Best way to secure a website?

[jtusa]

Setting up my webserver, I want restricted access. I'm running IIS6 on '03 Server. I've tried integrating with standard user/group accounts but it's being a PITA with the sharing and security rights(asks for password multiple times where it shouldn't, doesn't ask where it should, etc.). Anyway, I'm tired of messing with integrated accounts so I'm wondering what some other people are using to password protect their sites, preferably with encryption.

 

[jtusa]

BTT

 

[AFB]

ASP, Webforms, DB , possibly SSL ?

Seems like it would work

 

[kamper]

What are the pages written in? Are they dynamic so that you could have session info like asp, jsp or php give you? Or are you just trying to protect normal html pages with http authentication? If it's the latter, it should not be too hard to configure iis to handle this properly; any decent web server can. There is also an element that relies on the client, so if the browser isn't behaving then there's just nothing you can do about it.

 

[Childs]

Go to the back of your computer and pull the network cable. Then turn off the computer. Otherwise, someone will eventually find a way to get in.

 

[jtusa]

Originally posted by: kamper
What are the pages written in? Are they dynamic so that you could have session info like asp, jsp or php give you? Or are you just trying to protect normal html pages with http authentication? If it's the latter, it should not be too hard to configure iis to handle this properly; any decent web server can. There is also an element that relies on the client, so if the browser isn't behaving then there's just nothing you can do about it.

Not dynamic yet. Right now they are just basic html pages. Once everything is up and running like it should be then I'll be throwing in the php and java content. I can secure it through IIS, it's just being stubborn with permissions. So I figured I'd ask around and look around to see what my other options were.

 

[stndn]

Where i work, we use php scripts + mysql database to store user's registration information (login + password + others).
If the user want to access certain restricted pages, they will need to login first. Otherwise they will be redirected to login page instead of the page they are looking to access.

If you just want to protect basic plain html pages, you can use .htaccess to restrict access to certain directories where you'd put all your protected files.

The best way of protection is, of course, is to pull off the network cable as suggested by Childs ,p
but then again, that won't provide you with the sharing capability, so i guess that's not an option, huh? ,)