I just finished reading through 1,200 posts today with another a couple of hundreds later today. Anyway quickly, here's how I protected my scripts in NT:
I have lots of scripts, so I basically made a frame in 2 parts, one the menu to pick which script I want to log in. Also in the menu is logon/logoff script. This is the script:
Logon.pl
Code:
#!/usr/local/bin/perl
#######################################################################
# logon.cgi Log On Script
# Created by Craig David Horton chorton@neo.lrun.com
# Copyright (c) 1996 All Rights Reserved.
#
# This script MAY NOT be redistributed for any reason without
# the expressed written consent of the author . All copyrights reserved.
########################################################################
# Define location of passwd.txt file as created from Matt's Script Archive.
$passfile="d:/inetpub/youdirectory/password.cgi";
$logfile ="d:/inetpub/youdirectory/logon.cgi";
# Get the input
read(STDIN, $buffer, $ENV{'CONTENT_LENGTH'});
# Split the name-value pairs
@pairs = split(/&/, $buffer);
foreach $pair (@pairs)
{
($name, $value) = split(/=/, $pair);
# Un-Webify plus signs and %-encoding
$value =~ tr/+/ /;
$value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;
$FORM{$name} = $value;
}
if ($ENV{'REQUEST_METHOD'} eq "POST") {
# Print out a content-type for HTTP/1.0 compatibility
print "Content-type: text/html\n\n";
open(PASSWD,"$passfile") | | die $!;
$passwd_line = <PASSWD>;
chop($passwd_line) if $passwd_line =~ /\n$/;
close(PASSWD);
($username,$passwd) = split(/:/,$passwd_line);
$test_passwd = crypt($FORM{'password'}, substr($passwd, 0, 2));
open(FILE,">$logfile") | | die $!;
if (!($test_passwd eq $passwd && $FORM{'username'} eq $username)) {
$access="No One";
} else {
$access=$ENV{'REMOTE_HOST'};
}
print FILE "$access";
close(FILE);
print "<Head><Title>DBasics Log In Script</Title></Head>\n";
print "<h1><center>$access Logged On</center></H1>\n";
print "</body></html>\n";
exit;
} else {
# Print out a content-type for HTTP/1.0 compatibility
print "Content-type: text/html\n\n";
print "<Head><Title>DBasics Log In Script</Title></Head>\n";
print "<h1><center>DBasics Log In Script</center></H1>\n";
print "<FORM METHOD=\"POST\" ACTION=\"logon.pl\">\n";
print "<center><p><b>Username: </b><input type=text name=\"username\"> ";
print "<b>Password: </b><input type=password name=\"password\">\n";
print "<P><input type=submit> <input type=reset></center>\n";
print "</form></body></html>\n";
exit;
}
# END OF SCRIPT
You will need make a password.cgi and a logon.cgi in your directory. Make sure you modify logon.pl to point to the those files. For password.cgi, you will need encrypt the password and put it into the format:
logon:aaTPRWbi3eh7Q
where logon is the user name and aaTPRWbi3eh7Q is the encrypted password.
Now put this little code snippet into the scripts you wanted to protect:
# Place This Snippet At Top of Sensite Scripts
$logfile ="d:/inetpub/yourdirectory/cgi-bin/logon.cgi";
open(FILE,"$logfile") | | die $!;
$logon=<FILE>;
close(FILE);
if ($ENV{'REMOTE_HOST'} ne $logon) { exit; }
# End of Snippet
That's basically it. Now logon to logon.pl and enter the login/password then you can start using your scripts. Be sure to logout to erase your IP just in case of IP spoofing.
The only problem is users cannot login simutaneously. Does anyone know a way to let it do that? I would gladly appreciate it.
------------------
XanthisHP
http://boom.home.dhs.org BOOM! Flash 3 Resource - When there's a Flash, there's a BOOM!
