# Validators

### Introduction

Validators are a type of Cherokee modules. It provides a mechanism to restict the access of some resources: directories and extensions.

The scope of a validator is local to a directory or extension definition, inside of an Auth clause.

Cherokee distributes a number of validators: htpasswd, htdigest, pam, and plain text. Some of these validators are only suitable for some authentication methods:

| HTTP Basic | HTTP Digest
Plain | yes | yes
htpasswd | yes | no
htdigest | yes | yes
PAM | yes | no

- The Basic authentication sends the login and password pair clear over the network, so it is not the safer method to use. It is very easy to implement, so most of the programs supports it.
- The Digest authentication is much more safer, but it is also more complex. If the clients of the server are going to be modern browsers they will not have any problem to use this authentication method: More information

### PAM validator

The PAM validator uses PAM (Pluggable Authentication Modules) to validate the user and passwords pairs in a protected directory.

This validator only works if the server runs as root.

#### Examples

    Directory /protected {
       Auth Basic {
          Method pam
       }
    }

Requires a valid user and password system pair to access the protected directory.

    Extension iso {
       Auth Basic {
          Method pam
       }
       User alo, mark
    }

System users alo and mark are the only ones allowed to download ISO images.

### Plain Validator

The plain validator tries to match user and password pair in a text plain file.

The format of the text file is the username followed by colon sign, and then the password. For example:

    alo:8!45mKaZ*9
    mark:god

It needs one parameter to work:

- PasswdFile: This parameter specifies the path to the login/password pairs file.

#### Examples

    Directory /secret {
        Auth Basic, Digest {
            Method pain {
               PasswdFile /var/passwordsweb
            }
        }
    }

The directory secret requieres a valid login/password pair from the /var/passwordsweb. You can place the password file outside the web tree, in this way, remote users won't be able to fetch the list.

### Htpasswd Validator

It uses htpasswd files. These password files are very common on Apache web severs. It stores one line per entry with the user name and a hash of the password. Cherokee works with the following hash algorithms: MD5, MD5-crypt, Apache MD5, SHA1 and crypt.

It needs one parameter to work:

- PasswdFile: This parameter specifies the path to the login/password pairs file.

#### Examples

    Directory /secret {
        Auth Basic {
            Method htpasswd {
               PasswdFile /var/passwordsweb
            }
        }
    }

### Htdigest Validator

It uses htdigest files as input.

It needs one parameter to work:

- PasswdFile: This parameter specifies the path to the login/password pairs file.

#### Examples

    Directory /secret {
        Auth Basic, Digest {
            Method htdigest {
               PasswdFile /var/passwordsweb
            }
        }
    }