The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
1answer
817 views

NGINX basic auth timeout?

I've protected a directory with satisfy and basic_auth, but seems that the validation is not stored in a cookie which after some time it's deleted, seems it's ip or something based. So i login once ...
3
votes
1answer
382 views

How can I stop brute force with IIS6 basic http authentication?

Is there a way to restrict incorrect login attempts and add some sort of timeout to stop basic auth being brute forced, using IIS?
1
vote
1answer
275 views

Does basic authentication allow multiple users to login with the same username and password?

Using IIS 6 or 7, does basic auth allow two people to use the same username/password combination to access the site simultaneously?
3
votes
4answers
1k views

Basic Auth on DirectoryIndex Only

I am trying to configure basic auth for my index file, and only my index file. I have configured it like so: <Files index.htm> Order allow,deny Allow from all AuthType Basic ...
4
votes
2answers
4k views

IIS Basic Authorization ala .htaccess/.htpasswd in apache

How do I implement the protection of the pages (asp.net mvc app), so when I hit the home page or any other pages within the application I get a login dialog popup in the browser I'm looking for ...
1
vote
1answer
673 views

How can I use munin-node apache_ with basic authentication?

munin-node-configure --suggest tells me that the apache_* nodes cannot be used: apache_accesses | no | no [Port 80: Authorization Required] apache_processes | no | no ...
4
votes
1answer
2k views

Where to set username/password for BASIC authentication in IIS7

I have a .net web app running on iis7 (windows 2008) and want to add some simple protection to it. I've managed to set up BASIC authentication, but cant work out where I set the username/passwords ...
0
votes
1answer
2k views

PAM authentication failure with HTTP Basic auth and mod_auth_pam on Apache

I'm trying to set up HTTP Basic auth with PAM on Apache (running on Ubuntu 10.04). I have a VirtualHost setup with SSL and the options below for HTTP Basic authentication: AuthBasicAuthoritative off ...
0
votes
1answer
1k views

IIS 7.5 Basic authorization issue

When I log on using correct user name\password (I always copy-paste them) I get 401.1 error. User name and password are correct (user is created on server locally, not a domain one). I can run program ...
1
vote
2answers
73 views

apache AuthBasic denying correct login

I created a vhost in apache with this config Alias /my /srv/my <Location /my> AuthType basic AuthName "private area" AuthBasicProvider file AuthUserFile ...
1
vote
3answers
410 views

iis' basic authentication system blocks too many login attempts?

I'm doing a security analysis of a network for a university project. The servers use the basic autentication of iis, integrated with ssl. I'm now considering the possibility of a bruteforce attack. I ...
0
votes
1answer
1k views

basic auth across multiple subdomains

I'm setting up a basic test environment to test drive multiple sites I co-maintain with a colleague. What I am trying to achieve is to password protect the entire domain with basic auth. This is ...
2
votes
2answers
1k views

IIS7 How-To : Basic Folder Authentication

i am really lost with this problem and im hoping someone can help me out with some good old fashioned instructions. i was able in windows 2003 to setup a folder on our webserver so when navigating to ...
1
vote
3answers
2k views

Prevent AD account lock when using basic authentication

I want to setup basic authentication on a virtual directory (in IIS6). It looks as if a malicious user can use the dialog (uid/pwd challenge) to try and login with a domain account and lock this ...
3
votes
1answer
800 views

Excluding the nagios directory from Basic Auth that is set for the root directory

I have basic auth from the root directory for Apache. I am setting it like so. /etc/httpd/conf.d/xxxx.conf <Location /> AuthType Basic AuthUserFile xxxxxxxx AuthName "Restricted ...
3
votes
1answer
1k views

How can I enable http auth in lighttpd for all directories except one?

I am trying to authenticate access to everything in webroot (/) except anything that resides in a particular directory (/directory/) and I've tried both of these options to no avail: $HTTP["url"] =~ ...
1
vote
0answers
398 views

Prevent Authentication Prompt When Streaming Office Documents

I have an issue where when streaming office documents from SQL Server, an authentication dialog prompts for credentials even though the user has been authenticated via basic auth in the browser. ...
0
votes
2answers
561 views

Apache2 mix of two location restrictions: basic auth and ip-based

I want to restrict a staging server with basic auth, except for one special location, which should not have basic auth but be restricted to a client IP block. My virtual host section looks like this: ...
1
vote
1answer
488 views

Basic authentication not occurring to a remote machine on IIS7

I have a sub-directory of my IIS7 website that I want to lock-down with basic authentication. I've gone into IIS manager, chosen Authentication the designated directory and enabled Basic ...
1
vote
1answer
287 views

mercurial hgwebdir error with basicauth in apache2

I'm having kind of a strange error that I'm trying to track down. I was trying to setup mercurial on my home server this weekend. I seem to have it running up to the point where I'm trying to get ...
1
vote
1answer
278 views

How is using client certificates more secure than TLS plus basic authentication?

I've read that securing services with client certificates is more secure than using the combination of TLS with basic authentication. Client certificates have substantial drawbacks in terms of ...
0
votes
1answer
398 views

mod_auth wrong password authentication?

i have a server running apache2 in a debian lenny. something strange happen with the folders protected by .htaccess. basically, if you put a wrong password but formed by the_correct_password + ...
0
votes
1answer
1k views

Apache, Tomcat 5 and problem with HTTP basic auth

I have setup a Tomcat with a webapp that uses http basic auth in some of its URLs. There is a Apache server in front of the Tomcat. I have setup Apache as a proxy like this (all traffic should go ...
5
votes
2answers
460 views

How do I secure a .NET (MVC) website prior to launch?

I have a .NET (MVC2) website that is in development. I have deployed it to some production infrastructure, and tested it over the internet with anonymous access (as it will be once it is live) and it ...
0
votes
2answers
1k views

IIS7: Allow users to identify themselves with either “Windows Authentication” or “Basic Authentication” on the same file

Is it possible to have both windows authentication and basic authentication enabled on one .asmx page in IIS7? What I want is: Someone calls webservice If possible, use windows authentication (e.g. ...
0
votes
2answers
800 views

Dynamic AuthUserFile in apache with mod_rewrite. Is it possible?

I've got a server with several scponly accounts and I want to provide http access under Basic Auth. The first part of the problem is solved, using mod_rewrite to chop and select the right directory ...
1
vote
2answers
434 views

http basic auth using .htacces/.htpasswd allowing slightly incorrect passwords

I've got a few sites with directories protected by http basic auth implemented via .htaccess files paired with .htpasswd files. I've noticed that with a password ending in "et!" I can get in by ...
0
votes
1answer
383 views

Allow website access from specific subnet, otherwise ask for credentials

How can I configure IIS 6 to allow access to a sub folder from our intranet without any authentication (well, the IP address needs to be checked but that's already working) from the internet only ...
0
votes
1answer
623 views

Protect all XML-RPC calls with HTTP basic auth but one

I set up a Django project for smartphone serving XML-RPC methods over HTTPS and using basic auth. All XML-RPC methods require username and password. I would like to implement a XML-RPC method to ...
0
votes
2answers
120 views

Does using Apache Basic Auth affect yum installations?

I don't have further information yet, but I am going to be troubleshooting this in the morning and I wanted to get a head-start. Is there any reason that a yum install (that worked fine yesterday) ...
3
votes
1answer
1k views

NGINX basic auth only for POST

I'm settings up nginx to serve Mercurial repositories. It works when not using basic authentication at all, or when I use basic authentication all over. What I want to do is to just use basic auth on ...
3
votes
3answers
1k views

Apache redirect to https for basic auth

I have a tricky variation on an old problem. I have an apache based site that should generally be accessed via http/port 80. However for certain areas protected areas that require authentication ...
1
vote
1answer
1k views

squid closes the connection when presented with “401 Unauthorized”

This is the conversation: ==> GET http://xy/z HTTP/1.1 <== HTTP/1.0 401 Unauthorized / Proxy-Connection: close When bypassing Squid (squid/3.0.STABLE6), I get the HTTP basic authentication ...
0
votes
1answer
96 views

Weird htaccess file

I am working on a client's site, and I spot this htaccess file. # -FrontPage- IndexIgnore .htaccess */.??* *~ *# */HEADER* */README* */_vti* <Limit GET POST> order deny,allow deny from all ...
0
votes
1answer
588 views

Root URL forces IE to “HTTP BASIC” authentication mode?

I have a RoR app that has worked fine for quite some time, but after a recent deployment, all of the IE users in the office have been presented with a IE username and password popup dialog when they ...
1
vote
1answer
2k views

basic authentication with domain accounts on Windows Server 2008

A very weird issue that never encountered with Windows Server 2003: when configuring basic authentication to restrict access to specific directories in IIS7 I've done the following: Enabled basic ...
2
votes
1answer
475 views

Limiting the number of basic authentication attempts in Apache

I'm using HTTPS + Basic authentication to protect a resource. How can I throttle authentication attempts to protect against brute force attacks?
2
votes
4answers
639 views

Lock down Wiki access to password only but remain open to a subnet via .htaccess

Basically we have a Wiki that has some sensitive information stored in it - not the best I know but my predecessor set it up. I want to be able to request password access from any one who is not on ...
3
votes
2answers
10k views

service static files under nginx & HTTP-Authentication

I have an app deployed in testing mode on a server. Access to it has been restricted to a select group of users via HTTP-Authentication. That works fine. The problem is that if I serve static files ...
0
votes
2answers
767 views

apache basic auth require group not throing forbidden

i have a basic auth setuped with user and groups AuthType Basic AuthName "GSD Dev Area" AuthUserFile /coding/conf/passwords/gsdesign/htpasswd AuthGroupFile /coding/conf/passwords/gsdesign/groups ...
5
votes
4answers
3k views

Respond to HTTP OPTIONS with basic auth

We have a web site hosting Office documents behind IIS6 Basic authentication. IE has an authentication token for basic auth, which it presents to download the file. The user clicks "Open", and then ...