Weblog entry #7 for sneex
See all weblog entries made by sneex.
#7
Basic Authentication?
Posted by sneex on Tue 30 Sep 2008 at 21:54
Basic Authentication? Is it dead? I have an old RH9 server that is dying and the powers that be copied the data and old Apache config files over to my shiney (relatively) new Debian AMD64 box running Apache2 but we think Basic Authentication is broken. Since I didn't use basic authentication before this move I don't know if it was "broken or working" before :P Does anyone out there in Debian land have any insight or could maybe point me in better direction? This is the simplest VirtualHost example I can give that is not working: http://sneex.pastebin.ca/1214943
Thanks!
PS - My system(s) are - Debian Etch on AMD64 running Apache2
srv0:/etc/apache2/sites-available# apache2ctl -M
Loaded Modules:
core_module (static)
log_config_module (static)
logio_module (static)
mpm_prefork_module (static)
http_module (static)
so_module (static)
alias_module (shared)
auth_basic_module (shared)
auth_digest_module (shared)
auth_pam_module (shared)
auth_plain_module (shared)
auth_sys_group_module (shared)
authn_file_module (shared)
authz_default_module (shared)
authz_groupfile_module (shared)
authz_host_module (shared)
authz_user_module (shared)
autoindex_module (shared)
cgi_module (shared)
dav_module (shared)
dav_fs_module (shared)
dir_module (shared)
env_module (shared)
info_module (shared)
jk_module (shared)
mime_module (shared)
python_module (shared)
negotiation_module (shared)
perl_module (shared)
php4_module (shared)
rewrite_module (shared)
setenvif_module (shared)
ssl_module (shared)
status_module (shared)
Syntax OK
srv0:/etc/apache2/sites-available# apache2ctl -v
Server version: Apache/2.2.3
Server built: Apr 16 2008 21:17:45
Thanks!
PS - My system(s) are - Debian Etch on AMD64 running Apache2
srv0:/etc/apache2/sites-available# apache2ctl -M
Loaded Modules:
core_module (static)
log_config_module (static)
logio_module (static)
mpm_prefork_module (static)
http_module (static)
so_module (static)
alias_module (shared)
auth_basic_module (shared)
auth_digest_module (shared)
auth_pam_module (shared)
auth_plain_module (shared)
auth_sys_group_module (shared)
authn_file_module (shared)
authz_default_module (shared)
authz_groupfile_module (shared)
authz_host_module (shared)
authz_user_module (shared)
autoindex_module (shared)
cgi_module (shared)
dav_module (shared)
dav_fs_module (shared)
dir_module (shared)
env_module (shared)
info_module (shared)
jk_module (shared)
mime_module (shared)
python_module (shared)
negotiation_module (shared)
perl_module (shared)
php4_module (shared)
rewrite_module (shared)
setenvif_module (shared)
ssl_module (shared)
status_module (shared)
Syntax OK
srv0:/etc/apache2/sites-available# apache2ctl -v
Server version: Apache/2.2.3
Server built: Apr 16 2008 21:17:45
Comments on this Entry
Posted by Anonymous (84.45.xx.xx) on Wed 1 Oct 2008 at 20:29
Basic authentication works fine in Debian - like you seriously doubted it?
Define broken - usually Apache logs something sensible when these things are miss configured, like it can't read the user file.
Basic authentication ought to be dead, auth_digest is more secure for pretty much the same amount of configuration work, but then FTP ought to be dead....
Define broken - usually Apache logs something sensible when these things are miss configured, like it can't read the user file.
Basic authentication ought to be dead, auth_digest is more secure for pretty much the same amount of configuration work, but then FTP ought to be dead....
[ Parent | Reply to this comment ]
OK, after a lot of thought (and a few hacked Perl CGIs) I have discovered what was causing Basic Authentication to break under Debian AMD64 Apache2 -
In the global Apache2.Conf file I had this:
# Stop WebDAV attacks --wcj
<Location />
#
<Limit PUT DELETE CONNECT OPTIONS PATCH PROPFIND PROPPATCH MKCOL COPY MOVE LOCK UNLOCK SEARCH>
#
Require valid-user
#
</Limit>
</Location>
-Sx- :P
http://youve-reached-the.endoftheinternet.org/
In the global Apache2.Conf file I had this:
# Stop WebDAV attacks --wcj
<Location />
#
<Limit PUT DELETE CONNECT OPTIONS PATCH PROPFIND PROPPATCH MKCOL COPY MOVE LOCK UNLOCK SEARCH>
#
Require valid-user
#
</Limit>
</Location>
-Sx- :P
http://youve-reached-the.endoftheinternet.org/
[ Parent | Reply to this comment ]