weird HTTP authentication issue

[Red Squirrel]

I have several virtual hosts which requires HTTP authentication, they all require a specific group so that way I can maintain one user/pass database and simply add users to the groups I want them to access.

On my own account I changed my password, then decided to change it again and just make it longer so instead of abc I used abcdef (not the actual password )

So now to log in I can either use abc, or I can use abcdefg. Has anyone ever seen this before? It's really odd. It's almost as if it's remembering the last password and letting me in.

So I temporarly changed it to test, and then those two passwords did not work, so I changed it back, and same problem. I can most likely come up with a different password to work around this, but I'm just really curious as to what's going on.

 

[Nothinman]

Most likely you're setting the password past it's maximum allowable length so the end is getting chopped off. I believe crypt encryption is limited to 7 or 8 characters, if you want a longer password you should use MD5.

 

[Red Squirrel]

Oh ok, so whatever I type after is just completely ingored? Interesting. Looks like thats what's happening too since I typed only the first 10 chars of the password and it still let me in.

So in the apache config how would I specify the type of encryption? And I'm guessing I need to do something when I use htpasswd as well.

Right now I have:

alias /mail /data/squirrelmail
<directory "/data/squirrelmail">

AuthUserFile /data/intranet/main/htpasswd.txt
AuthGroupFile /dev/null
AuthName "LOCAL MAIL"
AuthType Basic

require user ryanauclair
</directory>



Also, is there a way to make http auth more secure as in masking the password better? Or do I need to use SSL to get better?

HTTP Auth encrypts it, but it's just a constant string so one that catches this can still log in with telnet or something without knowing the "real" password.

 

[Nothinman]

Look at the man page for htpasswd, I assume that's what you used to create the password in the first place. It tells you have to set the encryption to md5. And there's no configuration changes needed for Apache, just set the password and you're good.

SSL would probably be the easiest fix for the HTTP AUTH problem, it's pretty trivial to create a self-signed cert.

 

[Red Squirrel]

Yep that was it. I have to use the -m argument.