plugin for htpasswd for admins

[theos]

Hi all,

I've created a little plugin that creates a htpassword-file containing all passwords of the clients that are created in ispconfig3.
I usually use this file to secure webapps like phpmyadmin.

Maybe it is useful for others. This is my first ispconfig3-plugin. Comments are welcome :)

Copy this file to /usr/local/ispconfig/server/plugins-available/adminpassword_plugin.inc.php
Then create a symlink in /usr/local/ispconfig/server/plugins-available
and create the entry $conf['services']['adminpassword'] = true; in /usr/local/ispconfig/lib/config.inc.php

<?php
  // this plugin automatically creates /var/www/.htpasswd_admin
  // TL Snelleman
  // borrowed some code from: http://www.howtoforge.com/forums/showthread.php?t=33026

class adminpassword_plugin {

        var $plugin_name = 'adminpassword_plugin';
        var $class_name  = 'adminpassword_plugin';

        //* This function is called during ispconfig installation to determine
        //  if a symlink shall be created for this plugin.
        function onInstall() {
                global $conf;

                if(@$conf['services']['adminpassword'] == true) {
                        return true;
                } else {
                        return false;
                }
        }

        /*
                This function is called when the plugin is loaded
        */
        function onLoad() {
                global $app;

                /*
                Register for the events
                */

                $app->plugins->registerEvent('client_insert',$this->plugin_name,'client_insert');
                $app->plugins->registerEvent('client_update',$this->plugin_name,'client_update');
                $app->plugins->registerEvent('client_delete',$this->plugin_name,'client_delete');
        }

        function htpassword_update($event_name,$data) {
                global $app, $conf;
                $result = $app->db->queryAllRecords("SELECT * FROM client c");
           

            	$fp = fopen("/var/www/.htpasswd_admin","w");
                if ($fp) {
			foreach($result as $row)
			{
			    $username       = $row['username'];
			    $password       = $row['password'];
			    if ($password != "") {
			  	    fwrite($fp,$username.":".$password."\n");
			    }
			}
		}
                fclose($fp);
        }

	function client_insert($event_name,$data) {
                global $app, $conf;
                $this->htpassword_update($event_name,$data);
        }

        function client_update($event_name,$data) {
                global $app, $conf;
                $this->htpassword_update($event_name,$data);
        }

        function client_delete($event_name,$data) {
                global $app, $conf;
                $this->htpassword_update($event_name,$data);
        }

} //adminpassword_plugin
?>

[till]

Thanks for publishing your plugin! Just a small correction It must read:

Then create a symlink in /usr/local/ispconfig/server/plugins-enabled

[prisfeo]

thanks theos..i'll try..
..
in the meanwhile, i am in test-phase (ispconfig3+centos5.4)
but the main domain server is published,
so i have protected the http://ispconfig.mydomain.com/phpmyadmin
access through editing the following file:
/etc/httpd/conf/sites-available/ispconfig.conf
modifying the following code (red):

# Except of the following directories that contain website scripts
<Directory /usr/share/phpmyadmin>
#Order allow,deny
#Allow from all
Order Deny,Allow
Deny from all
Allow from 127.0.0.1 192.168.1.
</Directory>

so only my 192.168.1.0/24 private net can access to it..
i wonder..
in some changes of ispconfig3 made through the http panel
my above code modifications to /etc/httpd/conf/sites-available/ispconfig.conf will be overwritten ?

i have not used the ".htaccess" file cause i saw that in http.conf
the "AllowOverride" directive is set to "None"..
wil cause ipsconfig related web sites problems if i set to "All" ?

thanks,
bye.

[BorderAmigos]

Does this only run when a new site is created? I installed as above and modified an existing site so ISPConfig3 would update but no .htpasswd_admin file was created.

[fathertime]

The folder setup is different. I tried to use:
/usr/local/ispconfig/server/lib/config.inc.php

and not:

/usr/local/ispconfig/lib/config.inc.php

But it didn't work. I don't know if the directory issue is the problem or not.

---

Is there a way to password protect the phpmyadmin, even by using just the standard process to make a password protected directory?

htpasswd/htaccess?


I don't feel like the server is secured while this is open.

Thanks for the effort though.

[admins]

no answer?
it doesnt work.

thanks
admins

[fathertime]

I put this aside for a bit, while I worked on the ssl setup and configuration.

I couldn't get it to work as instructed in the first post.

I also cannot get .htpasswd or .htaccess to function correctly.

Chmod ... they are rwrr ?

folder used is /usr/share/phpmyadmin

I may be in the wrong folder, but from what I can gather I believe that I am in the right directory.

The end result is that the phpmyadmin is fully accessible via the various websites under /phpmyadmin.

Any suggestions?

T