# LOCATION OF PASSWORD FILE
$PASSFILE="/usr/home/web_directory/protected_dir/.htpasswd";

open(WRT,">$PASSFILE");

foreach $id (keys %user_hash){
$pass2 = crypt($user_hash{$id}, "AB");
print WRT "$id:$pass2\n";
}

close(WRT);
[download]

You can change 'AB' in the crypt statement to any two letter combination!

oakbox
"If what I'm saying doesn't make sense, that's because sense cannot be made, it's something that must be sensed"-J.S. Hall

As mentioned above, you won't want to manipulate the $ENV{'REMOTE_USER'} directly, but you may want to read from it. I've used it in the past to give certain users certain "permissions" within my CGI. Kinda like this:

if {$ENV{'REMOTE_USER'} eq "Cool Dude") {
   print p("You are a total stud!");
} else {
   print p("You are a luser.");
}
[download]

Gary Blackburn
Trained Killer

AuthName "Security Solutions Center HelpDesk"
AuthType Basic
AuthUserFile /dkdkdkdke/.htpasswd
AuthGroupFile /ej34l4l4tkgk/.htgroup
<Limit GET POST>
require group Xdwp
</LIMIT>
[download]

1. It sounds as if your Apache webserver may not have its basic authentication turned on. The book Apache Webserver for Dummies has a good chapter on how to configure your access.conf and other files to require basic authentication, which is what would cause the password window to popup. You want to make sure that Authtype is set to basic and that other parameters are also correct.
2. Since basic authentication is not turned on there is no one logging in, so REMOTE_USER is empty.
3. To do anything nonstandard use the CPAN modules htpasswd and htgroup. We use them to allow administrators to generate new users online.
4. I cannot think of a time when you would need to manipulate REMOTE_USER directly. Basic authentication checks it for you.
5. If you do need to access REMOTE_USER then access it using CGI.pm's param function, e.g., $q->param('REMOTE_USER').

don't use <Limit GET POST>!! It's a leftover from NCSA days. It will actually limit authentication to only those methods, GET and POST. A malicious user can craft a request using another method, e.g. PUT, and that request will bypass your authentication. Folks, don't use LIMIT containers unless you know what you're doing.

As echo says, you shouldn't use the Limit directives in this case - it really means "only limit the http request methods...".

Just to clarify, all you have to do is turn this:

<Limit GET POST>
require group Xdwp
</LIMIT>
[download]

into this:

require valid-user

The first example means that to log in successfully, the username submitted has to match the password of that user (obviously), and also be in the group "Xdwp". In the second example, all that has to happen is that the username has to be in the password file.

This has absolutely nothing to do with perl though, so I'd suggest having a look at <a href=http://httpd.apache.org/docs/mod/core.html#requirethe docs on httpd.apache.org.