Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I added .htaccess

AuthType Basic
AuthName "restricted area"
AuthUserFile /path/to/the/directory/you/are/protecting/.htpasswd
require valid-user

and .htpasswd

username:password

However, it is not working. It doesn't prompt me for login.

share|improve this question
add comment

3 Answers

Your .htaccess file looks fine. The only reason it is not working as you have it is that Apache is configured to ignore it.

In your apache config, ideally in the sites-* config file, add:

<Directory /path/to/the/directory/you/are/protecting/>
      AllowOverride AuthConfig
</Directory>

The AllowOverride directive is what allows the htaccess file to function. By default, most Apache setups have it turned off (set to None actually), including Ubuntu/Debian.

In your .htpasswd file, the password must be encrypted. You can do this most easily using the htpasswd tool that mezgani suggested. It will look like this if you read the file:

bob:abJnggxhB/yWI

With the AllowOverride directive set to at least AuthConfig, your .htaccess file in place, and your .htpasswd containing a user with an encrypted password, you should be good to go.

share|improve this answer
add comment

First, add this following to your apache config:


<Directory /path/to/the/directory/you/are/protecting/>
        AllowOverride AuthConfig
        Options Indexes MultiViews FollowSymLinks
        deny from all
        Order deny,allow
</Directory>

After, you may create the .htpasswd file that will contain your login and password with htpasswd command and not manually


htpasswd -c /path/to/the/directory/you/are/protecting/.htpasswd username
I think that moving the .htpasswd file somewhere different from the path of the directory that you are protecting is more secure.

Also, For security reasons, please read this article on securityfocus

share|improve this answer
    
how do you remove it later ? –  jaaaaaaax Oct 15 '09 at 20:22
    
Delete the .htaccess and .htpasswd files. and don't forget to remove the apache config that you've added –  mezgani Oct 15 '09 at 20:27
    
it doesn't work. –  jaaaaaaax Oct 15 '09 at 20:50
    
You will need to add a require valid-user below the Order line. The current apache configuration is set to deny from everyone. –  emills Oct 15 '09 at 21:11
    
yes. i did that. still doesn't work. –  jaaaaaaax Oct 15 '09 at 21:18
show 2 more comments

In Snow Leopard (OS X 10.6), changing the AllowOverride in httpd.conf only enables .htaccess protection in the main web pages (/Library/WebServer by default). Enabling it for individual users' ~/Sites folders is controlled by a separate .conf file for each user. On my systems this is under /etc/apache/users . Jeff Snider's reference to "in the sites-*" may be where the files for individual users' pages are configured on his system.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.