as follows:

<Location /***/>
    AuthType Basic
    AuthName "***"
    AuthBasicProvider ldap
    AuthLDAPUrl "***"
    require valid-user
</Location>

We want to allow our users to hit our site over the internet, but unfortunately Basic authentication is done in plain-text, which would expose our AD credentials on the net.

I realize that I could protect the entire site with ssl, but the only thing I'm really concerned about are the credentials themselves.

What is the best way to protect my AD credentials without using https:// for the entire site?

Note: I've tried substituting "Digest" for "Basic", but that doesn't work.

share|improve this question
    
The procedure described in this question may apply. serverfault.com/questions/62570/cookie-authentication-in-apache/… –  Zoredache Oct 6 '10 at 16:21
    
Whichever resources you intend to protect (i.e. things only employees should see - which is why you're requiring authentication to begin with, right?) will be sent in plain-text over the internet if you're not using SSL - seems like more than the AD credentials are at stake here..? –  danlefree Oct 6 '10 at 16:27
    
The system has the likelihood of containing network topology information and internal IP addresses. Not something I want on the public internet, but also not something sensitive enough to worry too much about. It is really only the credentials I am concerned about. –  Brent Oct 6 '10 at 16:35
add comment

4 Answers

You will never be able to use digest authentication with LDAP because digest auth obscures (via MD5) the password so it cannot be compared with the ldap password.

You can solve this problem by using cookies rather than basic auth. See, e.g., pubcookie http://www.pubcookie.org/ or Apache2::AuthCookie http://search.cpan.org/~mschout/Apache-AuthCookie-3.15/lib/Apache2/AuthCookie.pm

Really, though, what is the problem with using SSL everywhere? You're wasting effort to remove security.

share|improve this answer
add comment

I replied here http://stackoverflow.com/questions/6458398/apache-2-2-redirect-to-ssl-then-do-auth-with-solution-but-is-it-crap/7822709#7822709, a solution which use SSLRequireSSL, and a ErrorDocument 403 returning an html 403 error page containing a JavaScript which will reload the page to HTTPS ... the best solution I found without splitting the configuration file in two, one loaded by the VirtualHost on port HTTP, on the other on port HTTPS.

share|improve this answer
add comment

The answer is, you can't. Once the user authenticates with basic authentication, his or her browser will send an Authorization header with each subsequent request, containing his or her password in the clear (only Base64 encoded). So the only way to protect the password is to force HTTPS on the entire site, at least after they authenticate.

share|improve this answer
add comment

Use a rewrite rule to direct all authenticated pages to https:. This will happen before the authentication request happens. Also require ssl for all authenticated pages.

EDIT: You can use rewrite rules to force http: requests to https: requests. This happens for all requests that match the pattern you are matching on. This would normally happen before the page requiring authentication happens. This can be be inside a location or directory definition. The rest of the site will be on http, unless accessed using https. Rewrite conditions are quite flexible as th what is matched, and what it gets rewriten to.

#   Force clients from the Internet to use HTTPS
RewriteEngine        on
RewriteCond          %{REMOTE_ADDR} !^192\.168\.1\.[0-9]+$
RewriteCond          %{HTTPS} !=on
RewriteRule          .* - [F]

On the security side you require ssl. Like password authentication this would happen before access to the page. Be sure to use satisfy all on your security rules. Add SSLRequireSSL to the conditions for the authenticated areas.

Further details are covered by the Apache SSL HowTo.

share|improve this answer
    
If I'm understanding you correctly, since the user must authenticate before viewing ANY of the site, this is the equivalent of redirecting the entire site to https:// Correct? Or is there a way to redirect to https:// only if the user hasn't yet authenticated? –  Brent Oct 6 '10 at 15:34
1  
See edits. You can match URLS. Once they have been switch to HTTPS. they will stay there unless redirected back to HTTP. You can reverse the rewrite rules for unsecured areas. (Don't rewrite shared resourse areas like css and graphics.) With basic authentication, the credential are passed on subsequent requests to that URL. –  BillThor Oct 7 '10 at 3:13
1  
+1 for pointing out that credentials are passed on subsequent requests. I had forgotten about that. This therefore necessitates that the entire site be secured. –  Brent Oct 8 '10 at 12:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.