Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm currently denying access to all subdirectories and files with exception to the file /var/www/subdir/file.php

<Directory /var/www/*>
    Allow from None
    Order allow,deny
</Directory>

<Location /subdir/file.php>
      Order allow,deny
      allow from all
</Location>

How can I protect this file with htpasswd? I tried the following syntax, but it did not work:

<Directory /var/www/*>
    Allow from None
    Order allow,deny
</Directory>

<Location /subdir/file.php>
      Order allow,deny
      allow from all

      AuthType Basic
      AuthName "Restricted Access"
      AuthUserFile /var/www/private_html/passwords/allowed-users
      Require user me
</Location>

EDIT Here's my entire httpd.conf file

<Directory /var/www/public_html/*>
        Allow from None
        Order allow,deny
</Directory>

<Location /hello1.php>

        AuthType Basic
        AuthName "Restricted Access"
        AuthUserFile /var/www/private_html/passwords/allowed-users
        Require user me

        SetEnvIf Request_URI "(/hello1.php)$" allow

        Order allow,deny
        Allow from env=allow
        Satisfy any

</Location>
share|improve this question
    
Can you clarify what behavior it was exhibiting when it didn't work? –  Shane Madden Jun 14 '12 at 3:43
    
It allowed access to the the file from the URL without prompting for password validation –  user784637 Jun 14 '12 at 3:48
    
Do you have a Satisfy any directive somewhere else in your configuration? –  Shane Madden Jun 14 '12 at 3:48
    
No - All I have is the code block that says <Directory /var/www/public_html/*> Allow from None Order allow,deny </Directory> –  user784637 Jun 14 '12 at 3:50
    
I mean anywhere else in your Apache configuration that would apply to this request. It doesn't need to be in the same file. –  Shane Madden Jun 14 '12 at 3:52

3 Answers 3

up vote 3 down vote accepted
    <FilesMatch "^(?!protected\.html)$">
       deny from all
    </FilesMatch>
    <Files "protected.html">
       AuthName "Username and password required"
       AuthUserFile /www/sites/testcase.com/.htpasswd
       Require valid-user
       AuthType Basic
    </Files>

You will get a forbidden for everything but the file in question. But when you try to access protected.html or whatever name you want, it will give you a basic authentication dialog.

share|improve this answer
AuthType Basic
AuthName "Restricted Area"
AuthUserFile /home/path/.htpasswd
AuthGroupFile /dev/null
Require valid-user
SetEnvIf Request_URI "(path/to/file\.php)$"  allow
Order allow,deny
Allow from env=allow
Satisfy any

You can put the above in your .htaccess file

share|improve this answer

Try denying access by IP address. This should work around satisfy any, but no access would be allowed with satisfy all.

<Location /subdir/file.php>
      Order allow,deny
      deny from all

      AuthType Basic
      AuthName "Restricted Access"
      AuthUserFile /var/www/private_html/passwords/allowed-users
      Require valid-user
</Location>

Or try using satisfy any to require password from untrusted addresses.

<Location /subdir/file.php>
      Order allow,deny
      allow from 127.0.0.1
      deny from all
      satisfy any

      AuthType Basic
      AuthName "Restricted Access"
      AuthUserFile /var/www/private_html/passwords/allowed-users
      Require user me
</Location>

Check your error log to see if anything is logged there. I have found the solution there in a few cases where I got directives wrong.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.