Re: Apache & mod_auth_pam

[Waldemar Brodkorb <waldemar@thinknow.de>]

>From the keyboard of Jeremy,

> > > > At the moment I'm using mod_auth_pam for userauthentication on
> > > > special webfolders. /etc/shadow have to be accessed by apache
> 
> > > And second some password-results aren't exposed like the root-pw and 
> > > the accounts to maintain the machine.
> > 
> > How the root-pw or hash of it could be exposed?
> 
> If you are using standard http user authentication is is not encrypted or
> secure. The usernames and passwords are passwd via plain text.

O.k. that is clear. But nobody login as root to see some webalizer
statistics. Only userpasswords could be seen, but if you have
ftp-accounts you also could sniff the passwords.

bye
    Waldemar