Authentication, Authorization and Access Control - Apache HTTP Server
Getting it working
Here's the basics of password protecting a directory on your server.
You'll need to create a password file. This file should be placed somewhere not accessible from the web. This is so that folks cannot download the password file. For example, if your documents are served out of
/usr/local/apache/htdocsyou might want to put the password file(s) in/usr/local/apache/passwd.To create the file, use the
htpasswdutility that came with Apache. This will be located in thebindirectory of wherever you installed Apache. To create the file, type:
htpasswd -c /usr/local/apache/passwd/passwords rbowen
htpasswdwill ask you for the password, and then ask you to type it again to confirm it:
# htpasswd -c /usr/local/apache/passwd/passwords rbowen
New password: mypassword
Re-type new password: mypassword
Adding password for user rbowenIf
htpasswdis not in your path, of course you'll have to type the full path to the file to get it to run. On my server, it's located at/usr/local/apache/bin/htpasswdNext, you'll need to configure the server to request a password and tell the server which users are allowed access. You can do this either by editing the
httpd.conffile or using an.htaccessfile. For example, if you wish to protect the directory/usr/local/apache/htdocs/secret, you can use the following directives, either placed in the file/usr/local/apache/htdocs/secret/.htaccess, or placed inhttpd.confinside a <Directory /usr/local/apache/apache/htdocs/secret> section.
AuthType Basic
AuthName "Restricted Files"
AuthUserFile /usr/local/apache/passwd/passwords
Require user rbowenLet's examine each of those directives individually. The
AuthTypedirective selects that method that is used to authenticate the user. The most common method isBasic, and this is the method implemented bymod_auth. It is important to be aware, however, that Basic authentication sends the password from the client to the browser unencrypted. This method should therefore not be used for highly sensitive data. Apache supports one other authentication method:AuthType Digest. This method is implemented bymod_auth_digestand is much more secure. Only the most recent versions of clients are known to support Digest authentication.The
AuthNamedirective sets the Realm to be used in the authentication. The realm serves two major functions. First, the client often presents this information to the user as part of the password dialog box. Second, it is used by the client to determine what password to send for a given authenticated area.So, for example, once a client has authenticated in the
"Restricted Files"area, it will automatically retry the same password for any area on the same server that is marked with the"Restricted Files"Realm. Therefore, you can prevent a user from being prompted more than once for a password by letting multiple restricted areas share the same realm. Of course, for security reasons, the client will always need to ask again for the password whenever the hostname of the server changes.The
AuthUserFiledirective sets the path to the password file that we just created withhtpasswd. If you have a large number of users, it can be quite slow to search through a plain text file to authenticate the user on each request. Apache also has the ability to store user information in fast database files. Themod_auth_dbmmodule provides theAuthDBMUserFiledirective. These files can be created and manipulated with thedbmmanageprogram. Many other types of authentication options are available from third party modules in the Apache Modules Database.Finally, the
Requiredirective provides the authorization part of the process by setting the user that is allowed to access this region of the server. In the next section, we discuss various ways to use theRequiredirective.
