I'd like to restrict access to a certain directory in my webroot to all users that belong to a specific group.

I know that I can create a .htpasswd file that specifies a user, or even several users, that should be accepted for HTTP Basic/Digest Authentication, but is it possible to have Apache accept any username/password from the local Linux machine's users?

To go a step further, is it possible (through .htpasswd or other means that anyone is aware of) to allow any valid user within a specific group?

  • It might be helpful to others if you provide some more details on what you're trying to accomplish.
    – dan
    Jul 17, 2013 at 23:15
  • 1
    @dan: I've revised my question. Jul 17, 2013 at 23:59

2 Answers 2


There were a few similar questions on serverfault.com that searching didn't uncover:

Basically, PAM and mod_auth_pam or mod_auth_external are potential ways to achieve this.

  • It warrants repeating that authentication over HTTP using server login and password information is a serious security risk. The question didn't indicate if this was intended for over the Internet or intranet, which is why I asked for more details. For others reading this, it's important to note the security risks for exposing your server, even if there are options...of which the first two appear to be no longer supported, and the later appears to use basic authentication over HTTP.
    – dan
    Jul 18, 2013 at 6:08
  • For more about the security risks of doing this, as acknowledged by the author of pwauth, referenced on the Google project page as working with mod-auth-external, see: Security Risks
    – dan
    Jul 18, 2013 at 6:09
  • 1
    Thanks Dan, that link to the security risks is extremely helpful. SSL and other items on the "Mitigating Risk" list would help, but I still may abandon this idea after reading that the mod(s) do not offer a method for slowing down password attempts (i.e. throw thousands of HTTP requests simultaneously to brute force). Jul 18, 2013 at 13:39
  • No problem. I usually try to provide an answer for whatever is asked, but in this case I felt it was more important not to disseminate potentially harmful information to others. It's a good question to learn from though, which is what this site is all about :-)
    – dan
    Jul 18, 2013 at 20:18

is it possible to have Apache accept any username/password from the local Linux machine's users?

For security reasons, this would be a very bad idea. Over the Internet, web traffic can be spied on by hackers, who would then have access to user login and password information for your server. Also, passwords on modern Linux systems are stored with encryption, which is meant to be only readable by the superuser. See this for more about that.

If you are by chance interested in providing secured access to Internet users, but unsecured access to users on your local network, then you could consider this. I would make sure however that this implemented over HTTPS using an SSL, instead of HTTP. And depending on how sensitive your data is, it might be wise to use separate servers for each set of users if possible.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.