apache access to private files, security question . . .

On 03 Mar 2007 in macromedia.dreamweaver.appdev, hconnorjr wrote:

> could someone explain how to keep files hidden from the public but
> still available to be read by apache server. my website appears to
> have the www root under a public_html file, which makes sense, since
> that's where a lot of the display pages are, but if the root is
> public, how can you be certain that admin pages are secure, even if
> they are in a password protected file?

The Apache server can read files from anywhere in the filesystem it has
access to, including above the public_html/ directory. On many
systems, you'll find public_html's physical location to be something
like /home/username/public_html/. A lot of systems are set up such
that, say, a cgi directory on that same system would be
/home/username/cgi-bin/. The server uses those files, even though
they're outside the site root.

I think that your actual question might be how to password protect a
page or a directory? In that case, it depends on how secure you want
it and on how many username/password pairs you want. If it's only a
few, look into using htaccess/htpasswd; if it's more than that,
Dreamweaver's Help files (F1) have information about setting up
password-protected pages.

--
Joe Makowiec
http://makowiec.net/
Email: http://makowiec.net/email.php