2

I am running Apache 2.2.20 on a Ubuntu 11.04 web server. I have a Joomla site running on it, but I have also added some custom content. In the main web directly I have added a folder /images/sub_folder and in this sub_folder I have put a bunch of pictures. I do not want anyone to be able to simply access these pictures directly from the web, so I made a .htaccess file in that sub_folder and just put the following line in it:

deny from all

There doesn't seem to be any effect, I can still access the images directly from a web browser. I have restarted the Apache service. What am I doing wrong?

Thanks

Tim

2 Answers 2

2

At your apache configuration deny the entry for the directory, something like this:

<Directory "yourdirectoryabsolutepath" >
Options Includes
AllowOverride All
Order allow,deny
Deny from All
</Directory>

If you want to ask for a login password to access to the folder from web uou need to create an .htaccess in the folder you want to protect, and a password file for the user that will be able to log in, but have to change from your apache config to Allow from All and something at your .htacces like this

AuthName "Password Protected Directory"
AuthType Basic
AuthUserFile /pathtoyourpasswdfile/.htpasswd
require valid-user

and use a site like this to create your encrypted password, same format that your apache uses

http://www.edwinbush.com/my-tools-page/htpasswd-content-generator/

And thats it, now that when you need to enter to the folder a promp will show and ask you for the user and password. Might need to restart apache

3
  • Good note about setting up authentication in context of the question. Sep 7, 2012 at 20:04
  • Yes!!! that did. Sep 7, 2012 at 20:17
  • you are welcome...
    – jpganz18
    Sep 7, 2012 at 20:56
2

In your website's config file, you will have to use AllowOverride All. This will override earlier configuration directives with whatever you have mentioned in .htaccess file.

Note: For security reasons, do not set AllowOverride to anything other than None in your block. Instead, find (or create) the block that refers to the directory where you're actually planning to place a .htaccess file.

Refer following links.

http://httpd.apache.org/docs/2.2/mod/core.html#allowoverride http://httpd.apache.org/docs/2.2/howto/htaccess.html#how

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .