I'm designing a sensitive site and I want that login/passwd is not sent as plain text. I don't want to provide https connection or maintain a SSL certificate as it can easily be compromised on shared hosting.

For non-admin users login using openid will solve this issue but how do I do it for Admin(uid=1) ?

For admin login one way is to use a secured VPN of another country to login and once session cookie is placed I can close VPN and use my normal internet connection.

Any ideas?

Although this question isn't version specific but I need it for D6 site.

  • Not sure why admin cannot use OpenID? If you trust it for some logins, why not for others?
    – Bittrance
    Mar 5, 2012 at 21:58
  • Oh admin too can it! I did not know. Let me see how to do it.
    – AgA
    Mar 9, 2012 at 7:40

2 Answers 2


If you're already using OpenID, then that should work, but if you dont want to add yet another module and you have access to a server over ssh, you can temporarily route all traffic in a tunnel through the server, which will effectively secure all internet traffic, and allow you to connect to the site and send the password "in the clear" as it were over HTTP, but the SSH tunnel would encrypt it before it left your machine.

If you happen to be on a mac, i highly recommend using Sidestep.app to facilitate quickly connecting/disconnecting from the tunnel.


For this to really work for you and not be a complete annoyance, I repeat, you need to have SSH access to a server already set up, ideally, with public key access configured.

  • I think the idea of VPN is bit complicated, as at times i have faced few issues like slow connections and server down problems. While having a go at my latest project i found Secure Login this module.
  • I can assure you the security as this never passes the passwd in a plain text format. The MD5 encryption can add a great integrity to your site. Even if this does work for you, you can make use of http://www.cisco.com/en/US/products/sw/secursw/ps2308/index.html.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.