Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a few sites with directories protected by http basic auth implemented via .htaccess files paired with .htpasswd files. I've noticed that with a password ending in "et!" I can get in by omitting the "t!", or replacing the ! with a 1.

Contents of my .htaccess file:

AuthType Basic
AuthName "administration"
AuthUserFile /var/www/conf/

require valid-user

I have two users in

Obviously this behavior isn't wanted. Any idea what's going on?

share|improve this question
specifying SHA1 or MD5 (htpasswd -s or -m) was the solution. – CWSChris Jul 7 '10 at 20:33
up vote 6 down vote accepted

Have a look at:

It sounds to me like you're using CRYPT format passwords (the default on most platforms). CRYPT passwords only use the first 8 characters of the password.

I suspect your password exceeds 8 characters in length and the "slightly incorrect" part are characters in the ninth or greater position (which aren't actually checked as part of the password).

share|improve this answer
the man page doesn't mention the default on linux systems. is CRYPT default when using the htpasswd binary without -m, -d, or -s? – CWSChris Jul 7 '10 at 20:10
Try changing the hashing algorithm to SHA1 or MD5, see if that fixes it. – Marcin Jul 7 '10 at 20:19

I would try erasing and recreating the .pw file first. This is a really strange problem...

If that doesn't fix it, check for bug reports related your version of Apache. I HIGHLY HIGHLY doubt it is a bug, though.

I wish I knew where to go from there. Hopefully when you remove/recreate the file it fixes the problem. If not, hopefully an Apache expert wanders this way soon...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.