[mythtv-users] Need help securing mythweb

IvanK. chepati at yahoo.com
Sun Aug 22 14:41:48 EDT 2004


First, sorry for not wrapping the long lines, but I wanted to preserve the syntax.

I'm using mysql authentication.  Here's the .htaccess I stick inside mythweb:

AuthName "MythTV Area"
AuthType Basic

PerlAuthenHandler Apache::AuthDBI::authen
PerlAuthzHandler Apache::AuthDBI::authz

PerlSetVar Auth_DBI_data_source DBI:mysql:database=myth_users;host=localhost;mysql_socket=/tmp/mysql.sock
PerlSetVar Auth_DBI_username mythtv
PerlSetVar Auth_DBI_password mythtv

PerlSetVar Auth_DBI_pwd_table users
PerlSetVar Auth_DBI_uid_field username
PerlSetVar Auth_DBI_pwd_field passwd
PerlSetVar Auth_DBI_grp_field groups

PerlSetVar Auth_DBI_encrypted off

require group MythTV

I have a database called myth_users with one table in it, called users.  The users 
table has three fields, username, passwd and groups.  This is what users look like:

mysql> describe users;
+----------+--------------+------+-----+---------+-------+
| Field    | Type         | Null | Key | Default | Extra |
+----------+--------------+------+-----+---------+-------+
| username | varchar(255) |      | PRI |         |       |
| passwd   | varchar(255) |      |     |         |       |
| groups   | varchar(255) |      |     |         |       |
+----------+--------------+------+-----+---------+-------+
3 rows in set (0.00 sec)

mysql>

You can add a user with this command:

INSERT INTO myth_users.users VALUES("username", "password", "MythTV");

Also, as mysql root make sure you run:

GRANT ALL ON myth_users.* TO mythtv at localhost IDENTIFIED BY "mythtv";
FLUSH PRIVILEGES;

And it'd be a good idea not to use mythtv/mythtv for logging in.  I use mythtv/mythtv only
to open a mysql session from apache.  For the actual apache authentication I user other username
password pair.  In fact I shouldn't be using mythtv at all, but the machine is behind a firewall.

This works for me quite nicely.  Hope it helps you, if you decide to use mysql authentication.
Oh, on top of that, I'm running everything on https.

IvanK.

On Sunday 22 August 2004 01:09 pm, DTR wrote:
> Hi Folks,
> 
> I'm trying to secure my mythweb using simple htaccess/passwd 
> authentication.  I've followed instructions gleaned from searching this 
> list and met with some success.
> 
> I uncommented the lines in the default mythweb .htaccess, successfully 
> created a htpasswd file, changed "AllowOverride" from "None" to "All" in 
> my httpd.conf and restarted the httpd.
> 
> Now it does prompt for a password as it should however once I type the 
> password in, it semi-craps out.  I see the normal program listing trying 
> to load over and over again and in the very top left portion of the 
> screen I see an error message such as:
> 
> Warning at /usr/share/mythtv/mythweb/includes/init.php, line 50: 
> session_start(): 
> open(php_sessions/sess_0781db0909b02b7989ac8e0f92fa10fc, O_RDWR) failed: 
> No such file or directory (2)
> 
> It's almost as if it has access to some but not all of the files/areas 
> it needs in order to function properly.
> 
> The .htpasswd/.htaccess are both in /var/www which is the root of the 
> mythweb site and the allowoverride directive that I changed pertains to 
> /var/www as well.
> 
> Any ideas?
> 


More information about the mythtv-users mailing list