Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am loosing hours with this (should-be) simple task. I want to restrict access to my website, which is on my server in /var/www/.

I've created /etc/apache2/passwords file with httpasswd successfuly (user primoz). I've put .htaccess in /var/www/ and this is the content:

AuthType Basic
AuthName "RestrictedFiles"
AuthBasicProvider file
AuthUserFile /etc/apache2/passwords
Require user primoz

My website is still accessible. I also tried editing the /etc/apache2/sites-enabled/000-default - line AllowOverride None to AllowOverride All. No need to mention that it didn't make any changes.

Should restricting really be this frustrating?

EDIT: /etc/apache2/httpd.conf is empty by default because I run server on Debian - which uses apache2.conf instead.

Here is the whole apache2.conf.

share|improve this question

migrated from stackoverflow.com Oct 24 '12 at 16:32

This question came from our site for professional and enthusiast programmers.

    
From the sounds of it, it seems that your .htaccess is just not enabled. Is this line: LoadModule rewrite_module modules/mod_rewrite.so uncommented in your httpd.conf? –  Flo Oct 24 '12 at 15:40
    
/etc/apache2/httpd.conf is empty and AFAIK is not used anymore by apache. Though I have tried enabling rewrite with sudo a2enmod but also this doesn't solve it :) –  Primož Kralj Oct 24 '12 at 15:41
    
Are you closing your browser and re-opening before testing this auth each time? –  nickhar Oct 24 '12 at 15:47
    
No I didn't try that before. I tried it just now and it doesn't help. –  Primož Kralj Oct 24 '12 at 15:50
add comment

3 Answers

Enable .htaccess through httpd.conf and then put this code in your .htaccess under DOCUMENT_ROOT directory:

AuthType Basic
AuthName "RestrictedFiles"
AuthUserFile /etc/apache2/passwords
Require valid-user

Also make sure mod_authn_core is enabled.

share|improve this answer
    
I am using Apache 2.2.* and httpd.conf is empty. Also, authn_core doesn't exist via a2enmod! –  Primož Kralj Oct 24 '12 at 15:53
add comment

Just looking at mine (which is in use):

AuthUserFile /var/www/www.site.com/htdocs/.htpasswd 
AuthName Password_secure
AuthType Basic
require valid-user

You should also edit your apache2.conf and make sure the following are enabled:

LoadModule rewrite_module modules/mod_rewrite.so

And the options/allows:

<Directory /your/path>
  Options FollowSymLinks
  AllowOverride All
  Order deny,allow
  Deny from all
  Satisfy all
</Directory>

If it's for a virtual host, then this block needs to sit within <VirtualHost></VirtualHost> tags.

Beyond these, It's difficult to see what causing you issues without looking at the full apache2.conf

share|improve this answer
    
I think my .htaccess is OK. It' just not enabled and I don't know how to enable it. –  Primož Kralj Oct 24 '12 at 15:55
    
If I put AllowOverride All in apache2.conf and restart the server, it says Syntax error on line 38 of /etc/apache2/apache2.conf: AllowOverride not allowed here. I will put the whole apache2.conf in my question, please review it. Thanks! –  Primož Kralj Oct 24 '12 at 16:11
    
See my edit - needs to be put in directory tags. –  nickhar Oct 24 '12 at 16:16
    
I had put this in apache2.conf but - no changes, again! –  Primož Kralj Oct 24 '12 at 16:19
add comment
up vote 1 down vote accepted

I was able to resolve this. The configuration in /etc/apache2/sites-enabled/000-default had AllowOverride None instead of AllowOverride All.

I was sure I changed this but I guess I reverted the file when it didn't work (don't remember why - probably something else was misconfigured). Anyways, the first paragraph is the solution.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.