Thanks for all the reply, I got the ideas....

Shinn

On Wed, 4 Feb 2004, Nathan Brindle wrote:

> In 5.4.5 of the site manager's manual,
> http://www.lsoft.com/manuals/1.8e/sitemgr/sitemgr.html#_Toc9062339 , it's
> very clearly stated:
>
> -- begin excerpt --
>
> 5.4.5. Creating a subdirectory for the archive interface
>
> Create a subdirectory on your web server to contain the various files
> LISTSERV will be creating for the web archive interface. The suggested name
> (and the name LISTSERV will expect by default) for the subdirectory you
> will create in this step is 'archives'. Under IIS, you would typically make
> the directory C:\INETPUB\WWWROOT\ARCHIVES for this purpose. For a unix
> server running Apache it might be /usr/local/etc/httpd/htdocs/archives .
> Please note the following IMPORTANT restrictions carefully:
>
> - Do not simply use your main HTML documents directory as LISTSERV will
> create quite a few files. It is much more orderly to keep the web archive
> interface's files and subdirectories in their own place in any case.
>
> - Do not use the directory you keep the list's notebook archives in for
> this purpose. Notebook archives should always be kept separate from the web
> interface, preferably in a completely separate directory hierarchy.
>
> - Corollary to the above: Do not set the Notebook= keyword for any list so
> that the list's notebook archives are kept in the subdirectory used by the
> web archive interface for the list.
>
> -- end excerpt --
>
> Nathan
>
> At 11:52 AM 2/4/2004 -0800, Shinn Wu wrote:
> >I don't really understand the 'protection' of wa offers in UNIX.  I
> >install wa in /usr/local/apache/cgi-bin and the archives is under
> >/usr/local/apache/htdocs/archives.  All the archives can be accessed by
> >subscribers ONLY.  BUT, you can easily bypass the email/password if you
> >know (or guess) the name of ANY archive, e.g,
> >
> >http://www.anysite.com/archives/test.log0301
> >
> >or even better
> >
> >http://www.anysite.com/archive/test.html
> >
> >to search the whole list.  It didn't offer any .htaccess.  I must miss
> >something important, but I could not find it either in manual or LSTSRV-L.
> >Would someone shed a light or confirm that?  Thanks.
> >
> >Shinn
>