4

I'm designing a sensitive site and I want that login/passwd is not sent as plain text. I don't want to provide https connection or maintain a SSL certificate as it can easily be compromised on shared hosting.

For non-admin users login using openid will solve this issue but how do I do it for Admin(uid=1) ?

For admin login one way is to use a secured VPN of another country to login and once session cookie is placed I can close VPN and use my normal internet connection.

Any ideas?

Although this question isn't version specific but I need it for D6 site.

2
  • Not sure why admin cannot use OpenID? If you trust it for some logins, why not for others?
    – Bittrance
    Mar 5, 2012 at 21:58
  • Oh admin too can it! I did not know. Let me see how to do it.
    – AgA
    Mar 9, 2012 at 7:40

1 Answer 1

2

If you're already using OpenID, then that should work, but if you dont want to add yet another module and you have access to a server over ssh, you can temporarily route all traffic in a tunnel through the server, which will effectively secure all internet traffic, and allow you to connect to the site and send the password "in the clear" as it were over HTTP, but the SSH tunnel would encrypt it before it left your machine.

If you happen to be on a mac, i highly recommend using Sidestep.app to facilitate quickly connecting/disconnecting from the tunnel.

http://chetansurpur.com/projects/sidestep/

For this to really work for you and not be a complete annoyance, I repeat, you need to have SSH access to a server already set up, ideally, with public key access configured.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.