The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
1answer
1k views

PAM authentication failure with HTTP Basic auth and mod_auth_pam on Apache

I'm trying to set up HTTP Basic auth with PAM on Apache (running on Ubuntu 10.04). I have a VirtualHost setup with SSL and the options below for HTTP Basic authentication: AuthBasicAuthoritative off ...
0
votes
1answer
1k views

IIS 7.5 Basic authorization issue

When I log on using correct user name\password (I always copy-paste them) I get 401.1 error. User name and password are correct (user is created on server locally, not a domain one). I can run program ...
1
vote
2answers
72 views

apache AuthBasic denying correct login

I created a vhost in apache with this config Alias /my /srv/my <Location /my> AuthType basic AuthName "private area" AuthBasicProvider file AuthUserFile ...
1
vote
3answers
375 views

iis' basic authentication system blocks too many login attempts?

I'm doing a security analysis of a network for a university project. The servers use the basic autentication of iis, integrated with ssl. I'm now considering the possibility of a bruteforce attack. I ...
0
votes
1answer
1k views

basic auth across multiple subdomains

I'm setting up a basic test environment to test drive multiple sites I co-maintain with a colleague. What I am trying to achieve is to password protect the entire domain with basic auth. This is ...
2
votes
2answers
1k views

IIS7 How-To : Basic Folder Authentication

i am really lost with this problem and im hoping someone can help me out with some good old fashioned instructions. i was able in windows 2003 to setup a folder on our webserver so when navigating to ...
1
vote
3answers
2k views

Prevent AD account lock when using basic authentication

I want to setup basic authentication on a virtual directory (in IIS6). It looks as if a malicious user can use the dialog (uid/pwd challenge) to try and login with a domain account and lock this ...
3
votes
1answer
748 views

Excluding the nagios directory from Basic Auth that is set for the root directory

I have basic auth from the root directory for Apache. I am setting it like so. /etc/httpd/conf.d/xxxx.conf <Location /> AuthType Basic AuthUserFile xxxxxxxx AuthName "Restricted ...
3
votes
1answer
1k views

How can I enable http auth in lighttpd for all directories except one?

I am trying to authenticate access to everything in webroot (/) except anything that resides in a particular directory (/directory/) and I've tried both of these options to no avail: $HTTP["url"] =~ ...
1
vote
0answers
375 views

Prevent Authentication Prompt When Streaming Office Documents

I have an issue where when streaming office documents from SQL Server, an authentication dialog prompts for credentials even though the user has been authenticated via basic auth in the browser. ...
0
votes
2answers
507 views

Apache2 mix of two location restrictions: basic auth and ip-based

I want to restrict a staging server with basic auth, except for one special location, which should not have basic auth but be restricted to a client IP block. My virtual host section looks like this: ...
1
vote
1answer
466 views

Basic authentication not occurring to a remote machine on IIS7

I have a sub-directory of my IIS7 website that I want to lock-down with basic authentication. I've gone into IIS manager, chosen Authentication the designated directory and enabled Basic ...
1
vote
1answer
276 views

mercurial hgwebdir error with basicauth in apache2

I'm having kind of a strange error that I'm trying to track down. I was trying to setup mercurial on my home server this weekend. I seem to have it running up to the point where I'm trying to get ...
1
vote
1answer
273 views

How is using client certificates more secure than TLS plus basic authentication?

I've read that securing services with client certificates is more secure than using the combination of TLS with basic authentication. Client certificates have substantial drawbacks in terms of ...
0
votes
1answer
388 views

mod_auth wrong password authentication?

i have a server running apache2 in a debian lenny. something strange happen with the folders protected by .htaccess. basically, if you put a wrong password but formed by the_correct_password + ...
0
votes
1answer
1k views

Apache, Tomcat 5 and problem with HTTP basic auth

I have setup a Tomcat with a webapp that uses http basic auth in some of its URLs. There is a Apache server in front of the Tomcat. I have setup Apache as a proxy like this (all traffic should go ...
5
votes
2answers
426 views

How do I secure a .NET (MVC) website prior to launch?

I have a .NET (MVC2) website that is in development. I have deployed it to some production infrastructure, and tested it over the internet with anonymous access (as it will be once it is live) and it ...
0
votes
2answers
1k views

IIS7: Allow users to identify themselves with either “Windows Authentication” or “Basic Authentication” on the same file

Is it possible to have both windows authentication and basic authentication enabled on one .asmx page in IIS7? What I want is: Someone calls webservice If possible, use windows authentication (e.g. ...
0
votes
2answers
760 views

Dynamic AuthUserFile in apache with mod_rewrite. Is it possible?

I've got a server with several scponly accounts and I want to provide http access under Basic Auth. The first part of the problem is solved, using mod_rewrite to chop and select the right directory ...
1
vote
2answers
415 views

http basic auth using .htacces/.htpasswd allowing slightly incorrect passwords

I've got a few sites with directories protected by http basic auth implemented via .htaccess files paired with .htpasswd files. I've noticed that with a password ending in "et!" I can get in by ...
0
votes
1answer
377 views

Allow website access from specific subnet, otherwise ask for credentials

How can I configure IIS 6 to allow access to a sub folder from our intranet without any authentication (well, the IP address needs to be checked but that's already working) from the internet only ...
0
votes
1answer
602 views

Protect all XML-RPC calls with HTTP basic auth but one

I set up a Django project for smartphone serving XML-RPC methods over HTTPS and using basic auth. All XML-RPC methods require username and password. I would like to implement a XML-RPC method to ...
0
votes
2answers
119 views

Does using Apache Basic Auth affect yum installations?

I don't have further information yet, but I am going to be troubleshooting this in the morning and I wanted to get a head-start. Is there any reason that a yum install (that worked fine yesterday) ...
3
votes
1answer
969 views

NGINX basic auth only for POST

I'm settings up nginx to serve Mercurial repositories. It works when not using basic authentication at all, or when I use basic authentication all over. What I want to do is to just use basic auth on ...
3
votes
3answers
1k views

Apache redirect to https for basic auth

I have a tricky variation on an old problem. I have an apache based site that should generally be accessed via http/port 80. However for certain areas protected areas that require authentication ...
1
vote
1answer
923 views

squid closes the connection when presented with “401 Unauthorized”

This is the conversation: ==> GET http://xy/z HTTP/1.1 <== HTTP/1.0 401 Unauthorized / Proxy-Connection: close When bypassing Squid (squid/3.0.STABLE6), I get the HTTP basic authentication ...
0
votes
1answer
93 views

Weird htaccess file

I am working on a client's site, and I spot this htaccess file. # -FrontPage- IndexIgnore .htaccess */.??* *~ *# */HEADER* */README* */_vti* <Limit GET POST> order deny,allow deny from all ...
0
votes
1answer
565 views

Root URL forces IE to “HTTP BASIC” authentication mode?

I have a RoR app that has worked fine for quite some time, but after a recent deployment, all of the IE users in the office have been presented with a IE username and password popup dialog when they ...
1
vote
1answer
2k views

basic authentication with domain accounts on Windows Server 2008

A very weird issue that never encountered with Windows Server 2003: when configuring basic authentication to restrict access to specific directories in IIS7 I've done the following: Enabled basic ...
2
votes
1answer
460 views

Limiting the number of basic authentication attempts in Apache

I'm using HTTPS + Basic authentication to protect a resource. How can I throttle authentication attempts to protect against brute force attacks?
2
votes
4answers
632 views

Lock down Wiki access to password only but remain open to a subnet via .htaccess

Basically we have a Wiki that has some sensitive information stored in it - not the best I know but my predecessor set it up. I want to be able to request password access from any one who is not on ...
3
votes
2answers
10k views

service static files under nginx & HTTP-Authentication

I have an app deployed in testing mode on a server. Access to it has been restricted to a select group of users via HTTP-Authentication. That works fine. The problem is that if I serve static files ...
0
votes
2answers
748 views

apache basic auth require group not throing forbidden

i have a basic auth setuped with user and groups AuthType Basic AuthName "GSD Dev Area" AuthUserFile /coding/conf/passwords/gsdesign/htpasswd AuthGroupFile /coding/conf/passwords/gsdesign/groups ...
5
votes
4answers
3k views

Respond to HTTP OPTIONS with basic auth

We have a web site hosting Office documents behind IIS6 Basic authentication. IE has an authentication token for basic auth, which it presents to download the file. The user clicks "Open", and then ...