ServersApache Guide: Apache Authentication, Part 4 Page 2

Apache Guide: Apache Authentication, Part 4 Page 2

ServerWatch content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

There are several ways to handle putting passwords into each type of
storage mechanism. In each case, you can do things “by hand”, or you
can use one of the existing CPAN modules to do a lot of the work for

The CPAN module to look for is HTTPD::UserManage. It was written
by Lincoln Stein and Doug MacEachern, and allows you to manage multiple
types of authentication mechanisms, on multiple server-types (Apache,
Netscape, etc) via one interface.

You can get HTTPD::UserManage from your favorite CPAN mirror. It also
comes with a CGI application that, when correctly installed, lets
you manage your authentication files from the web. Pretty cool stuff.

There are also a couple of other modules – Apache::Htpasswd and
Apache::Htgroup, that give a simple, Apache-only interface for managing
your authentication files.

Adding a password to a Text Password File

If you want to add a password to a text htpasswd-type password file,
without the benefit of modules, here’s how you’d do it:

        open PASSWD, '>>/path/to/.htpasswd';
        print PASSWD ":n";
        close PASSWD;

Well, you say to yourself, that's pretty darned simple. Why would I want
to use a module to do that? Three reasons. One, if you're going to be doing
this hundreds or thousands of times, you'll find it much easier to be able
to call one function, passing in the username and desired password, than
encrypting the password yourself and running the above code. Secondly,
the modules provide you with a lot of other functionality, such as verifying
a password, and deleting a user. Thirdly, if you're using HTTPD::UserManage,
and you decide a year from now to change to using mod_auth_mysql instead
of htpasswd files, you don't have to change any code. That third one
is a big win, because some day you will want to change your authentication
method, and you don't want to be stuck with changing code a dozen places,
and potentially missing a few. Trust me. I missed a few.

Passwords in DBM Files

DBM files are the fun ones, because they let me use a pretty cool feature
of Perl. Perl has a key work called tie. As the name suggests, it lets
you tie one thing to another. In this case, it lets you tie a variable
(in particular, a hash) to a DBM file. So, when you modify the hash, the
DBM file automatically gets modified for you. Very cool stuff.

This looks like the following:

        use DB_File;
        my %database;
        tie %database, 'DB_File', "passwords.dat"
            or die "Can't initialize database: n";
     = crypt(, );
        {} = ;
        untie %database;

And, voila, you have an entry in the password file associating user
with their password.

Note that you should, of course, not put your password file inside your
web root, where someone can download it and crack it at their
leisure. The above code is just an example.

Passwords in MySQL Databases

This is the most obvious one. In fact, most often when you use mod_auth_mysql,
it's beacase you already have user information in a database, and want to
use if for authentication.

Information can be updated in the database with regular SQL statements, and

Get the Free Newsletter!

Subscribe to Daily Tech Insider for top news, trends & analysis

Latest Posts

Related Stories