Member Avatar for brujo

Hello everyone, noob here. I've done a couple of websites that are just graphic heavy.Those are pretty easy (I'm more of a tech then designer.) But now the company I work for wants to create a website for our remote users that has our company software available 24/7. It's mainly proprietary(sp?) software so we need security and they want to create individual user accounts for roughly 1000 uses. This will probably hosted on one of our servers. What software will I need for the user accounts? What will be some of the possible problems? Any suggestions? Any help, comments, and suggestions are greatly appreciated.

The project is in it's planning stage so we have sufficient time to learn the software and install/test everthing.

  • 4 Contributors
  • 8 Replies
  • 236 Views
  • 1 Month Discussion Span
  • Latest Post Latest Post by floris

Dani AI

Generated

A focused, practical roadmap so the project actually ships securely.

For a 1,000-user download portal the immediate priorities are: strong authentication and safe password storage; delivering files only after server-side authorization checks (never by a public URL); reliable per-download logging and audit trails; and end-to-end transport security (TLS). ’s timeline gives you the luxury to prototype and test each piece rather than rushing them together.

Keep implementation simple and defensive. Use parameterized queries (no string-built SQL) and a least-privilege DB account for the app. Never store passwords in plain text or with fast hashes (MD5/SHA1). Example (PHP-style) for hashing and verifying:

$hash = password_hash($password, PASSWORD_BCRYPT);
// store $hash in users.password
if (password_verify($input, $hash)) { /* authenticated */ }

Serve files from outside the webroot and stream them through an authenticated handler that checks the session, authorization and then logs the download. Minimal schema for logging:

CREATE TABLE downloads (
  id INT AUTO_INCREMENT PRIMARY KEY,
  user_id INT NOT NULL,
  filename VARCHAR(255) NOT NULL,
  client_ip VARCHAR(45),
  ts TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

And in your download handler, stream the file (fread loop) instead of loading the whole file into memory, then insert a row into downloads. This avoids memory exhaustion and guarantees an audit record even if clients abort.

Operational notes and common pitfalls: harden the DB (remove anonymous users, restrict bind-address), enforce HTTPS (HSTS, Secure and HttpOnly cookies), set appropriate file permissions, patch the OS and app stack, and run staging load tests for concurrent downloads and bandwidth. Watch for mistakes that show up in logs: permission denied, path traversal attempts, and session fixation. If time is short or you want a packaged admin UI, evaluate commercial account systems (as mentioned) but verify their export, patch cadence, and ability to store files off-webroot.

Recommended Answers

All 8 Replies

Member Avatar for rixius

What functions do you need the users to perform?

Member Avatar for brujo

Just basic downloads of the software. We need it to create a log of the itmes they download and have them log in.

Member Avatar for brujo

OK, I think this is what I need. Be patient with me since I know very little about web security and my HTML knowledge is slightly at average.

1) Apache software/server
2) Some sort of Perl or scripted account manager.
3) A password protector.
4) A clue :confused:

Any suggestions?
Free round of drinks on me when I'm finished!

Member Avatar for samaru

Well, because you mentioned Apache/Perl, I'm assuming you want to go with open source software? Here's what you need in general, all open source and free:

Apache HTTP Server - Used for hosting HTML pages.
PHP/Perl - Binds with Apache in order to create web applications, like what you're trying to do with users (create/manager/etc.)
MySQL - Database to store user/web site information as well as to paths to the files you want users to download.

If you have MySQL and Apache set up, you can program the rest in Perl or PHP. I suggest you apply the correct rights on the files so not just anyone can download them. They'll need to create an account first in order to download them, or any way you prefer.

Member Avatar for rixius

I would recommend PHP over perl/cgi scripts, whenever you're set up, you can use a site like hotscripts.com or scriptdex.com to find the appropriate script you're looking for (they both have cgi and php scripts)

Member Avatar for samaru

PHP all the way. ^_^

Member Avatar for brujo

MySQL - Database to store user/web site information as well as to paths to the files you want users to download. . . .
. . . They'll need to create an account first in order to download them, or any way you prefer.

Yes, this is exactly what I need. I really don't know anything other than HTML but am willing to learn. Even if it takes me a couple of months. My company is sponsoring me so of course I will take advantage of the schooling.

So what I need is the Apache server, then MSQL. What about the security? Does MySQL have reliable securty?

Member Avatar for floris

You could purchase software like aMember and use their features, saves you time and ensures you of security (more then when you would make it yourself).

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.