Re: [SL] SQL-Ledger vulnerability CVE-2006-4244

[jean m. <je...@nr...>]

Apache documentation says it's preferred to put authentication in the main
server configuration and not use .htaccess whenever possible. The
documentation says .htaccess should only be used when you don't have
access to the main server configuration file. Instead of using .htaccess
you can put the lines in sql-ledger-httpd.conf,

Alias /sql-ledger /usr/local/sql-ledger/
   <Directory /usr/local/sql-ledger>
     AuthType Basic
     AuthName "Accounts"
     AuthUserFile /var/www/passwd/passwords
     Require valid-user
     AllowOverride All
     AddHandler cgi-script .pl
     AddDefaultCharset On
     Options ExecCGI Includes FollowSymlinks
     Order Allow,Deny
     Allow from All
   </Directory>

works for me

jean

>
> For clarification.
>
> A .htaccess file in /usr/local/sql-ledger containing something like:
> AuthType Basic
>   AuthName "Accounts"
>   AuthUserFile /var/www/passwd/passwords
>   Require valid-user
>
> Add a line in the sql-ledger-httpd.conf file under:
> <Directory /usr/local/sql-ledger>
>   SSLRequireSSL
>
> Create the usernames and passwords using Apache's htpasswd utility
> -stored in /var/www/passwd/passwords referred to in the .htaccess file
> above.
>
> Choose sensible usernames and passwords - preferably different to the
> those used for SQL-Ledger login.
>
> Create a Digital certificate, and make sure httpd/apache uses it.
>
> Block port 80, open port 443
>
> This assumes you are using a recent version of Apache/httpd
>
> Or for a lot of users make httpd authenticate access against an LDAP or
> AD server.
>
> You will have two usernames and  passwords to enter to use SQL-Ledger,
> but your server will be much more secure.
>
> Regards
> Trevor Hennion
> http://www.infocentrality.co.uk
>
> -------------------------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job
> easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> sql-ledger-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sql-ledger-users
>