4

Okay, so I don't have much HTML experience, but I recently started working on a project with a group of people that involves regularly manipulating files in a web server. I would like to work on this project when I am at work sometimes, but use of remote connection is discouraged there.

I thought I could write a program that could mimic an ssh environment and allow me to enter commands/see their output and even edit files. I believe this would only give me access to files in the www directory but this is fine.

I would secure the program via .htaccess

what are the flaws with this approach? Is there a better way to get this job done? should I try it at all?

Is it true that .htaccess sends the password via plain text?

if so, what are the other down sides? I don't expect anyone to be sniffing here.

2
  • I think there are good reasons to not change files via a web server. Can you use a table/laptop to ssh to the server and do the changes in that way? In this way you won't be using your work network to connect to your server (remember that your employer might have activity trackers/keyloggers installed for security reasons)
    – HocusPocus
    Sep 25, 2014 at 15:26
  • I do not have a laptop. Basically, the company wouldn't care, they just wouldn't like it if I was on some sort of connection that would allow me to transfer files from my work comp to somewhere else, sensitive info. I know I could do that via internet sites/email, which is why they monitor. Can you explain the "good reasons" you mentioned?
    – Luke
    Sep 25, 2014 at 16:24

1 Answer 1

1

The best you could do is use a ssh connection to work on those files.

If that is not an option you should try to make it possible.

If ssh is really not possible you should check the following:

  • use https with a valid certificate (without that password will be send as plain text!)
  • your .htaccess uses a strong password (otherwise it might be brute forced)
  • use a solid editor (not something you wrote yourself)
  • check file permissions and make sure you can only access file you really need

If one of the above points is not fulfilled you should simply do not this.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .