.htaccess logging

[kevinpham]

I have seen many CGI scripts that log member information such as IP address, and can ban member from accessing the .htaccess protected directory if that username/password is used by more than, let say, 7 IP addresses

My question is that how can you call a CGI script when a member enter their username/password when prompt???

[sugarkane]

welcome to WebmasterWorld Kevin

We had a short thread on a similar topic here [webmasterworld.com] which might be of help.

Another option is controlling the authentication directly using PHP (if you've got it installed as a server module):

[perl]
Header("WWW-Authenticate: Basic realm=\"My Realm\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Text to send if user hits Cancel button\n";
[/perl]

will fire up an authentication request, and two variables, $PHP_AUTH_USER and $PHP_AUTH_PW will be returned.

You could then use these variable in any way you want eg checking for a valid password, serving up different pages per user, or as you suggest keeping a count of how many users have logged in with that username.

Hope that gives you a few ideas.

[nosanity]

I completely agree with sugarkane about using PHP. You really should take a look at using the auto_prepend configuration directive in an htaccess file, along with raising the authentication dialog. This will allow you to keep track of a user, use a database, and have much better limitations on a users use.

You can also use this method for access control groups instead of the Group directive within the LIMIT directive of a .htaccess file.

Now, I know you can do the same in perl, but remember, if you are not using mod_perl you will have a much higher overhead than using PHP.

If you need more help, just ask! :)

noSanity