htaccess/php/sess/recording

htaccess/php/sess/recording

Posted by: SiliconSorcerer
Posted on: 2008-01-15 17:54:00

I need to have restricted access to a site but I also want to record who's logging in.
I want to write who did log into the website into mysql but I don't want to have to access mysql to get access to the site (should that fail) and if the log fails for any reason I don't care that much.
So my thought was just to use htaccess/hpasswd and manage that with deadlock or whatever, that's easy but how can I log who did log in?
Is there a way to get that into the logs and I can scan that with a cron?
Or do I need to write a php login using the htpassword file and only write a record to mysql when a session is created. I don't want to modify every stinking application/directory so I guess I would have to do a AddHandler for .html php etc etc and the php would be "eek" and have to do a force application type on eek to php so it doesn't loop forever?
Am I dope is there just an easy way to do this without having to write the code and do it this convoluted way?
So simple (no credit cards here, no-one on life support) access control with logging but not having to hack into phpbb, gallery, and every other bleeking thing to do this.



Re: htaccess/php/sess/recording

Posted by: SiliconSorcerer
Posted on: 2008-01-20 12:27:00


Ok so that post is a bust how about this....

How do you do php htaccess/passwd access when (as here) php is cgi.
No I don't want to change that and I don't want to log in for every access because it doesn't remember me.


Re: htaccess/php/sess/recording

Posted by: rlparker
Posted on: 2008-01-20 13:39:00

http://www.besthostratings.com/articles/http-auth-php-cgi.html demonstrates a workaround methodology. Yeah Google!wink

--rlparker

Re: htaccess/php/sess/recording

Posted by: SiliconSorcerer
Posted on: 2008-01-20 13:48:00


Yeah google, but garbage in garbage out, that doesn't work.

Re: htaccess/php/sess/recording

Posted by: askapache
Posted on: 2008-01-22 18:46:00

This works. Tested for DreamHost Apache 2 running php-cgi.


Process Request

client -> GET /
server -> set REMOTE_USER=user
set REDIRECT_REMOTE_USER=REMOTE_USER if 401 errordocument
show errordocument 401 if invalid user/pass
errordocument 401 requests user pass with "Authorization Required"
401 sends Header- 'WWW-Authenticate: Basic ream="AskApachePass"'
client -> GET /
send username and password with
Header- 'Authorization: Basic (base64_encoded username:password)'
server -> (repeats until authorized)


2 .htaccess tricks required
1. a custom 401 ErrorDocument specifying a php file (logger).
2. pass along the clients username using mod_rewrite.

.htaccess

ErrorDocument 401 /log-htpasswd.php

# BEGIN AskApache Password Protect
AuthName "AskApachePass"
AuthUserFile /.htpasswd
AuthGroupFile /dev/null
AuthType Basic
Require valid-user
# END AskApache Password Protect

RewriteEngine On
RewriteBase /
RewriteCond %{ENV:REDIRECT_STATUS} ^401$
RewriteRule .* - [E=REMOTE_USER:%{ENV:REDIRECT_REMOTE_USER}]


log-htpasswd.php

<?php
define('LOGINS_LOG','/home/user/log-htpasswd.log');

if(isset($_ENV['REDIRECT_REMOTE_USER']) && !empty($_ENV['REDIRECT_REMOTE_USER'])){
$fp = fopen(LOGINS_LOG, 'a ');
fwrite($fp, $_ENV['REDIRECT_REMOTE_USER']);
fclose($fp);
}

ob_start();
header("HTTP/1.1 401 Authorization Required",1);
header("Status: 401 Authorization Required",1);
echo '<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head><title>401 Authorization Required</title></head><body>
<h1>Authorization Required</h1>
<p>This server could not verify that you
are authorized to access the document
requested. Either you supplied the wrong
credentials (e.g., bad password), or your
browser doesn't understand how to supply
the credentials required.</p>';
exit;
exit();
?>


example log-htpasswd.log
just a list of usernames attempted

username1
tom
rcowen
askapache
dreamhost
dreamadmin



All you need to do now is add mysql commands to log-htpasswd.php... And you should tighten the security for log-htpasswd.php to only allow from from server for redirects to secure against crackers and hackers. more .htaccess tricks



_____

 _  _|  _  _  _  _|_  _
(_|_|<(_||_)(_|(_| |(/_
|

So I'm not sure what's different in my environment but this does not work....

first I had to change /.htpasswd to the full path or I couldn't even log in.

I checked my log file path etc, even made it all 777's, and then just tried writing "test" in it, nothing...
Made a copy of the log-htpasswd.php and pulled the if and other stuff out, it did write to the "test" to the file only no user.

I don't know, this is what is driving a bit nuts. I agree this should work.

Re: htaccess/php/sess/recording

Posted by: askapache
Posted on: 2008-01-23 13:02:00

No worries Sorcerer~

I forget that my environment is different than the default, I have a lot of optimized stuff going on. My guess is that its a php issue.

First, the .htpasswd thing was my fault, indeed you will need to change to be the full path like /home/user/.htpasswd

Next configure your domain to use the php5.cgi

1. cd to your domain root

cd /home/user/domain.com

2. make a cgi-bin folder

mkdir -p /home/user/domain.com/cgi-bin; chmod 755 /home/user/domain.com/cgi-bin

3. copy the php5.cgi

cp -p /dh/cgi-system/php5.cgi /home/user/domain.com/cgi-bin

4. add this to your /home/user/domain.com/.htaccess

AddHandler php-cgi .php
Action php-cgi /cgi-bin/php5.cgi

Now that you have php5, it should work.



Ultimate debug:

1. create a file called login.php in /home/user/domain.com/cgi-bin/login.php and make a copy at /home/user/domain.com/logins.php
2. the contents of login.php, change the IP to yours

<?php
define('LOGINS_LOG','/home/user/logins.log');

$fp = fopen(LOGINS_LOG, 'a+');
fwrite($fp, $_ENV['REDIRECT_REMOTE_USER']."n");
fclose($fp);

ob_start();
header("HTTP/1.1 401 Authorization Required",1);
header("Status: 401 Authorization Required",1);
echo '<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head><title>401 Authorization Required</title></head><body>
<h1>Authorization Required</h1>
<p>This server could not verify that you
are authorized to access the document
requested. Either you supplied the wrong
credentials (e.g., bad password), or your
browser doesn't understand how to supply
the credentials required.</p>';
if($_SERVER['REMOTE_ADDR'] !== '208.113.183.103') die();
echo '<pre>';
$password=base64_decode(str_replace('Basic ','', $_SERVER['HTTP_AUTHORIZATION']));
echo $password;
print_r($_ENV);
print_r($_SERVER);
exit;
exit();
?>

3. Add this to your /home/user/domain.com/.htaccess

ErrorDocument 401 /logins.php

RewriteEngine On
RewriteBase /
RewriteCond %{ENV:REDIRECT_STATUS} ^401$ [OR]
RewriteCond %{REQUEST_URI} ^/.*login*.php$
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},E=REMOTE_USER:%{ENV:REDIRECT_REMOTE_USER}]

<Files login.php>
AuthName "Protection"
AuthUserFile /home/user/.htpasswd
AuthGroupFile /dev/null
AuthType Basic
Require valid-user
</Files>

Now goto your web browser and request http://site.com/cgi-bin/login.php and try entering the wrong password, hitting cancel, entering the correct password, etc.

Besides also showing you the decrypted password, it will show you everything you need to know. Let me know how it goes.

_____

 _  _|  _  _  _  _|_  _
(_|_|<(_||_)(_|(_| |(/_
|

I'm missing something...

the <files means I have to specifically access the file
I want it to run "auto" based on the .htaccess file

When it runs it will authorize but that's like a goto not a gosub after this is done it doesn't finish the code to let me know who just logged in.

For then on it never goes back to access this code.

Oh and when I do run it twice the password is the user/password but the REDIRECT_REMOTE_USER is still blank.
Edited by SiliconSorcerer on 01/26/08 12:23 PM (server time).

Re: htaccess/php/sess/recording

Posted by: askapache
Posted on: 2008-01-26 14:09:00

You only need to use the files directive if you are debugging.

_____

 _  _|  _  _  _  _|_  _
(_|_\|<(_||_)(_|(_| |(/_
|