well i secured ftp already, that was the first thing i did, but i want to give the guys web access so they can stream or download, just don't want to have people clickin play and changin the songs while i am listening to them.

Not meaning to sound like a broken record here, but consult the Hijack FAQ -- it has features to do exactly what you want: allow streaming/downloads while preventing direct commands to the player itself.

-ml