May 25, 2006...8:55 am
Password protecting MediaWiki with mod_auth_mysql
MediaWiki is the powerful software on which Wikipedia and many other sites are built. It does not, however, come with the option to password protect pages from being viewed. (It can password protect pages from being edited.)
If you need to setup a private, members-only wiki for internal use, here is how you can do it with MediaWiki software and the Apache server extension mod_auth_mysql:
1. Install MediaWiki as usual. Create a user account for yourself.
2. Add the following line to your LocalSettings.php file, located in the root of your MediaWiki installation. This will cause MediaWiki to use a simple MD5 hash for user passwords in the database, instead of the more complicated “salted hash hash” that it normally uses.
$wgPasswordSalt = false;
3. Activate mod_auth_mysql in Apache. This is usually done with a LoadModule line in your Apache configuration file (httpd.conf), provided the module is available. (If not, you may need to compile or download the module.)
LoadModule mysql_auth_module libexec/apache2/mod_auth_mysql.so
4. Create a new MySQL user that has SELECT access to the “user_name” and “user_password” fields in the “user” table of your MediaWiki installation. Apache will use this MySQL user for connecting to the MediaWiki database.
5. Configure mod_auth_mysql to use the MediaWiki user table for authentication by placing the follow directives in your Apache configuration file:
AuthName “This wiki is password protected (make sure the first letter of the username is Uppercase)”
AuthType Basic
require valid-user
AuthMySQLEnable On
AuthMySQLHost localhost
AuthMySQLUser unprivilegeduser
AuthMySQLPassword thesecretpassword
AuthMySQLDB mediawikidatabase
AuthMySQLUserTable user
AuthMySQLNameField user_name
AuthMySQLPasswordField user_password
AuthMySQLPwEncryption md5
AuthMySQLAuthoritative On
6. Restart Apache.
Your installation of MediaWiki should now be password-protected, but your username and password will let you in. This protects the entire wiki; no one will even know that MediaWiki is present until they login. To give other people access, you can either create user accounts for them, or you can create a guest account that they can use until they sign themselves up.
P.S. Thanks to Gary Thornock for helping me with the details of installing mod_auth_mysql on FreeBSD.
If you want to be notified the next time I write something, sign up for email alerts or subscribe to the RSS feed. Thanks for reading.
25 Comments
May 25, 2006 at 10:49 am
June 1, 2006 at 12:21 am
June 21, 2006 at 12:49 am
AuthName "This wiki is password protected (make sure the first letter of the username is Uppercase)"AuthType Basic
require valid-user
##AuthMySQLEnable On # this directive didn't exist
AuthMySQLHost localhost
AuthMySQLUser imotion_wiki
AuthMySQLPassword 400z13
AuthMySQLDB imotion_wiki
AuthMySQLUserTable user
AuthMySQLNameField user_name
AuthMySQLPasswordField user_password
##AuthMySQLPwEncryption md5
AuthMySQLMD5Passwords On # had to add this instead of the above
AuthMySQLAuthoritative On
June 21, 2006 at 1:00 am
June 21, 2006 at 1:11 am
October 7, 2006 at 10:50 am
Any ideas on how to password protect only SOME wikimedia pages and not the ENTIRE thing?
Alternatively can you run multiple wikimedia instances on one system and password protect only one of them?
October 7, 2006 at 5:20 pm
December 29, 2006 at 8:43 am
December 29, 2006 at 11:27 am
February 2, 2007 at 10:47 pm
thanks a lot in advance.
February 5, 2007 at 9:26 am
You’ll need to uncompress the .tar.gz file with tar -xzf. If it produces an .so file then you can place it with the others .so files and then include it in your Apache configuration file. If it produces source, then you’ll need to compile it with “sudo make install”.
March 14, 2007 at 9:12 pm
Very cool. First thing I looked for when trying to password protect a wiki at home. Very well done. And to think you are another Utah County-ite, mac lover and fellow member.
-Robert
March 14, 2007 at 11:39 pm
Thanks for stopping by! I’m glad you found the post. Gary Thornock was the other Utahn that helped craft this solution.
March 21, 2007 at 9:00 am
Since mod_auth_mysql is being used with apache in basic authentication mode, as with any other basic apache auth scheme, it will request your username/password every time you goto the page. Most modern browsers cache username/password for that reason.
So keep in mind that if you use this method (as opposed to php sessions or so), if the page is not closed (and/or cache is not purged, depending on browser) - the browser will let anybody else access that page as long as the username/password are in the cache.
So if you are using your wiki from a public access computer, keep that in mind.
I’m currently building a mission critical system and had to work around this problem.
April 6, 2007 at 8:24 am
AuthName “This wiki is password protected (make sure the first letter \
of the username is Uppercase)”
AuthGroupFile /dev/null
AuthUserFile /dev/null
AuthMySQLEnable On
AuthMySQLHost localhost
AuthMySQLUser wikiuser
AuthMySQLPassword wikipassword
AuthMySQLDB wunderwikidb
AuthMySQLUserTable user
#AuthMySQLUserCondition “users.status = 1″
AuthMySQLNameField user_name
AuthMySQLPasswordField user_password
AuthMySQLNoPasswd Off
AuthMySQLPwEncryption md5
AuthMySQLAuthoritative On
require valid-user
Now its working
hope someone can use this info
April 6, 2007 at 8:28 am
[Fri Apr 06 12:33:18 2007] [error] [client 192.168.1.52]
(9)Bad file descriptor: Could not open password file: (null)
(sorry, this should be in my previous post, if there was an edit option)
May 18, 2007 at 8:58 am
May 24, 2007 at 2:50 am
$wgGroupPermissions['*']['edit'] = false;
$wgGroupPermissions['*']['read'] = false;
Now, anonymous users cannot read any pages, except for the ones you explicitly whitelist, like this:
$wgWhitelistRead = array( “Special:Userlogin”, “-”, “MediaWiki:Monobook.css”, “Main_Page” );
That line is probably already in your LocalSettings.php, just add pages you want anonymous users to see.
If you don’t even want them to see your wiki front page, remove “Main_Page” from this list.
Visitors will now be asked to log in immediately, even before they get to see your front page.
Unfortunately, by default Mediawiki lets users create their own accounts and this would mean that anonymous visitors can just create an account and have all the privileges you didn’t want them to have.
Protect your wiki against account creation by adding this line to LocalSettings.php:
$wgGroupPermissions['*']['createaccount'] = false;
Be aware that now legitimate new users cannot create their own accounts either, (but that problem also existed with the mod_auth_mysql approach).
There is a way for wiki admin users to create new accounts though:
* Go to the Special:Userlogin page (after loging in as an admin)
* Click “Create an account”
* Fill in the form, uncheck the box “Remember my login on this computer”
* Click “by e-mail”
The new user gets an e-mail with a generated password (I found out the password I typed in the form was discarded)
After logging in for the first time, the new user is asked to choose a new password.
Hope this is useful for people who don’t have access to the Apache configuration on their site, and also for people who are annoyed by having to log in twice.
February 19, 2008 at 1:40 pm
Which says that it’s an issue of basic auth, and suggests adding the line “AuthBasicAuthoritative Off” so I added that to Richard’s example and that made things go. I hope that is of benefit to others.
It may benefit others to mention the version used. FreeBSD 6.3, Mediawiki 1.11.1, apache-2.2.8, mod_auth_mysql_another-3.0.0_2 (from the ports collection).
This configuration documentation for mod_auth_mysql might also help people : http://modauthmysql.sourceforge.net/CONFIGURE
February 19, 2008 at 2:32 pm
February 20, 2008 at 11:57 pm
February 21, 2008 at 8:07 am
March 4, 2008 at 4:59 pm
March 11, 2008 at 5:10 pm
You’ll need to uncompress the .tar.gz file with tar -xzf. If it produces an .so file then you can place it with the others .so files and then include it in your Apache configuration file. If it produces source, then you’ll need to compile it with “sudo make install”.
I’m a giant among midgets at my job, where I’ve been setting up an intranet (WinXP, Apache 2+PHP, MediaWiki, MySql, FreeBSD).
Unfortunately, I’ve been having trouble extending Apache by installing modules like mod_auth_mysql, mod_dav, etc. I don’t know how to uncompress a tar.gz with -xsf under windows. Is there an application that does this? I don’t know how to get/make .so plug in files.
March 28, 2008 at 5:47 am
Leave a Reply