Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

This is the first time that I have ever tried working with .htpasswd and .htaccess files, so please point out my childish works.

I have my apache document root set to /www/ on my debian server. Inside it, there's a folder named Logs/ which I want to restrict access using a htpasswd. I created my htpasswd file using the shell's htpasswd command. And this is the result:

user:<encoded password here>
hjp:<encoded password here>
hjpotter92:<encoded password here>

I put this file named .htaccess inside /www/. The Logs/ has following htaccess file in it:

AuthName "Restricted Area"
AuthType Basic
AuthUserFile /www/.htpasswd
AuthGroupFile /dev/null
require valid-user

This was again created using an online tool(I forgot its name/link, and can't search the browser-history now).

The problem, as it might've already struck you is that I am experiencing no change on my Logs folder access. The folder is still accessible to everyone. I am running apache as root user(if that matters/helps). Please help/guide me. I've tried reading some htaccess guides and have followed some of older SO questions, but still haven't figured out a way to restrict access to Logs folder with a password.

share|improve this question

migrated from stackoverflow.com Mar 31 '12 at 23:35

This question came from our site for professional and enthusiast programmers.

1  
FYI, it should be .htaccess, and you should: 1.) not run apache as root (terrible for security), and 2.) use digest authentication unless you're only accessing that URL via HTTPS. Because even if your .htpasswd file is SHA1 encrypted, the browser will be sending the password in plain-text if you use basic authentication. –  Lèse majesté Apr 1 '12 at 12:38
    
@Lèsemajesté I am fully aware about running apache as root, but since the network is quite private(not more than 300 users, all of whom I know) so, its fine. I am using MD5 instead of SHA1 in .htpasswd . –  hjpotter92 Apr 1 '12 at 13:44
    
Whats the point in storing the passwords in MD5 SHA1 at all if your Apache is running on root. Surely your not worried about security then and hashing the passwords is pointless. –  bybe Feb 12 '13 at 21:04

2 Answers 2

up vote 1 down vote accepted

Solved the problem with the help of a person i know. :)

Added this segment to httpd.conf:

<Directory /www/ChatLogs>
  Allow from all
  AuthName "Restricted Area"
  AuthType Basic
  AuthUserFile /www/.htpasswd
  AuthGroupFile /dev/null
  Require valid-user
</Directory>

Because there's a line in httpd.conf as follows:

AllowOverride None
share|improve this answer

It looks like you got your problem solved by putting the contents of your .htaccess file into httpd.conf.

Another solution would have been to change the line in your httpd.conf from

AllowOverride None

to

AllowOverride All
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.