In the previous lesson we saw how to slow down brute force attacks or even denial of service attacks
by means of rate limiting but let's say you have an area of your website not intended for users but
rather for administrators or contributors of the site.
You quite simply want to deny any unauthorized requests.
A great solution for this is basic authentication or basic AWF basic or provides a simple username and
password layer to any part of your site and is relatively straightforward to implement.
To demonstrate I'll add it to this demo site home page.
But before we can add all th indication we'll have to generate a simple password file in the HD password
format.
To do this will again be using that same suite of tools we installed to get the Apache bench tools.
Get install apache to use tools or yum install HTP de tools on centos but of course I already have this
installed so the command we're going to use is h t pass w d or HD password setting a C flag to indicate
that we want to generate a password written to a file at EDC slash engine X dot HD password.
So ahead in file then with that prefixed dot for a given user name I'll just make it user one enter
were prompted for a password or make this no secret.
Enter and confirm.
Done adding password for user use of one check that newly generated password file cat iti see engine
x h.t. Password and there we have it a very simple password file containing that user we created user
one and its corresponding password hash.
So now having a password file we can implement basic auth with access granted as per the contents of
that file in this default static location.
Oh get rid of the rate limit implementation adding auth underscore basic so enabling basic or for any
request to this location with the value being the message that will get displayed to the user when prompted
to authenticate secure area.
And secondly tell engine x way to find the password file.
AUTH basic user file iti see slash engine X slash dot HD password save this.
Reloader configuration.
And now we know reload this page in the browser.
We get this native dialogue prompting us to authenticate with the message secure area.
Enter those credentials.
User 1 and my password.
No secret which works and we are granted access.
Or more specifically the request for indexed Odd h.t. email is served with most browsers giving you
the option to store these credentials for automatic future Loggins.
That's all there is to adding basic authentication and as you can see this is a quick and easy solution
to block or secure areas of your site.