Awstats password protection

[lbm]

When thinking of encryption it may be interesting to put the awstats web access in a single place (I did this on a server once) e.g. https://iscpcontrolpanellink/awstats.
Then one could use something like the following in awstats:

AllowAccessFromWebToFollowingAuthenticatedUsers="user1 user1s_reseller"

and authenticate in Apache "normally" like (this is without the use of sql as an example):

Alias /awstats /usr/local/awstats/wwwroot/
<Directory /usr/local/awstats/wwwroot>
AuthType Basic
AuthUserFile /where/ever
<Limit GET>
require valid-user
</Limit>
</Directory>

So (if one is using encryption for the isp-panel; which imho should be the case on productive servers) the awstats pass is encrypted, too. Otherwise the admin pass will be exposed for the statistics since the domains are not encrypted usually...

The awstats-link can then be done this way per domain:

RewriteEngine on
RewriteRule ^/stats/$ http://iscpcontrolpanellink/awstats/cgi-bin/awstats.pl?config=domain [R]
(assuming http://ispcontrolpanellink redirects to https://ispcontrolpanellink -> thats how I do in my ispcp)

such that restriction is handled in the awstats config (see above). Furthermore this enables e.g. resellers to be able to see some stats of their domains, too (which in Germany at least would not be allowed by law)...

Tell me what you think and tell me if you need more information about how I did the setup.

Cheers,
Thorsten