How to limit number of attempts someone has to provide username/password credentials for a webpage with htpasswd?

Question

I've enabled htpasswd on a webpage. Is there a way I can limit the number of attempts a user has to enter the correct username/pass credentials before they have to do a hard refresh of the page?

Answer 1

Not with basic authentication, you'll need to go to a different authentication module in order to do it. I was just reading up on mod_auth_pamacea which allows you to use the PAM libraries and all of their goodness with .htpasswd. You could setup a separate service for your http authentication and then use pam_tally.so to limit the number of login attempts. Here are a couple of links for your reading pleasure:

The Linux-PAM System Administrators' Guide

mod_auth_pamacea Documentation

I'm sure there are other auth modules that will allow the same functionality, to me this is the closest you'll come to mod_auth_basic.