Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am somewhat new to Apache and the idea of authentication. I'm creating a front-end for a flood simulator which serves up images representing the simulation data. I'd like to restrict access to these images only to those who know the key to that simulation. There's no need for a full-blown username and password combo as the only functionality here is viewing simulations.

It seems like Apache authentication methods require a username and password or something similar. All I really want is for someone to temporarily be allowed to see the content they ask for when they enter the corresponding key on the homepage. I'm not really sure how to go about this so any help is appreciated.

share|improve this question

closed as off topic by Michael Hampton, MadHatter, Khaled, Scott Pack, freiheit Mar 24 '13 at 22:02

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

2  
Just give them unique URLs that have the key embedded in them. Like every other website does. –  Michael Hampton Mar 24 '13 at 7:09

3 Answers 3

up vote 2 down vote accepted

Let me start by saying that I think this is a bad idea; you want to make knowledge of the shared-secret (the "key to the simulation") a capability; that is, a secret which identifies a particular dataset and where knowledge of the secret is proof of authorisation to access the data set. This is security-through-obscurity and will give you very little control over access to the run data as time goes on: if you think the knowledge has spread, you can't exclude some people who possess the secret without excluding everyone.

But if you insist on doing it, then you don't have to do anything clever at all: merely put the secret into the URL. For example, suppose your datasets are stored under http://sets.example.com/data/, and that directory is unlistable. Given a set of secrets whose key is, say, b8ab010d69f6008384d39bd3c0efeb0c, store them under http://sets.example.com/data/b8ab010d69f6008384d39bd3c0efeb0c/; given a set of secrets with a different key, store them under a correspondingly different URL.

If you want a redirector from your main page ("allowed to see the content they ask for when they enter the corresponding key on the homepage") writing it becomes trivial: a one-liner where you enter any key and get redirected to http://sets.example.com/data/THAT-KEY/. No checking on the "key" need be done; if an invalid key is entered, the user just gets a 404 not found error.

Edit: the fastest way to make a directory unlistable is to put a zero-length index.html in it. But there are others, as ioctl as pointed out. And as I write this, I realise that all I have described is exactly what Michael Hampton was alluding to in his (extremely, perhaps overly) pithy but accurate comment on your question, above.

share|improve this answer
    
I understand your concern over the security over this idea. But the data is not particularly sensitive. I just want to avoid absolutely everybody having access to the information. The idea is the user could give the key to multiple people and they could all view the images. I think this will work for me, but even with what I've said you still think this is a bad idea, please let me know. I'd rather avoid doing things that are considered bad practice or unsafe. –  SethG Mar 24 '13 at 17:34
    
Hey, you should determine what works for you - that's noone else's call, and definitely not mine. My main issue with it the difficulty of access control: once the capability leaks, your only choices are to allow everyone who has it access, or to allow noone. If you're OK with that, then I'd suggest the scheme I described. –  MadHatter Mar 24 '13 at 17:50
    
IF you would indulge me once more, I'm not sure how to make a directory "unlistable" as you state above. I've searched for information on the matter and while I think I understand what you're saying, I don't know how to implement it. –  SethG Mar 24 '13 at 19:00

You could completely do this without apache.

Do you use a php/.net/ruby/whatever page that serves the images?

If you do, you could use an md5 generated key (there's a php function that does this) from the id of the image plus a "salt" which could also be their password, to make it less obvious that you are using the id (for example if id is 1 you can append "flood" to it and then make the md5 key: $key = md5("1"."flood")).

Then you could send the link to the user through other means, like email, an internal web page, an app etc.

For example httttp://myflodpage.coom/images.php?floodimage=<\MD5HERE>

share|improve this answer

Sorry I don't mean to hijack MadHatter's answer. To make a directory unlistable, you add the option "-Indexes" (without the quotes) in your virtualhost entry.

<VirtualHost *:80>

ServerAlias domain.com

ServerAdmin webmaster@domain.com

DocumentRoot /DocumentRoot

Options -Indexes OtherOption1 OtherOption2 etc..

<\VirtualHost>

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.