Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I currently have my apache server to authenticate via a password file created from htpasswd. Configured as such:

AuthType Basic
AuthName "Secured Site"
AuthUserFile "/etc/apache2/users.passwd"

How can I change this to authenticate via local system accounts and additionaly restrict to only a subset of local system accounts in a specified group?

share|improve this question

As suggested by David Z, you can use mod-authnz-external. Use it with pwauth for example.

If you are running Debian or a derivative:

apt-get install libapache2-mod-authnz-external pwauth
a2enmod authnz_external

In your configuration, add

<IfModule mod_authnz_external.c>
  AddExternalAuth pwauth /usr/sbin/pwauth
  SetExternalAuthMethod pwauth pipe

And in the Directory section or your .htaccess file:

    AuthType Basic
    AuthName "Login"
    AuthBasicProvider external
    AuthExternal pwauth
    Require valid-user
    # or
    # Require user jules jim ...

Finally reload the configuration with apache2ctl restart or service apache2 reload.

See also this documentation.

share|improve this answer
From INSTALL, section "CONFIGURATION" -> "Configurating the External Authenticator" -> "For External Authentication Programs": AddExternalAuth and SetExternalAuthMethod are old-style syntax commands. The new-style syntax uses only one command: DefineExternalAuth pwauth pipe /usr/sbin/pwauth. – sierrasdetandil Dec 14 '15 at 16:28

The Apache module mod_auth_pam will do exactly this for you. You enable the module, and the config file should look something like

AuthType Basic
AuthName "secure area"
require group staff
require user webmaster

And you're all set.

share|improve this answer
Seems the module you linked to is designed for Apache 1.3 or 2.0.… gives hints on making it work. – David Pashley Jul 24 '09 at 21:13

You probably want to look into something like mod_auth_pam. PAM is the "Pluggable Authentication Module" system and the standard Linux (I'm assuming this is Linux) system login mechanism relies on PAM to do its authentication.

Another option is mod_authnz_external, which will look directly at the /etc/shadow file to authenticate accounts.

EDIT: Apparently mod_auth_pam is no longer maintained (unfortunately), so maybe mod_authnz_external would be a better bet...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.