12

For the moment we protect a directory on our site with .htaccess and .htpasswd. But I was wondering how secure this is? Are there things I should watch for or can do make it more secure?

I don't know why but it don't feel really confident about it. I have the feeling this kind of security is easy to crack. From what I have read there are ways to just download the .htpasswd file and decrypt the passwords.

Improve this question
1

3 Answers 3

Reset to default
12

If all the access is via SSL, then it's reasonably secure.

Basic authentication without SSL only sends the username/password as base64 encoded - so it's trivial to extract the tokens via MITM or sniffing.

Digest authentication without SSL is a lot better (a challenge based mechanism) but still not as secure as an encrypted connection. However there are few cues to the user that the authentication is being implemented as Digest rather than Basic. Also proxy authentication challenges look very similar.

The built-in authentication mechanisms don't provide for a good user experience. If this is for a site with a small, defined user group, then using the built-in methods are a quick solution (but you might consider client-side certificate auth instead). But for a public facing website you should think about implementing somethnig a bit more sophisticated.

You should configure your webserver appropriately to prevent direct access to the htaccess file and password database. Either by putting the config outside of the document root (obviously this isn't going to work for htaccess files - but they are just a local extension to the webserver config) or by blocking access to the files. Every Apache distribution I've ever come across blocks access to files with names starting '.ht'

While you can prevent direct access to the password db, there's not a great deal of scope for limiting brute force attacks on the server over HTTP - another reason for considering a forms based approach.

Improve this answer
1
  • 1
    What about fail2ban or similar for preventing brute force attacks?
    – bstpierre
    Dec 2, 2011 at 12:37
1

Ideally, a hacker shouldn't be able to download your .htpasswd file -- apache will disallow access to any files starting with ".ht", so as long as you don't give out FTP access and you don't have any vulnerabilities in your apps, you should be in decent shape.

Improve this answer
1

I would check out this resource to make sure that htaccess is properly protected:

http://www.symantec.com/connect/articles/hardening-htaccess-part-one

And I would check out a WAF or mod_security if you want greater operational control:

http://www.askapache.com/htaccess/modsecurity-htaccess-tricks.html

Improve this answer
1
  • Hmmm, after reading through the first article, it doesn't seem to be that great of advice.
    – Kzqai
    Dec 29, 2011 at 23:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .