AWStats password protection in Apache

[Tom Lewandowski]

I've been trying to find a solution for this through Google searches, but I haven't been able to find much on it; and I'm not really quite sure on how AWStats works and displays its results. Maybe someone here can help?

I'd like to password protect access to the AWStats results.

System:
WinXP Pro
Apache 2
ActiveState Perl 5.8
AWStats 6.3
etc.

I've installed AWStats to the default 'c:\Program Files\AWStats\', which places the awstats.pl location at 'c:\Program Files\AWStats\wwwroot\cgi-bin\awstats.pl'. Since AWStats seems to be working primarily from this directory (the logs and config files are there), I thought using htaccess and htpasswd would work to password protect the results, but it doesn't.

(example)
AuthUserFile c:/Program Files/AWStats/wwwroot/cgi-bin/.htpasswd
AuthType Basic
AuthName "AWStats Login"
<Limit GET POST>
require valid-user
</Limit>

Since you access the logs via a web browser with a URL that doesn't exist (http://mydomain.com/awstats/awstats.pl?config=mydomain.com), I don't understand where (or if) you can place the htaccess/htpasswd file to affect the result display.

Perhaps changing/adding something to my VirtualHost description in regards to the CustomLog?:

<VirtualHost *:80>
ServerAdmin [e-mail]
DocumentRoot C:/clients/mydomain/public_html
ServerName www.mydomain.com
ServerAlias mydomain.com

ErrorLog logs/mydomain.com-error_log
CustomLog logs/mydomain.com-access.log combined
</VirtualHost>

I'm using htaccess to password protect a couple of other directories on this domain, and it works fine. So I assume, there's no other directives I need to enable in the VirtualHost tag to make it work.

Any suggestions or help would be appreciated.

Thanks.

[jdMorgan]

Check the mechanism used to alias the stats into the web directory. This may be done with mod_rewrite or with mod_alias. You need to make sure that the module that maps the script into your web space executes *after* mod_auth. Otherwise the local path will be changed before your auth code runs in .htaccess.

This problem really isn't AWStats-specific; Generally, your whole cgi-bin directory should be protected from direct web access.

Jim

[Tom Lewandowski]

the module that maps the script into your web space executes *after* mod_auth.

Well, mod_auth is right at the top of the LoadModule list, so it looks like it's being executed first. AWStats is the only CGI based program I'm using, though Apache is setup to run scripts from any directory.

I just found an option in the AWStats config file for requiring authentication by using htaccess, but it's not explained in a way I understand. I enabled it (while keeping the htaccess/htpasswd files there), and I receive a browser error stating 'Authentication is required'. (Seem to be in a catch-22, there.)

I've never run anything from a "Program Files" subdirectory, and I wondered if maybe the:

AuthUserFile c:/Program Files/AWStats/wwwroot/cgi-bin/.htpasswd

should instead be:

AuthUserFile c:/progra~1/AWStats/wwwroot/cgi-bin/.htpasswd

Windows long file names have always thrown me when using to describe a path. Though, I'be tried both ways. I've disabled AWStats for now until I can figure this out...

[jdMorgan]

> top of the LoadModule list, so it looks like it's being executed first.

Not sure about Apache 2, but in Apache 1.3, modules are executed in reverse priority from their position in the LoadModule list. In other words, listed first, executed last.

The path given in AuthFile should be below Apache, not out in the general filesystem of your machine.

Jim

[Tom Lewandowski]

Shoot. You're right -- Apache loads modules the same in Windows, and I forgot all about that.

It's been stange using Windows and installing server software. Some recommend (like AWStats) to install under "Program Files", some (like Perl) in \www\bin...etc. I installed most everything under a "www" directory...except for AWStats. I think my best option is to reinstall, as you've said, under my Apache directory.

Thanks!

[Ybnorml]

I don't know if this issue has been resolved, but a week or two ago I read of security problems that just began to show up with Awstats. It may be a good thing to check into if you haven't already.

[Tom Lewandowski]

I believe the exploit was resolved with v6.3. There was a vulnerability in earlier versions when "Update From Browser" was enabled for AWStats. Anyway, AWStats recommends updating to v6.3 immediately to avoid the exploit.

A real easy solution I used for 'protecting AWStats' from the public was to simply add "Allow from localhost" in Apache's <Directory> tag for AWStats; all other IP's are forbidden...which was my goal.