Apache Server user authentication

Readers who frequently access the Internet may encounter this situation: when accessing some resources of some websites, a dialog box pops up in the browser asking users and passwords to access resources. This is a technology used for user authentication. User authentication is the first line of defense to protect network system resources. it controls all logins and checks the legality of users. Its goal is to allow only legitimate users to integrate Apache

Readers who frequently access the Internet may encounter this situation: when accessing some resources of some websites, a dialog box pops up in the browser asking users and passwords to access resources. This is a technology used for user authentication. User authentication is the first line of defense to protect network system resources. it controls all logins and checks the validity of users, the goal is to only allow legal users to access network system resources with legal permissions. The basic user authentication technology is "user name + Password ".

Apache is a popular Web server that runs on Linux, Unix, Windows, and other operating systems. it can well solve the authentication problem of "user name + Password. The username and password required for Apache user authentication are stored in two different ways: text files and databases such as MSQL, Oracle, and MySQL. The following uses Apache in Linux as an example to describe how to implement user authentication based on these two storage methods. It also briefly introduces Apache user authentication for Windows.

1. use text file storage

The basic idea of this authentication method is: After Apache starts the authentication function, you can create a file named. htaccess in the directory to which access is restricted and specify the authentication configuration command. When you access the file in this directory for the first time, the browser displays a dialog box asking you to enter the user name and password to confirm your identity. If the user is a legal user, the content of the Accessed page is displayed. after that, the browser automatically sends out the user name and password and does not need to enter the password until the browser is closed. The specific steps are as follows:

Run root as the super user to enter Linux. assume that Apache 1.3.12 has been compiled and installed in the/usr/local/apache directory. By default, the mod_auth module is automatically added when Apache is compiled. This module can be used to implement the authentication function of "user name + password" stored in text files.

1. modify the Apache configuration file/usr/local/apache/conf/httpd. conf and set the configuration command for the directory where the authentication resource is located.

In the following example, configure the/usr/local/apache/htdocs/members Directory:

<Directory/usr/local/apache/htdocs/members>

Options Indexes FollowSymLinks

Allowoverride authconfig

Order allow, deny

Allow from all

</Directory>

Allowoverride authconfig indicates that user authentication is allowed for files in the/usr/local/apache/htdocs/members Directory.

2. create a file. htaccess under the/usr/local/apache/htdocs/members directory with the following content:

AuthName \ "member area \"

AuthType basic

AuthUserFile/usr/local/apache/members.txt

Require valid-user

Note: common configuration commands in file. htaccess include the following:

1) AuthName command: specify the authentication region name. The region name is displayed to the user in the prompt authentication dialog box.

2) AuthType command: specify the authentication type. In HTTP1.0, there is only one authentication type: basic. There are several authentication types in HTTP1.1, such as MD5.

3) AuthUserFile command: specify a text file containing the user name and password. each line has a pair.

4) AuthGroupFile: specifies a text file that contains a list of user groups and a list of members of these groups. Group members are separated by spaces, for example, managers: user1 user2.

5) require Command: specify which users or groups can be accessed with authorization. For example:

Require user user1 user2 (only users user1 and user2 can access)

Require group managers (only members in the group managers can access)

Require valid-user (any user can access the file specified by AuthUserFile)

3. Generate the text file/usr/local/Apache/members.txt containing the username and password using the program htpasswd included in apache. the format of each line is "username: Password ".

# Cd/usr/local/apache/bin

# Htpasswd-bc./members.txt user1 1234

# Htpasswd-B ../members.txt user2 5678

The hosts file members.txt contains two users: user1, password 1234, user2, and password 5678. Note: Do not store this text file in the directory tree of the Web document to avoid being downloaded by users.

To learn more about the htpasswd program, run htpasswd-h.

When the number of users is small, this method is convenient and easy to authenticate, and the maintenance work is also simple. However, when there are tens of thousands or even hundreds of thousands of users, it takes some time to find users, thus reducing server efficiency. In this case, the database method should be used.
2. database storage

Currently, Apache, PHP4, and MySQL are the best Web site construction partners in Linux. these three software are free software. Combine the three methods and use PHP4 and MySQL through HTTP to implement Apache user authentication.

User authentication can be performed only when PHP4 runs in Apache module mode. Therefore, you must add the PHP4 module to compile Apache. Assume that PHP4 is used as the Apache module to compile and install Apache to the/usr/local/apache directory, and compile and install MySQL to the/usr/local/mysql directory. Perform the following steps:

1. create a database member in MySQL, and create a table users in it to store the username and password of valid users.

1) use the vi command to create an SQL script file auth. SQL in the/tmp Directory. the content is:

Drop datebase if exists member;

Create database member;

Use member;

Create table users (

Username char (20) not null,

Password char (20) not null,

);

Insert into users values (\ "user1 \", password (\ "1234 \"));

Insert into users values (\ "user2 \", password (\ "5678 \"));

2) start MySQL client program mysql, execute the auth. SQL command in the preceding SQL script file, and add two user records in the users table.

# Mysql-u root-pmypwd </tmp/auth. SQL

2. write a PHP script header file auth. inc. the program content is:

<? Php

Function authenticate (){

Header (WWW-authenticate: basic realm = \ "member area \");

Header (HTTP/1.0 401 Unauthorized );

Echo \ "you must enter the correct user name and password. N \";

Exit;

}

Function CheckUser ($ uname, $ pwd ){

If ($ uname = \ "\" | $ pwd = \ "\") return 0;

$ Query = \ "SELECT username, password FROM users WHERE username = $ uname and password = password ($ pwd )\";

$ Db_id = mysql_connect (localhost, oot, mypwd );

Mysql_select_db (member, $ db_id );

$ Result = mysql_query ($ query, $ db_id );

$ Num = mysql_num_rows ($ result );

Mysql_close ($ db_id );

If ($ num> 0 ){

Return 1; // valid logon

} Else {

Return 0; // invalid logon

}

}

?>

The Authenticate () function uses the function Header (WWW-authenticate: basic realm = \ "member area \") to send an authentication request message to the browser, make the browser pop up a user name/password dialog box. After the user enters the user name and password, the URL containing the PHP script will be automatically called again, and the user name, password, and authentication type will be respectively stored in three special variables of PHP4: $ PHP_AUTH_USER, $ PHP_AUTH_PW, and $ PHP_AUTH_TYPE. in the PHP program, you can determine whether the user is valid based on these three variable values. In the Header () function, basic indicates the basic authentication type, and the value of realm indicates the authentication region name.

Function Header (HTTP/1.0 401 Unauthorized) enables the browser user to receive an HTTP 401 error when entering the wrong user name or password multiple times in a row.

The CheckUser () function is used to determine whether the user name and password sent by the browser are the same as those sent by the MySQL database. if they are the same, 1 is returned; otherwise, 0 is returned. The root username and password of mysql_connect (localhost, oot, mypwd) database should be changed according to your MySQL settings.

3. add the following program segments at the beginning of each PHP script program that requires restricted access:

<? Php

Require (auth. inc );

If (CheckUser ($ PHP_AUTH_USER, $ PHP_AUTH_PW) = 0 ){

Authenticate ();

} Else {

Echo \ "this is the webpage that a legal user wants to access. \ "; // Change this row to a webpage output to a valid user

}

?>

Place the webpage content that needs to be displayed to a valid user in the else clause to replace the line in the preceding section:

Echo \ "this is the webpage that a legal user wants to access. \";

In this way, when a user accesses the PHP script program, the user name and password must be entered to confirm the user's identity.

III. Windows Apache user authentication

1. when a text file is used to store the user name and password, the method is the same as before. However, note that the slash "/" is used to separate the directory names in the path and between the directory names and file names, instead of the backslash "".

2. when using the MySQL database to store user names and passwords, run PHP 4.0.3 as the Apache module in the following ways, then follow the above "user authentication using the database to store user names and passwords" method.

1) Download Apache 1.3.12, PHP 4.0.3, and MySQL 3.2.32 for Windows, decompress and install the three software to the C: apache, C: PHP4, and C: mysql directories respectively.

2) C: the PHP4SAPI directory contains several PHP module files of common Web servers. copy php4apache. dll to the modules subdirectory (C: apachemodules) of Apache ).

3) modify Apache configuration file C: apacheconfhttpd. conf and add the following lines:

LoadModule php4_module modules/php4apache. dll

AddType application/x-httpd-php. php3

AddType application/x-httpd-php-source. phps

AddType application/x-httpd-php. php

First, run PHP4 in Apache module mode to perform user authentication. the last three lines define the extension of the PHP script program.

4) Add "C: PHP4" in the PATH command of the autoexec. bat file and restart the computer.