2

This is the first time that I have ever tried working with .htpasswd and .htaccess files, so please point out my childish works.

I have my apache document root set to /www/ on my debian server. Inside it, there's a folder named Logs/ which I want to restrict access using a htpasswd. I created my htpasswd file using the shell's htpasswd command. And this is the result:

user:<encoded password here>
hjp:<encoded password here>
hjpotter92:<encoded password here>

I put this file named .htaccess inside /www/. The Logs/ has following htaccess file in it:

AuthName "Restricted Area"
AuthType Basic
AuthUserFile /www/.htpasswd
AuthGroupFile /dev/null
require valid-user

This was again created using an online tool(I forgot its name/link, and can't search the browser-history now).

The problem, as it might've already struck you is that I am experiencing no change on my Logs folder access. The folder is still accessible to everyone. I am running apache as root user(if that matters/helps). Please help/guide me. I've tried reading some htaccess guides and have followed some of older SO questions, but still haven't figured out a way to restrict access to Logs folder with a password.

Improve this question
3
  • 1
    FYI, it should be .htaccess, and you should: 1.) not run apache as root (terrible for security), and 2.) use digest authentication unless you're only accessing that URL via HTTPS. Because even if your .htpasswd file is SHA1 encrypted, the browser will be sending the password in plain-text if you use basic authentication.
    – Lèse majesté
    Commented Apr 1, 2012 at 12:38
  • @Lèsemajesté I am fully aware about running apache as root, but since the network is quite private(not more than 300 users, all of whom I know) so, its fine. I am using MD5 instead of SHA1 in .htpasswd .
    – hjpotter92
    Commented Apr 1, 2012 at 13:44
  • Whats the point in storing the passwords in MD5 SHA1 at all if your Apache is running on root. Surely your not worried about security then and hashing the passwords is pointless.
    – Simon Hayter
    Commented Feb 12, 2013 at 21:04

2 Answers 2

Reset to default
2

Solved the problem with the help of a person i know. :)

Added this segment to httpd.conf:

<Directory /www/ChatLogs>
  Allow from all
  AuthName "Restricted Area"
  AuthType Basic
  AuthUserFile /www/.htpasswd
  AuthGroupFile /dev/null
  Require valid-user
</Directory>

Because there's a line in httpd.conf as follows:

AllowOverride None
Improve this answer
1

It looks like you got your problem solved by putting the contents of your .htaccess file into httpd.conf.

Another solution would have been to change the line in your httpd.conf from

AllowOverride None

to

AllowOverride All
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.