From owner-freebsd-isp  Wed Apr  7 12:47: 5 1999
Delivered-To: freebsd-isp@freebsd.org
Received: from heaven.gigo.com (ppp.gigo.com [207.173.132.1])
	by hub.freebsd.org (Postfix) with ESMTP id CA5F714F1E
	for <freebsd-isp@freebsd.org>; Wed,  7 Apr 1999 12:46:50 -0700 (PDT)
	(envelope-from jfesler@gigo.com)
Received: from heaven.gigo.com (heaven.gigo.com [207.173.133.57])
	by heaven.gigo.com (Postfix) with ESMTP
	id 6D4E0CD; Wed,  7 Apr 1999 12:44:53 -0700 (PDT)
Date: Wed, 7 Apr 1999 12:44:53 -0700 (PDT)
From: <jfesler@gigo.com>
To: Deepwell Internet <freebsd@deepwell.com>
Cc: Ryan Mooney <ryan@pcslink.com>, freebsd-isp@freebsd.org
Subject: Re: Apache users file (was Re: Web Based Script)
In-Reply-To: <4.1.19990408123628.012aec70@mail1.dcomm.net>
Message-ID: <Pine.BSF.4.05.9904071242380.383-100000@heaven.gigo.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-isp@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

> master.passwd and they also exist in a .db file.  I wouldn't want to raise
> the permissions of httpd, and I don't want to open hte shadow file to everyone.


You'll want a cron event that makes a copy, owned by the web server, mode
700.  Secondly, you'll want the web server to _not_ serve that document -
ie, using the <Files> directive.  Assuming you name it .htpasswd ..


<Files .htpasswd>
    Order allow,deny
    Deny from all
</Files>






To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-isp" in the body of the message