User authentification with .htaccess files

The Authentification will be done over a file called passwords. Because i like everyhting in order, i will create this file in subdirectory (maybe there will be other password files for upcoming issues) and own it to my webserver user (httpd).

debianhustler:~# mkdir /usr/local/apache2/passwd
debianhustler:~# touch /usr/local/apache2/passwd/passwords
debianhustler:~# chown -R httpd:httpd /usr/local/apache2/passwd
debianhustler:~# chmod 640 /usr/local/apache2/passwd/passwords

Now we need to add the desired users (here: sebastian and robert) which should be able to access the content. This will be done by the htpasswd tool which ships with apache. In my case the path to the apache binaries where not in the $PATH variable and i had to add it). If you add a user to the passwords file for the first time, you need to get it the -c flag, otherwise its obsolete. Be careful, if you add users with the -c flag everytime, they'll be overwritten.

debianhustler:~# htpasswd -c /usr/local/apache2/passwd/passwords sebastian
New password: custompassword
Re-type new password: custompassword
Adding password for user sebastian

debianhustler:~# htpasswd /usr/local/apache2/passwd/passwords robert
New password: robertspassword
Re-type new password: robertspassword
Adding password for user robert

Now we will edit our .htaccess file which sets the Options how the content can be accessed and who will able to.

debianhustler:~# vim /usr/local/apache2/htdocs/webpage/.htaccess
AuthName "This is private content"
AuthType Basic
AuthUserFile /usr/local/apache2/passwd/passwords
Require user sebastian robert

debianhustler:~# chown httpd:httpd /usr/local/apache2/htdocs/webpage/.htaccess

debianhustler:~# chmod 700 /usr/local/apache2/htdocs/webpage/.htaccess

It would be possible to add your Auth Options in the main apache config (between <Directory>.htaccess directives) but then you would need to restart the webserver after every change. the file is parsed on every http access.

The AuthName Options sets what header the login prompt will have. The AuthType sets the Authentification Type, we will use Basic. With AuthFile you set the full path (don't use relative paths, that's ugly and buggy ) to your passwords file and with Require user you can set those who should be able to access the content (they'll only be accepted if they are in the passwords file, it's a stronger rule).

I prefer to use the Require user username1 username2 Option, because of its better control. If you got a whole bunch of users, this will get confusing. Therefor It's possible to set Require valid-user (then it is enough when the username is in the passwords file).

After i did anything above, i recieved a 500, Internal Server Error, because my passwords file was not readable by my apache user httpd, a simple chown httpd:httpd on the file resolved the error.

This is a simple way to protect some content. To reed more about Authentification with Apache, read this Howto on the official apache website.

Regards,

Sebastian