Integrate VB security with Apache

[thewitt]

You have a few options that come to mind immediately.

1) Run a periodic script that extracts the usernames and passwords from the vB database and creates your password file for use by .htaccess. Simple, but not real time.

2) Modify (hack) vB to generate a new entry in your .htaccess password file whenever a new user is added to vB (password changed, etc). Will be seen as the user as real time - he gets a vB account on the system, he can use the other authenticated portions of the site.

3) Extend Apache with a new mod_auth_vB module that would read the vB database. It is open source, so you could modify one of the other authentication modules to simply read from vB's schema.

The problem with #3 is that the vB password is currently stored as plain text, so you are at risk on a shared server to opening up your entire website if you use the passwords stored there as your website passwords. Of course if you can modify Apache on your server you are not likely on a shared server anyway...

I guess this risk applies to #1 and #2 as well should anyone hack your vB password list .

I'm not a proponent of plain text passwords anywhere as you might be able to tell.

It would not be difficult to do #1 or #2 (you'll probably want both to populate your password file initially anyway), and if passwords are ever stored secured by default in vB, #3 would be a great addition for folks with dedicated servers.

-t