I have the following in my .htaccess file:
AuthType Basic
AuthName "Secured"
AuthUserFile ../private/passwd
Require valid-user
Order allow,deny
Allow from env=unauthenticated
Satisfy any
The problem from the error.log is that Apache is saying "Could not open password file: /etc/apache2/passwd" - which is obviously my Apache root.
How would I specify a relative reference to the .htaccess file for a path instead?
And probably very important, can this be done in the .htaccess file only?
If so, answering question #2 would make the solution much more portable.
Doc: AuthUserFile
The AuthUserFile directive sets the name of a textual file containing the list of users and passwords for user authentication. File-path is the path to the user file. If it is not absolute, it is treated as relative to the ServerRoot.
So I assume that your server root is in /etc/apache2/ so your relative URL: ./passwd will be relative to the root, and not where your htaccess file is at. Thus, it's not possible to make it portable and relative to where you place the htaccess.
Additionally, the documentation also says:
Security
Make sure that the AuthUserFile is stored outside the document tree of the web-server. Do not put it in the directory that it protects. Otherwise, clients may be able to download the AuthUserFile.
So it's a bad idea to keep your password file in the same place that you serve your content.
I would like to use a .htaccess file to protect my symfony2 website while developing it.
I added the following line at the beginning of my .htaccess located in /web and a .htpasswd file just next with my password.
AuthName "Développement"
AuthType Basic
AuthUserFile ".htpasswd"
Require valid-user
I have a Error 500 when I try to access my website. Is it possible to use a htaccess in my case ? What should I use if it is not posible ?
Assuming the 500 error is caused by these directives, the most likely reason is the path to .htpasswd. AuthUserFile says
The AuthUserFile directive sets the name of a textual file containing the list of users and passwords for user authentication. File-path is the path to the user file. If it is not absolute, it is treated as relative to the ServerRoot.
So either use an absolute path (e.g. /var/www/.htpasswd) or add the complete path starting from your document root (e.g. web/.htpasswd).
Also note the last section in AuthUserFile
Security
Make sure that the AuthUserFile is stored outside the document tree of the web-server. Do not put it in the directory that it protects. Otherwise, clients may be able to download the AuthUserFile.
This means, store the auth file somewhere else, like /etc/apache2/htpasswd.
In my CakePHP app, I have a directory of files which I want to allow direct access to with a username/password. For reasons that are overly complicated, placing the directory inside the /webroot folder is not an option. My folder is located here:
/app/parent_folder/folder_full_of_files
So I want to be able to access files directly like this:
http://mysite.com/app/parent_folder/folder_full_of_files/some_file.pdf
I think I need to modify the .htaccess file in the root, and also add another .htaccess file and .htpasswd file in the folder_full_of_files
I have already found this post which asks a similar question... but I can't translate it to my application.
How do I need to modify the root .htaccess file?
What should be in the new .htaccess file. Here's what I've tried, but just results in 500 error...
AuthType Basic
AuthName "restricted area"
AuthUserFile /bla/bla/mysite/app/parent_folder/folder_full_of_files/.htpasswd
require valid-user
What is the correct way to encrypt the password in the .htaccess file?
I got this to work. I had to do a couple things...
I added this to the .htaccess file in root:
RewriteCond %{REQUEST_URI} !^/app/parent_folder/folder_full_of_files
As #Jon pointed out, my original version above had a mistake ([L]).
I also have an .htaccess file in my /app directory. This might be a quirk about my installation because it is not 100% standard. I can't remember if it's there by default, so I'm mentioning it just in case. IF you don't have one in /app skip this step.
I added this to an .htaccess file in the /folder_full_of_files:
AuthType Basic
AuthName "restricted area"
AuthUserFile /bla/bla/mysite/.htpasswd
require valid-user
Make sure the path after AuthUserFile is a fully-qualified path to the .htpasswd file (see next step).
Create the actual .htpasswd file. It's not supposed to be under the document root, but mine is. I think the most important thing is that it's not inside /webroot. I used this command from the terminal and it created the file:
htpasswd -c /path/where/it/should/go/.htpasswd whatever_username
It asks for a plain text password which gets encrypted and written into the file.
That's it. One annoying "gotcha" is that the path in the .htaccess to the auth file must be absolute, which means it will probably have to be edited when moving between local testing and production (unless the two environments are exactly the same). It would be less clunky if relative paths were allowed.
You don't need to modify the htaccess file in your document root at all
Make sure you have AllowOverride AuthConfig or AllowOverride All configured for your /app/parent_folder/folder_full_of_files/ directory. Make sure that the directory also has a properly generated htpasswd file (named .htpasswd). You need to use the htpasswd program to generate it, or any number of online generators.
I am trying to password protect a directory, and have two files in the directory which should password protected it:
.htaccess
.htpasswd
HTACCESS:
###Contents of .htaccess:
AuthUserFile /var/www/html/path/to/my/directory/.htpasswd
AuthName "Protected Files"
AuthType Basic
Require user admin
HTPASSWD:
###Contents of .htpasswd
admin:oxRHPuqwKiANY
The password is also admin, but no matter what password I try, it is always wrong. It immediately asks for the password again!
What is wrong with this configuration?
This problem is almost always because apache cannot read the .htpasswd file. There are four causes that come to mind:
it isn't parsing the path correctly... how did you create the .htaccess file? Does it have unix line endings (versus say using Notepad in Windows?
is the path correct? What does the following command (with the path update) show?
ls -l /var/www/html/path/to/my/directory/.htpasswd
does the web server have access to the file? chmod 644 and see if that solves the problem.
it can't parse the .htpasswd file: in this case, you are using the crypt() encryption so it does seem you created the file on Linux and it is probably fine. Some types of encryption only work on certain platforms, if in doubt try switching to MD5.
You may find helpful messages in the Apache error log.
My money is on #3.
I had a similar issue using MAMP and it was because i was creating .htpasswd by hand. Solution was to use htpasswd command in terminal:
htpasswd -bc .htpasswd someuser somepass
this created the .htpasswd file which worked fine with my .htaccess file which looked like so:
AuthType Basic
AuthName "This site is in alpha and requires a password."
AuthUserFile "/Applications/MAMP/htdocs/mywebsite/.htpasswd"
require valid-user
There's a small chance you're seeing password protection from a parent folder, not the folder you expect.
If your /etc/apache2/sites-enabled folder has only one file in it, check to see if it has a section for your sites folder, something like:
<Directory /var/www/mysite.com>
AllowOverride All
</Directory>
otherwise, if it has a file for your site name, like:
/etc/apache/sites-enabled/YOUR_SITE_NAME_HERE.conf
edit that file instead, and make sure that there's an
AllowOverride All
in there. That's the important part! If you want to only allow the minimum, specify:
AllowOverride AuthConfig
instead.
I had the same problem. Turned out the issue was this line:
Require user admin
If you specify admin you can only access the directory with admin even if you have other users in the .htpasswd file.
If you want to specify the users in the .htpasswd file, you can change the line to:
Require valid-user
My problem was that I did not give an absolute path for the AuthFile line.
I had the same issue.
The password should have specified encryption:
CRYPT_STD_DES - Standard DES-based hash with a two character salt from the alphabet "./0-9A-Za-z".
function standard_salt(){
$a = array_merge(range(0,9),range('a','z'),range('A','Z'));
return (string) $a[rand(0,count($a)-1)].$a[rand(0,count($a)-1)];
}
echo(crypt("admin",standard_salt()));
example:
admin:dsbU.we73eauE
Online javascript encripter is also available.
If it still does not work, take care of these:
use unix linebreaks
use correct AuthUserFile path, You can get it using: echo $_SERVER['DOCUMENT_ROOT'];
set file readable: chmod(".htpasswd",0644);
Also, make sure your password file is ANSI-encoded.
I spent about 2 hours to resolve the same issue. But problem was in nginx.
I have nginx as front web server and there was a line for proxy configuration:
proxy_set_header Authorization "";
It overrides Authorization field and apache don't receive login and password typed in.
I just commented out this line and it worked.
use
htpasswd -b .htpasswd admin admin
to use the password from command line.
Also, if you are scatterbrained like me, make sure you have some content to display, like some index.html file in the directory. Otherwise, it will look like authentication failed, while it's just that the server is not allowed to display the directory listing.
Every time I try to go to Art School on Home Page and put it the correct username/password I get a server error. Yes this is homework, and yes it is my first time doing anything related to this type of setup so any help would be appreciated. All the various instructions that I found listed this as the correct way so I'm sort of stuck.
.htpasswd file(/afs/asu.edu/users/r/l/p/rlpeck/pwd/.htpasswd):
Alice:$apr1$sgDEa/..$FBtlSGHkbPHmlW80Sj2Sx1
Bob:$apr1$V8LLa/..$iX.YVKHoDfKyTKEMvuX.g/
Chris:$apr1$XuHOa/..$o6bf/JyA1otkH0jor4n5c/
Dave:$apr1$hpjQa/..$u3/D.f0xdN23Flg35qp9g.
Eve:$apr1$JIGSa/..$uTs55qYH1.gtDV7WZ0X7q0
.htaccess file(/afs/asu.edu/users/r/l/p/rlpeck/www/CSE465a):
AuthType Basic
AuthName "Restricted Area"
AuthUserFile /afs/asu.edu/users/r/l/p/rlpeck/pwd/.htpasswd
AuthGroupFile /dev/null
Require valid-user
When I do run locate -r error.log all I get are these:
/opt/tivoli/tsm/client/ba/bin/dsmerror.log
/usr/share/doc/cups-1.2.4/de/images/button-view-error-log.gif
/usr/share/doc/cups-1.2.4/es/images/button-view-error-log.gif
/usr/share/doc/cups-1.2.4/help/ref-error_log.html
/usr/share/doc/cups-1.2.4/images/button-view-error-log.gif
/usr/share/doc/cups-1.2.4/ja/images/button-view-error-log.gif
/usr/share/doc/cups-1.2.4/pl/images/button-view-error-log.gif
/usr/share/doc/cups-1.2.4/sv/images/button-view-error-log.gif
/var/log/cups/error_log
/var/log/cups/error_log.1
/var/log/cups/error_log.2
Edit: Response from help desk:
If you were testing the security of your page, you passed. I dont see an error
Is the .htaccess file being saved on the server using UNIX line endings? If you are saving it on a Windows computer, that is likely a problem. If you use FTP, you can transfer in ASCII mode. Otherwise, get a good text editor like Notepad++ (http://notepad-plus-plus.org/) and set UNIX format under Edit → EOL Conversion → UNIX Format.
Is the AuthUserFile pathname correct? It should be the pathname that the web server computer sees, which might not be the pathname you see. You were probably logged in to a different server than the web server when you ran the locate command; the AFS network filesystem allows both servers to see your files but not necessarily at the same path on both.
Does the web server have permission to read the .htpasswd file? Try putting it in the same directory as the .htaccess file and update the pathname in .htaccess accordingly. Of course, it depends on the server configuration whether or not the server will prevent someone from looking at the list of valid passwords that way, so you may need to figure out what AFS commands you need to use to grant such permission.