Yadda zaka kare shafukan mu ta amfani da .htpasswd + Misalai

Saboda dalilai da yawa, yana iya zama da amfani sosai ga samun damar sarrafawa zuwa wasu kundayen adireshi a sabar yanar gizo ko kawai abubuwan da ke cikin shafinmu ko blog ta hanyar sabis na tabbatarwa bisa sunan mai amfani da kalmar wucewa. Ina magana ne game da wani abu kamar taga ta yau da kullun da ke bayyana lokacin da muke son shiga gidan yanar gizo tare da ƙayyadaddun sabis.

Akwai hanyoyi da yawa don samar da windows tare da hanyar tabbatarwa amma an samar da mafita mai ban sha'awa a matakin uwar garke htpasswd. Yana da amfani wanda aikinsa shine adana kalmomin shiga a cikin ɓoyayyen tsari don Apache suyi amfani dasu a cikin ayyukan tabbatarwa. Amfani da shi zai ba mu damar nuna wasu kundayen adireshi ko fayiloli ta hanyar http kawai ga masu amfani da aka gano kuma ba tare da dole kowa ya sami damar kyauta ba.

Na fahimci cewa ba magana ce mai walƙiya ba amma yana iya zama da amfani ga wasu. Don kar in kashe su da rashin nishaɗi, zan yi amfani da hotuna don yin karin haske.

Abubuwan da suka gabata: Zan yi amfani da su 12.04.1 Ubuntu Server y Apache 2.2.22 a cikin yanayin sarrafawa.

Mun fara.

Kamar yadda wasu na iya riga sun sani, ta hanyar tsoho shafukan yanar gizo na Apache suna adana a cikin kundin adireshin / var / www / kuma ga wannan misali zan ƙirƙiri kundin adireshi tare da samfurin HTML kuma inyi ƙoƙarin kiyaye shi da .htpasswd.

Littafin adireshi don kare shine / var / www / misali / inda na sanya shafi na gaba.

A kan sabar

A cikin mai bincike

1. Zamu kirkiri .htpasswd.

Wurin da zai kasance yana da mahimmancin mahimmanci kuma sanya shi a waje da kundin adireshin jama'a na iya zama fiye da yadda aka ba da shawara. A halin da nake ciki zan sanya shi a cikin jakata na (wanda ba kundin adireshin Apache na jama'a bane) kuma tare da suna .htpasswd (A priori ba lallai bane a kira shi haka, amma wanda yake ɓoye koyaushe yana da kyau).

Tare da umarni masu zuwa na kirkira fayil din .htpasswd ga mai amfani da yanar gizo wanda na sanya masa suna: "Luka".

# htpasswd -c /home/krel/.htpasswd Luke

Zai buƙaci mu samar da kalmar sirri sau biyu, a nawa yanayin na sanya "skywalker" (ba tare da ambato ba). A cikin yanayin da ba a sarrafa shi dole ne mu kafa kalmomin shiga masu ƙarfi. Tsoffin ɓoye ɓoye akan Linux shine MD5 amma akan Unix daidaitaccen aiwatarwa ne na crypt () kuma don kalmomin shiga tare da ƙasa da haruffa 8 zai iya zama mai rauni. Yanzu ina da shakku idan a BSD haka yake.

Umurnin yana da wannan tsari:

• -c → don ƙirƙirar fayil ɗin

• /home/krel/.htpasswd ute cikakkiyar hanyar fayil.

• Luke → sunan mai amfani (zai iya zama duk abinda kake so)

Hakanan, ban tilasta kowa amfani da tashar lokacin da akwai sabis akan Intanet don ita ba:
http://www.web2generators.com/apache/htpasswd_generator

http://www.htaccesstools.com/htpasswd-generator/

Muna kwafin sakamako a cikin fayil ɗin rubutu kuma tare da suna .htpasswd idan kuna so. Game da wannan hanyar, kar a daina karanta abin da na yi sharhi a sakin layi na gaba.

A halin da muke ciki zamu ga an kirkiri fayel din a inda muke tsammanin su /home/krel/.htpasswd. A cikin hoton na haskaka cewa da wannan hanyar fayil ɗin na ƙungiyar apache ne da mai amfani, wanda a Ubuntu ake kira www-data. Wannan yana da mahimmanci saboda idan mun samar da .htpasswd ta wata hanyar daban, dole ne mu tabbatar cewa yana da izini 644.

To, yanzu zamu ga yadda hanjin su yake:

Kamar yadda kake gani, akwai mai amfani (Luka) amma an ɓoye kalmar sirri.

Ta wannan hanyar mun riga mun ƙirƙira kuma mun tsara .htpasswd ga mai amfani da Luka, a ƙarshe ba komai bane face akwati don kalmar sirri. "Duk tare da umarni ɗaya" zai zama kyakkyawar ma'anar magana.

2. Sanya Apache don amfani da bada izinin wannan sabis ɗin akan rukunin yanar gizon.

# nano /etc/apache2/sites-available/default

Idan kuna da rundunoni da yawa, dole ne suyi aiki akan kowannensu, a halin da nake ciki kawai ina da wanda ya zo da tsoho. Kar ka manta cewa yana da kyau koyaushe a yi ajiyar wannan fayil ɗin.

Fayil din yana da tsari na asali:

ServerAdmin mai kula da gidan yanar gizo @ localhost

..........

..........

Daidai yake a cikin taken Virtualhost cewa amfani da .htpasswd za a ƙayyade don samun dama ga wani kundin adireshi. Muna yin shi kamar yadda hoton da ke ƙasa ya bayyana kuma ya dace da misalinmu:

Yayi kyau. Na bayyana layin:

Dole ne ku sanya kundin adireshi don karewa.

AuthType Basic

Nau'in mai amfani ne da kalmar sirri da aka yi shawarwari tare da mai binciken, a wannan yanayin Basic ne, ba tare da ɓoyewa ba.

Akwai wani nau'in tattaunawa: Digest, wannan yana ɓoye sunan mai amfani da kalmar wucewa, duk da haka kalma ta ƙarshe ita ce mai bincike dangane da ko tana tallafawa sabis ɗin. Ana iya cewa Digest yana da ɗan ƙaramin ƙarfi aiwatarwa akan masu sanƙo. Ina gayyatarku ku shiga wannan.

AuthName "Buga ƙofa kafin shiga."

Saƙo ne wanda zai bayyana ga mai amfani a cikin burauzar tare da hanyar shiga kuma yana iya zama wanda muke so.

AuthUserFile /var/www/.pass/.htpasswd

Hanyar fayil .htpasswd. Saboda wannan dalili shine na ce ba ma mahimmanci a sanya shi ba .htpasswd, kawai sanya hanyar zai yi daidai.

Bayi mai amfani mai amfani

An tsara wannan layin don masu amfani da yawa tare da keɓaɓɓun kalmomin shiga. Idan ya kasance mai amfani ɗaya ne, ana iya taƙaita shi azaman mai bambanta.

Ana buƙatar mai amfani el_que_sea

A cikin misali na na iya zama: Ana buƙatar mai amfani Luka

Kuma a ƙarshe mun haɗa komai da

Mun sake farawa apache:

# service apache2 restart

Mu gwada.

Idan bamu tantance gaskiya ba zamu sami Kuskure 401.

A gefe guda, idan muka sanya sunan mai amfani daidai da kalmar wucewa, zai bar mu mu wuce ba tare da wata matsala ba.

Tipsarin nasihu.

• Don ƙara ƙarin masu amfani zuwa fayil ɗin htpasswd da aka riga aka ƙirƙira zaku iya amfani da wannan umarnin

htpasswd -mb /home/krel/.htpasswd Kalmar wucewa ta Mai amfani

Idan kun saita "Buƙatar mai amfani" kuma ba "Nemi mai amfani mai amfani ba" dole ne ku ƙara sabon mai amfani wanda na baya ya bi kuma an raba shi da sarari. Misali:

Ana buƙatar mai amfani Luka Anakin

• Yi amfani da ƙungiyoyin masu amfani

Idan maimakon kowane mutum mai amfani mun fi so ko muna buƙatar aiki tare da ƙungiyoyi akan rukunin yanar gizon mai zuwa suna bayyana shi dalla-dalla kuma kyakkyawan labari ne.
http://www.juanfelipe.net/node/23

• Hakanan zamu iya saita wani nau'in ɓoyayyen ɓoye, misali: SHA

htpasswd -sb /home/krel/.htpasswd Kalmar wucewa ta Mai amfani

Anan hoto ne na yadda za a nuna rajistar kalmar sirri ta SHA a cikin .htpasswd. A cikin duka ya kasance "skywalker".

Karin bayani

htpasswd --taimako

Idan kana so ka zurfafa cikin wannan batun, RTFM koyaushe tana da kyau!
http://httpd.apache.org/docs/2.0/es/howto/auth.html

http://httpd.apache.org/docs/2.2/misc/password_encryptions.html

Wannan rubutun na PHP daga shafin Jami'ar Granada shima ya kasance yana bani sha'awa don ƙirƙirar janareta na htaccess da htpasswd. Ban sami damar aiwatar da shi ba amma ina gayyatarku "kuyi hankali da hankali."

Samfurin HTML na samo daga wannan shafin idan kowa yana da sha'awar.
http://www.templatemo.com/

Fata kuna son wannan gabatarwar ta htpasswd.