Securing one particular file on the server; .htaccess good way of doing it?

Question

I have a classifieds website.

I as an administrator need to be able to remove classifieds as I wish... So I have created a very simple remove function which only requires the name of the classified.

I plan on placing it on the server ONLY when I need to remove classifieds, so it wont be there unless I upload it and plan on using it. Then remove it when I am done.

I also plan on using htaccess to password protect it.

Is this a good plan?

And is it possible to only password protect one file on the server with htaccess? If so, how?

Thanks...

Answer 1

You need to create a sub-directory called /admin or /remove, I don't think you can use it secure a single file. You shouldn't need to add and remove the file when you need to, that seems like a recipe for screwing up your authorization scheme (accidentally deleting .htaccess etc).

If you choose a strong password and good username (not admin or administrator), you should be just fine.

Answer 2

You've got two choices: <Location> or <Directory> in the server config (they can't be placed in .htaccess), or a .htaccess file

<Location /admin>
   Order Deny,Allow
   Deny from All
   Allow from your.ip.addr.ess
   AuthType Basic
   AuthName "Admin page. Keep out"
   AuthUserFile /some/path/htpasswd
   AuthGroupFile /dev/null
   Require valid-user
</Location>

Location allows you to restrict by URL, which will match regardless of where the files are physically stored on the server, but also can be bypassed if you allow symlinks to be followed. Directory works the same way, but matches by physical server-side path, regardless of how the directory/file is accessed. With Location, you can specify an absolute path, including a file, to match on, if you want to restrict just the one file.

With .htaccess, you're essentially duplicating the Directory directives, but can do so without having to bounce the server to load the new configuration, at the cost of the .htaccess having to be parsed for every request.

It's best to not rely on password protection alone to secure administrative scripts, so I've added the IP address (Order/Deny/Allow directives) filter as well. Better security yet is to place the admin scripts on a completely seperate domain (even if it's still hosted on the same physical server) so someone poking at random URLs on the main site won't find the adminstrative section.