General Web Prgrming. - Where is this password stored?

[DevInCode]

I'm working on a site that has been left to die for a few years. There is a login to access a certain part of the site. I can't figure out where this password is stored.

When the private html page is accessed the box pops up asking for credentials. It says 'A username and password are being requested by http://www..com. The site says: "Restricted Area"'

If incorrect credentials are supplied it gives a 401 error. Suggestions?

If it helps, its running on a centos linux box. (I think).

Thanks!

[Markus]

@DevInCode
Could be a .htaccess restriction (look for an .htaccess file - it will be hidden, usually) or it may be happening on the server (apache, whatever).

[DevInCode]

I see, I can see the user name, but obviously the password is blanked out. That isn't the issue though. I really don't want the popup box on the webpage, its just a poor way of asking for information. Is it possible I could get this information from the user then authenticate with PHP?

[Markus]

@DevInCode
You could do it all with PHP, sure.

Store the username and a hash of the password in some sort of database (can be flat-file, or in a database such as MySQL).

On pages that need a level of restriction, require the user to enter a username and password, compare these to the stored values. If they match, awesome, let the in. If not, refuse them access.

[DevInCode]

I can do it with a database, yes. But is there any way to to it with the passwd file?

[Markus]

@DevInCode
The passwd file? If the password is stored inside it, then yes.

[DevInCode]

The user seems to match without a problem, but when I enter the password it never finds a match. When I print out the hashed password the user entered and the password from the passwd file, they look identical. Why aren't they matching?

ideas?

 
foreach ($data as $line)
    {
  $arr = explode(":", $line);
 
 
 
  // if username matches
  // test password 
 
      if ($arr[0] === $user)
      {
        $temp .= $user;
        $temp .= "|";
        $temp .= $arr[0];
          // get salt and crypt()
          $salt = substr($arr[1], 0, 2);
          echo "user found";
          // if match, user/pass combination is correct
          // return 1
          $temp .= "<br>" . $arr[1] . "<br>" . crypt($pass, $salt);  
          if ($arr[1] === crypt($pass, $salt))
          {
          $result = 1;
          $temp .= "user pass good";
          break;
          }
          // otherwise return 0
          else
          {
        $result = 0;
        break;
          }
      }
 
    }

[DevInCode]

stupid trim. Fixed it :)

[Markus]

Glad we could be of help ;)