How to Configure Your Website Using Htaccess in Linux with Apache
Step 01: For this to work successfully you will have to be logged in as root or using one of the sudo or su options.Step 02: We will need to create the folder that will have to be authenticated. Since the default location in apache is /var/www/html we will create it here. You will do this by using the mkdir command.[root@linux ~]# mkdir /var/www/html/testfolder
Restrict web page under
/var/www/html/testfolder using basic authentication:
Step 03: Next we need to add the .htaccess & .htpasswd files to the personal folder. We first need to change the directory of the folder we wish to protect.[root@linux ~]# cd /var/www/html/testfolder
Step 04: Next we can create the .htaccess file.[root@linux ~]# vi .htaccess
Step 05: Press i to insert and add the following content.AuthUserFile /var/www/html/testfolder/.htpasswd
AuthGroupFile /www.null
AuthName "Authorization Required"
AuthType Basic
require user USER_NAME
N.B. Change "test folder" to the name of your folder and change "USER_NAME" to the user name you wish to use.
Press your esc button then :wq to save your file in your vi editor.
Step 06: Next we'll create the .htpasswd file. We want to run htpasswd on the path of the folder we want to protect.
[root@linux ~]# htpasswd -c /var/www/html/testfolder/.htpasswd USER_NAME
New password:
Re-type new password:
Adding password for user USER_NAME
Step 07 : Next we will have to edit the apache httpd.conf (on some systems called the apache2.conf) file.[root@linux ~]# vi /etc/httpd/conf/httpd.conf
Step 08: You will have to scroll all the way to the bottom to add the following directory.#FOR MY TEST FOLDER
<Directory "/var/www/html/testfolder">
AllowOverride AuthConfig
</Directory>
Step 09: Finally save httpd.conf by typing esc :qw! and restart apache.[root@linux ~]# service httpd restart
Step 10: To add new users, use the same command without the -c switch. For example, to add the user mahbub, type# htpasswd .htpasswd mahbub
Step 11: To delete users, open the .htpasswd file, using your favorite unix editor, like vi, and delete the row(s) associated with the specific user(s) that you want to remove.Restrict web page under
/var/www/html/testfolder using Digest authentication:
Step 12: Add the following lines in the htttpd.conf file<Directory "/var/www/htdocs/testfolder" >
Options None
AllowOverride None
AuthType Digest
AuthName "Protected Area"
AuthDigestFile /usr/local/Apache/conf/digest_passwd
AuthDigestGroupFile /usr/local/apache/conf/groups
Require valid-user
Order deny,allow
Deny from all
</Directory>
Step 13:create a valid user as# htdigest -c /usr/local/apache/conf/digest_passwd "Protected Area" username
Step 14:Now restart http serviceTheory of User authentication
Apache allows us to require user authentication for access to certain directories. The authentication method can be one of two types, Basic or Digest.
Basic authentication
To set up a directory that requires a user to supply a username and password we would use something like the following in our
httpd.conf file:
<Directory "/var/www/htdocs/protected" >
Order deny,allow
Deny from all
Allow from 192.168.1.
AuthName "Private Information"
AuthType Basic
AuthUserFile /usr/local/apache/conf/passwd
AuthGroupFile /usr/local/apache/conf/groups
require group <group-name>
</Directory>
Firstly we have denied access to all users but those on our internal network to the directory /var/www/htdocs/protected. To require a password we use the
AuthType Basic directive. Our password file is /usr/local/apache/conf/passwd, as specified by the
AuthUserFile directive and, similarly, we specify a group file. The last line
require group <group-name> means that a user must be a member of <group-name> in order to be allowed access to the directory.
Of course, for this to work, we must set up our password and group files. For the group file simply create a file, /usr/local/apache/conf/groups, containing the line:
group-name: user1 user2
You can specify as many groups as you wish on separate lines. List users separated by a space.
Next we create the password file with the command
htpasswd -cm /usr/local/apache/conf/passwd user1. This will prompt for a password and create a user with name
user1 in the file /usr/local/apache/conf/passwd. The
c option will create the file if it doesn't exist, and the
m option will MD5 hash the password (SHA1 and crypt options are also available, but SHA1 does not work with some Apache versions). Subsequent users can be added using
htpasswd -m /usr/local/apache/conf/passwd user1.
If you do not want to use groups you could use
require valid-user user1 user2 in order to only allow access to certain users.
The disadvantage of Basic Authentication is that passwords are sent as plain text from the client to the server, meaning that it is simple for a malicious user with access to the network can obtain the password using a network traffic analyzer. Digest Authentication tries to prevent this.
Digest Authentication
In digest authentication the password is never transmitted across the network. Instead the server generates a
nonce, a one-time random number, and sends it to the client's browser, which then hashes the nonce with the user's password and sends the resulting hash back to the server. The server then performs the same hash and compares the result. This is considerably more secure than Basic Authentication, though not so widely used. One disadvantage of Digest Authentication is that it requires setting up a different password file for each realm on the server, as the realm name is used when creating the necessary hashes. With Basic Authentication, one password file can be used across the board.
To create an area protected by Digest Authentication, we use something like the following.
<Directory "/var/www/htdocs/protected" >
Options None
AllowOverride None
AuthType Digest
AuthName "Protected Area"
AuthDigestFile /usr/local/Apache/conf/digest_passwd
AuthDigestGroupFile /usr/local/apache/conf/groups
Require valid-user
Order deny,allow
Deny from all
</Directory>
This time we set
AuthType Digest, and the
AuthName "Protected Area" directive is required. In place of
AuthUserFile and
AuthGroupFile directives we use the
AuthDigestFile and
AuthDigestGroupFile directives. The group file is the same as previously, but we need to set up the password file using the command
htdigest -c /usr/local/apache/conf/digest_passwd "Protected Area" user1. Note the use of the
htdigest program in place of
htpassword and the
AuthName in the command. Again the
c option creates the file if it doesn't exist.
Article Written By : Mahabub Bhai.
