OSC Admin.. SSL

**miko** · 01-24-2003, 06:50 AM

When i am using my admin it doesnt prompt me to enter passwords or anything.. and it says im not using SSL whne i did specify use SSL in the installation.

Do i need to go out and get SSL separatly? if so where and what do i do!

Miko

**michael_s** · 01-24-2003, 07:01 AM

You have to protect the dir with .htaccess. This is explained in the guide.

SSL for the admin is set in catalog/admin/configure.php

You need to do this manually.

**miko** · 01-24-2003, 07:27 AM

You mean in the catalog/admin/configuration.php file right?

I cannot find what to change and whihc guide are you talking about ... ive tried to download those but they arent working for me for some reason.

**michael_s** · 01-24-2003, 07:52 AM

No, I mean /catalog/admin/includes/configure.php

You have downloaded and installed v2.1. This site and documentation only support v2.2CVS.

The guide is in the download section of this website. Pick one - Acrobat 5.0 version, MSword XP version and download.

Make sure you have acrobat reader 5 or MS word XP, or you will not be able to read them. Acrobat reader 5 is free from Adobe.com

**miko** · 01-24-2003, 10:12 AM

okay so i got he guide and i read it and it says:

Code:

use .htaccess on your /admin directory so that it is
password protected.

I found the .htaccess file and it says

Code:

# Example&#58;
#
#&lt;Directory "/usr/local/apache/htdocs">
#  AllowOverride Limit
#&lt;/Directory>
#
# 'All' with also work. &#40;This configuration is in your
# apache/conf/httpd.conf file&#41;

&lt;IfModule mod_setenvif.c>
  &lt;IfDefine SSL>
    SetEnvIf User-Agent ".*MSIE.*" \
             nokeepalive ssl-unclean-shutdown \
             downgrade-1.0 force-response-1.0
  &lt;/IfDefine>
&lt;/IfModule>

and they say to edit this file 'httpd.conf' which i found and this is where i think your supposed to edit it...

Code:

# Each directory to which Apache has access, can be configured with respect
# to which services and features are allowed and/or disabled in that
# directory &#40;and its subdirectories&#41;. 
#
# First, we configure the "default" to be a very restrictive set of 
# permissions.  &#40;dev5 is not as strict as default !!! &#91;Options FollowSymLinks&#93;&#41;
#
&lt;Directory />
    Options FollowSymLinks MultiViews
    AllowOverride None
&lt;/Directory>

BUT... i have no clue what to do.... ?

**michael_s** · 01-24-2003, 10:26 AM

Ok, this really is apache 101, you should really know this stuff it you are adminstering a web server or installing software on a server. You are attempting to do a high level activity - install complex software - without the basic knowledge of how to operate your server. It is critical that you understand how apache works (at least on the most basic level) or you will keep getting stumped by this basic stuff.

I suggest you get a book about apache or go to the apache website and read the docs (at least on htaccess). Also a google search on htaccess will get you the info you are looking for.

To answer your immediate question about .htaccess read this post:

http://oscdox.com/modules.php?op=mod...light=htaccess

**miko** · 01-24-2003, 11:12 AM

Could i not jsut get aorund this by using the Apache SSL server?

**michael_s** · 01-24-2003, 04:36 PM

No. Again, this is basic Apache and basic web security (very basic).

SSL does not restrict access to the dir, it only makes it secure between the server and browser, so anyone can demolish your data, but they can do it over a secure connection.

Just read the above posts, and do what they say. It is not difficult, and you will have a secure admin.

**miko** · 01-27-2003, 05:15 AM

Alrighty....i looked at the other postings... and i went to that site where it makes the files for you.

http://www.kelv.net/programming/htaccess/

My question now is for the top part(.htpasswd )
do i create a file for that and where do i put it..

and for the .htaccess file... the text that comes up.. i just replace the whole uncommented part of the old .htaccess file?

thanks.. i apologize if i seem to be dragging

Miko

**michael_s** · 01-27-2003, 09:20 PM

You create the .htpasswd file, you can do this with a text editor or you can SSH to you server and pico .htpasswd, and edit right on the server.

If using a text editor, paste the encrypted passwords into this file (that you generated at the website), and save the file on your local computer as htpasswd.txt

Once you ftp this file to your home dir on your server, rename it to .htpasswd. In your .htaccess file, make sure you enter the correct path to .htpasswd.

I am not sure what you are asking about the .htaccess file...

OSC Admin.. SSL

LinkBack

Thread Tools

OSC Admin.. SSL

got the guide still have questions

SSL

Okie....

Bookmarks

Bookmarks

Posting Permissions