Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

For the moment we protect a directory on our site with .htaccess and .htpasswd. But I was wondering how secure this is? Are there things I should watch for or can do make it more secure?

I don't know why but it don't feel really confident about it. I have the feeling this kind of security is easy to crack. From what I have read there are ways to just download the .htpasswd file and decrypt the passwords.

share|improve this question
    
Seems the Apache folks aren't keen on half of it... httpd.apache.org/docs/1.3/howto/htaccess.html#when –  Avery Payne Dec 8 '11 at 23:11

4 Answers 4

I would check out this resource to make sure that htaccess is properly protected:

http://www.symantec.com/connect/articles/hardening-htaccess-part-one

And I would check out a WAF or mod_security if you want greater operational control:

http://www.askapache.com/htaccess/modsecurity-htaccess-tricks.html

share|improve this answer
    
Hmmm, after reading through the first article, it doesn't seem to be that great of advice. –  Kzqai Dec 29 '11 at 23:21

Yes you are "somewhat" secure when it comes to application-layer level.

But you just can't rely on htaccess alone. Are your files securely coded and warded of against SQL-Injection & XSS attacks? Also, there are local File-Inclusion attacks with that an attacker can break in and even edit/delete your .htaccess or .htpasswd. So what's the point in just making .htaccess secure?

Do test all your files for such vulnerabilities.

share|improve this answer
1  
If there are vulnerabilities like the ones you described, it does not make much difference whether .htaccess or other means of access control are used. –  Hendrik Brummermann Dec 3 '11 at 0:32

Ideally, a hacker shouldn't be able to download your .htpasswd file -- apache will disallow access to any files starting with ".ht", so as long as you don't give out FTP access and you don't have any vulnerabilities in your apps, you should be in decent shape.

share|improve this answer

If all the access is via SSL, then it's reasonably secure.

Basic authentication without SSL only sends the username/password as base64 encoded - so it's trivial to extract the tokens via MITM or sniffing.

Digest authentication without SSL is a lot better (a challenge based mechanism) but still not as secure as an encrypted connection. However there are few cues to the user that the authentication is being implemented as Digest rather than Basic. Also proxy authentication challenges look very similar.

The built-in authentication mechanisms don't provide for a good user experience. If this is for a site with a small, defined user group, then using the built-in methods are a quick solution (but you might consider client-side certificate auth instead). But for a public facing website you should think about implementing somethnig a bit more sophisticated.

You should configure your webserver appropriately to prevent direct access to the htaccess file and password database. Either by putting the config outside of the document root (obviously this isn't going to work for htaccess files - but they are just a local extension to the webserver config) or by blocking access to the files. Every Apache distribution I've ever come across blocks access to files with names starting '.ht'

While you can prevent direct access to the password db, there's not a great deal of scope for limiting brute force attacks on the server over HTTP - another reason for considering a forms based approach.

share|improve this answer
    
What about fail2ban or similar for preventing brute force attacks? –  bstpierre Dec 2 '11 at 12:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.