Please help a newbie setup a *secure* members-only site on the web!! - Unfortunately, I have been assigned that duty ;(

What is the *best* and *Most secure* way to setup a *password* protected URL - which is resitant to password traders and hurlers, and (optionally) ideally includes password expirations capability, etc.

Should we use >>.htaccess<< or _not_even_bother - and use another scheme instead (maybe MySQL & PHP script)?

Is there a script, or service which is secure that we can implement?

Here is what our server is setup with:

1. Apache/1.3.20 (Unix) (Red-Hat Linux 6.22)
2. mod_watch/2.0
3. mod_throttle/3.1.2
4. mod_gzip/1.3.19.1a
5. mod_auth_pam/1.0a
6. mod_ssl/2.8.4
7. OpenSSL/0.9.6a
8. PHP/4.0.6
9. mod_perl/1.25 on Linux.

Thanks in advance!!

P.S. We prefer/need full logs of username/password accesses, with time and date, etc., and the ability to block or ban certain ip's and/or usernames/email addresses, whether temporarily or permanently. We
recently (yesterday) heard of 'phpsecurepages' - is this maybe a good option for us?

You might want to post this question in a few of the various webmaster newsgroups:

alt.html, alt.www.webmaster, etc.

--Tina

if you have cpanel, you can protect a directory and then create different user/pass combos to give out to ppl. I don't know about logs or anything though....

There are many scripts that can do this for you. Check hotscripts.com and do a search on
password protection. If you still need help let me know.

I would use .htaccess and .htpasswd to get going right-away. With .htaccess you cannot only restrict access to certain users, but you can also deny access based on IP addresses. You simply need to add a line like this:

Deny from 192.168.1.1

Then, like kickster said, go and visit:

http://www.hotscripts.com/
http://cgi.resourceindex.com/
http://php.resourceindex.com/

You might be able to find a nice script there.

Good luck. :)