Backups and Revisioning

8/19/08 - Ok so version 4.6 has some nice automatic revisioning/backup features... the next release will let us compare the new .htaccess file with the old .htaccess files just like wikis. (based once again on wordpress core)..

So now that the SID module system is pretty stable and there is now decent backups going on, the next thing I'll be adding is multi-user and group management. And much more access control by IP address and other ids.

The point of doing all that is so the plugin will be stable enough code-wise so we can focus in on developing custom SIDs for protecting wordpress blogs.. Mod_Security rules are on the way....

The SID Module Redesigned

8/14/08 - I'm finally mostly happy with the system now used by this plugin to update/modify/and use the different modules. The old code just wasn't future-proofed enough. This new version is based very much off of the WordPress Plugins code, so it is future proofed.

This "Improvements" page is the start of whats to come, Basically each of the security modules (and there are a LOT of great mod_security ones coming) will have their own very Basic settings. So you can tweak the settings. If someone finds an improvement they can send it for review. New ideas and modules can be submitted here also.

.htaccess File Revisions

';
		echo htmlspecialchars( $content );
		echo '

Test for Compatibility and Capability

First we need to run a series of tests on your server to determine what capabilities your site has and also to locate any potential installation problems.

The tests will be run on temporary files I'll create in your /wp-content/askapache/ folder. They will create .htaccess and .htpasswd files in that temp location and then use fsockopen networking functions to query those files. This tells us exactly how your server handles .htaccess configurations, HTTP authentication schemes, Apache Module capability, etc..

Known Support Only check these if you are 100% sure your server supports them. This bypasses auto-detecting support.	/> .htaccess files supported /> mod_alias Redirects supported /> mod_rewrite supported /> mod_security supported /> mod_auth_digest supported /> digest authentication supported /> basic authentication supported

Several tests send specially crafted HTTP requests which are designed to elicit very specific HTTP Protocol Responses to accurately determine your servers capabilities.

Other important checks will run: file permissions, function availability, much more boring testing. The tests are fast and you can re-run them whenever you want. If you'd like to see the action, define AA_PP_DEBUG to true in the source of this file. Good Luck!

Setup Password Protection

Create User

Admin Email Username and Password sent here in case you forget it.
Username
Password (twice)

Authentication Scheme

Choose Scheme	/> Digest — Much better than Basic, MD5 crypto hashing with nonce's to prevent cryptanalysis. /> Basic — Cleartext authentication using a user-ID and a password for each authname. This is the mechanism by which your credentials are authenticated (Digest is strongly preferred)

Authentication Settings

Password File Location	Use a location inaccessible from a web-browser if possible. Do not put it in the directory that it protects.
Realm Name	The authname or "Realm" serves two major functions. Part of the password dialog box. Second, it is used by the client to determine what password to send for a given authenticated area.
Protection Space Domains	One or more URIs in the same protection space (i.e. use the same authname and username/password info). The URIs may be either absolute or relative URIs. Omitting causes client to send Authorization header for every request.

Encryption Preferences

Password File Algorithm	/> CRYPT — Unix only. Uses the traditional Unix crypt(3) function with a randomly-generated 32-bit salt (only 12 bits used) and the first 8 characters of the password. /> MD5 — Apache-specific algorithm using an iterated (1,000 times) MD5 Digest of various combinations of a random 32-bit salt and the password. /> SHA1 — Base64-encoded SHA-1 Digest of the password.

Note I do not store or save your password anywhere, so you will need to type it in each time you update this page.. for now.

Manage Security Modules

Modules are inserted into your server .htaccess configuration files. Once a module is installed, you may activate it or deactivate it here.

$arr ) aa_pp_print_sids_table( $arr, $n ); ?>

";
			foreach( $rules as $line )@$_POST['notice'] .= htmlentities( $line );
			@$_POST['notice'] .= '

Test Results

Required Checks

The tests performed by this page are currently required to determine your servers capabilities to make sure we don't crash your server. The utmost care was taken to make these tests work for everyone running Apache, which is crazy hard because we are testing server configuration settings programmatically from a php binary without access to server configuration settings.

So we achieve this by modifying your server's .htaccess configuration file and then making special HTTP requests to your server which result in specific HTTP responses which tell us if the configuration changes failed or succeeded. The most widely allowed (by web hosts) and compatible 4+5 php function that provides access to sockets is fsockopen, so it is required. The next version will fallback to curl, but if your web host has disabled fsockopen you can bet you don't have curl.

File Permission Tests

If any of these checks fail this plugin will not work. Both your /.htaccess and /wp-admin/.htaccess files must be writable for this plugin, those are the only 2 files this plugin absolutely must be able to modify. If any of the other checks fail you will need to manually create a folder named askapache in your /wp-content/ folder and make it writable.

Encryption Function Tests

Your php installation should have all of these. The md5 is the only one absolutely required, otherwise I can't create the neccessary password files for you.

Revision Tests

This checks for the neccessary file permissions and functions needed to utilize the .htaccess file revision support.

Decompressed MD5: " . $data_decompress_md5 . "
Compressed MD5: " . $data_md5 . "

"; } ?>

.htaccess Capabilities

These tests determine with a high degree of accuracy whether or not your server is able to handle .htaccess files, and also checks for various Apache modules that extend the functionality of this plugin. The 2 modules you really want to have are mod_rewrite and mod_auth_digest. In future versions of this plugin, we will be utilizing the advanced security features of mod_security more and more, so if you don't have it, bug your web host about it non-stop ;)

sockit( "{$test_url_base}test.gif" ) == 200 ) ? 1 : 0; $msg = ( $atest ) ? $aok : $fail; echo $m_s . $msg . " .htaccess files allowed" . $m_e; $tester = new AskApache_Net; $ap['mod_alias_support'] = $atest = ( $tester->sockit( "{$test_url_base}modaliastest" ) == 305 ) ? 1 : 0; $msg = ( $atest ) ? $aok : $warn; echo $m_s . $msg . " mod_alias detection" . $m_e; $tester = new AskApache_Net; $ap['mod_rewrite_support'] = $atest = ( $tester->sockit( "{$test_url_base}test.gif?modrewritetest=1" ) == 307 ) ? 1 : 0; $msg = ( $atest ) ? $aok : $warn; echo $m_s . $msg . " mod_rewrite detection" . $m_e; $tester = new AskApache_Net; $ap['mod_security_support'] = $atest = ( $tester->sockit( "{$test_url_base}modsec_check.gif?modsecuritytest" ) != 200 ) ? 1 : 0; $msg = ( $atest ) ? $aok : $warn; echo $m_s . $msg . " mod_security detection" . $m_e; $tester = new AskApache_Net; $ap['mod_auth_digest_support'] = $atest = ( $tester->sockit( "{$test_url_base}digest_check.gif" ) == 200 ) ? 1 : 0; $msg = ( $atest ) ? $aok : $warn; echo $m_s . $msg . " mod_auth_digest detection" . $m_e; ?>

HTTP Digest Authentication

Now we know the encryption and apache module capabilities of your site. This test literally logs in to your server using Digest Authenticationts, providing the ultimate answer as to if your server supports this scheme.

authtype = ''; $rb = ( $tester->sockit( $test_url_base . 'digest_auth_test1.gif' ) == 401 ) ? 1 : 0; $tester->sockit( str_replace( '://', '://testDIGEST:testDIGEST@', $test_url_base ) . 'digest_auth_test1.gif' ); $tester->authtype = 'Digest'; $rg = ( $tester->sockit( str_replace( '://', '://testDIGEST:testDIGEST@', $test_url_base ) . 'digest_auth_test1.gif' ) == 200 ) ? 1 : 0; $ap['digest_support'] = $atest = ( $rb && $rg ) ? 1 : 0; $msg = ( $atest ) ? $aok : $fail; echo $m_s . $msg . " Digest Authentication Attempt" . $m_e; if ( !$atest ) { $tester = new AskApache_Net; $tester->authtype = ''; $rb = ( $tester->sockit( $test_url_base . 'digest_auth_test.gif' ) == 401 ) ? 1 : 0; $tester->sockit( str_replace( '://', '://testDIGEST:testDIGEST@', $test_url_base ) . 'digest_auth_test.gif' ); $tester->authtype = 'Digest'; $rg = ( $tester->sockit( str_replace( '://', '://testDIGEST:testDIGEST@', $test_url_base ) . 'digest_auth_test.gif' ) == 200 ) ? 1 : 0; $ap['digest_support'] = $atest = ( $rb && $rg ) ? 1 : 0; $msg = ( $atest ) ? $aok : $fail; echo $m_s . $msg . "2nd Digest Authentication Attempt" . $m_e; } } else echo $m_s . $msg . $fail . " Major bummer... you don't have mod_auth_digest! (included in apache since 1.1)" . $m_e; ?>

Basic Authentication Encryption Algorithms

Basic Authentication uses the .htpasswd file to store your encrypted password. These checks perform actual logins to your server using a different .htpasswd encryption each time.

sockit( $test_url_base . 'basic_auth_test.gif' ) == 401 ) ? 1 : 0; if ( $ap['crypt_support'] != 0 ) { $tester = new AskApache_Net; $rg = ( $tester->sockit( str_replace( '://', '://testCRYPT:testCRYPT@', $test_url_base ) . 'basic_auth_test.gif' ) == 200 ) ? 1 : 0; $ap['crypt_support'] = $atest = ( $rb && $rg ) ? 1 : 0; $msg = ( $atest ) ? $aok : $fail; echo $m_s . $msg . " Basic Authentication Attempt using Crypt Encryption" . $m_e; } if ( $ap['md5_support'] != 0 ) { $tester = new AskApache_Net; $rg = ( $tester->sockit( str_replace( '://', '://testMD5:testMD5@', $test_url_base ) . 'basic_auth_test.gif' ) == 200 ) ? 1 : 0; $ap['md5_support'] = $atest = ( $rb && $rg ) ? 1 : 0; $msg = ( $atest ) ? $aok : $fail; echo $m_s . $msg . " Basic Authentication Attempt using MD5 Encryption" . $m_e; } if ( $ap['sha1_support'] != 0 ) { $tester = new AskApache_Net; $rg = ( $tester->sockit( str_replace( '://', '://testSHA1:testSHA1@', $test_url_base ) . 'basic_auth_test.gif' ) == 200 ) ? 1 : 0; $ap['sha1_support'] = $atest = ( $rb && $rg ) ? 1 : 0; $msg = ( $atest ) ? $aok : $fail; echo $m_s . $msg . " Basic Authentication Attempt using SHA1 Encryption" . $m_e; } $ap['basic_support'] = $atest = ( $ap['sha1_support'] != 0 || $ap['md5_support'] != 0 || $ap['crypt_support'] != 0 ) ? 1 : 0; $msg = ( $atest ) ? $aok : $warn; echo $m_s . $msg . " Basic Authentication Access Scheme Supported" . $m_e; ?>

Compatibility Checks

Checks different software to make sure its compatible with this plugin.

PHP.ini Information

Some information about your php.ini settings. The following settings may need to be tweaked. Likely they are fine.

'; wp_nonce_field( 'askapache-passpro-form' ); if ( !$htaccess_test1 || !$htaccess_test2 || !$netok || $aa_PP['htaccess_support'] != 1 ) { echo '

Im very sorry, but unless you can resolve the failed requirements above you cannot utilize this plugin at this time. :(

'; echo '

Change the AA_PP_DEBUG to true in the source code of this plugin for verbose reasons why these tests failed.

'; echo ''; echo '

'; } else { echo ''; echo '

'; } echo '

'; echo '

';
					print_r( $this->request_headers );
					print_r( $this->response_headers );
					echo '