$Id: Passwords.txt,v 1.6 2000/12/28 05:13:37 dan Exp $



MIG AND PASSWORDS
-----------------

Table of Contents:

  1. Password Protection
  2. Crypt Format
  3. How do I protect the main level ('currDir=.') ?


PASSWORD PROTECTION
-------------------

You may want to protect some folders from being viewed by the public.
You can do this by assigning usernames and passwords for access control
to particular folders.

To do this, add lines like this one to your mig.cfg file:

    $protect['./Example_Gallery']['joe'] = 'IBDXWbkBirMfU';

The part in the first set of []'s is the directory.  The second set of []'s
contains the username.  The part in '' at the end is the password, in unix
crypt() format.

The directory name is the value of currDir as seen in any URL when you go
to that folder.  Some examples might be:

    ./Example_Gallery
    ./People/Stephanie
    ./Trips/Europe

The password protection includes subfolders - so if you have a Trips/Europe
folders, and it contains many subfolders, they will also have the same
password protection properties.

Note that if you have a defined password policy for say Trips/Europe/Belgium,
it will override Trips or Trips/Europe.  The rule is simple - the most
specific definition wins.  Or, one could say the longest folder name wins.

A more complete example might be something like this:

    $protect['./People/Stephanie']['dan'] = 'NI6kjeu0Bu5OA';
    $protect['./People/Stephanie']['kate'] = 'BSkfNxImwPHeQ';
    $protect['./People/Stephanie']['mom'] = 'IGSQpYrjm0znM';

    $protect['./Trips/Europe/Belgium']['joe'] = 'NLmqM5pt3s6Xc';
    $protect['./Trips/Europe']['fig'] = 'RRElq4KBFcLhk';

It is important to use only the currDir string you want.  Do not add a
trailing slash, and do not omit any characters at the end.  Do not omit the
leading ./ either.

So if you have currDir=./People/Stephanie, use "./People/Stephanie"
and not "People/Stephanie" or "./People/Stephanie/".



CRYPT FORMAT
------------

But wait!  How do I generate unix crypt() format passwords?

Well, you can do it like this in PHP:

    <?php
        $pass = 'somepassword';
        $salt = 'Ai';
        print crypt($pass, $salt);
    ?>

The salt is any two-character combination - it is used to seed the random
generation process, so to speak.  Any two characters are good enough (but
you can't use ":" (colon) in a salt).

If you have access to Perl somewhere (most of us do), you can also find a
script in the contrib directory that will generate crypt format passwords
for you.  Here's the URL to that script:

    http://tangledhelix.com/software/mig/downloads/contrib/crypt


HOW DO I PROTECT THE MAIN LEVEL ('currDir=.') ?
-----------------------------------------------

You could set up an .htaccess file in Apache, or the equivalent mechanism
for your server, on your gallery base directory.

If you want to do it using MiG's own password scheme, just set something
like this:

    $protect['.']['kate'] = 'BSkfNxImwPHeQ';

