Website Security

How do I password protect a directory?

You can do this through our control panel. You first need to go to the User/Group Admin section to create users, then put those users into groups. Then you go to the Web Permissions section and assign that group of users to a particular directory.

How do I use the secure web server with my forms?

When posting your forms, you must use https:// to begin with, then point to the CIA web server with your login: www.cia.com.au/login So the line you would use in your form would be
<form method=POST action="https://www.cia.com.au/login/script.cgi"> on the Linux servers or
<form method=POST action="https://nt.cia.com.au/username/index.html"> on our Windows NT servers:

You can also use the cia formmail.cgi script if you do not have your own. You would then use
<form method=POST action="https://www.cia.com.au/cgi-bin/formmail.cgi"> on the Linux servers or
<form method=POST action="https://nt.cia.com.au/cgi-bin/formmail.cgi"> on the Windows servers

Can you show me an example?

Below is a form that you can fill out to see what happens when people submit a form calling the SSL Secure server. This form is no different to any other form, except that the form method calls a https:// rather than a http:// address.

Feedback Form

Your Name:
Your Email Address:

Can I use the secure server with ordinary html files?

Yes you can, however it is not recommended because it is slower than the regular server for delivering files. It is really only necessary (and recommended) for use with forms, where people may be transmitting sensitive information across the web.

Are there any other things I need to consider?

• When using the secure server, you must point to https://www.cia.com.au/yourlogin/file (orhttps://nt.cia.com.au/yourlogin/file if you are using the WIndows NT server) rather than https://www.yourcompany.com.au/. The latter will not work unless you buy an SSL digital certificate (see below)
• If you use the optional redirect hidden field, it must also point to an https:// address, or the person submitting the form will get a message that they are going to a non-secure page.
• Once your page is showing as secure (such as the result of a redirect), any links pointing back to your main area should be in the form of http://www.yourcompany.com.au (ie, absolute urls, not relative ones).

Can I use https://www.mycompanyname.com.au instead of https://www.cia.com.au/mylogin ?

Yes you can. However, you will need to purchase a certificate (from either Thawte or Verisign) which we can use to setup your domain. You can apply online for a certificate to be setup for you, will contact you with full details and requirements.

Member Logins:
Control Panel
Webmail
Resellers