11

The Apache Directory directive on /var/www/ninja/www/ only allows modification of the behaviour of FileInfo Indexes by way of the .htaccess file. Refer to the Apache documentation on AllowOverride. Please modify the AllowOverride to also allow the local configuration of AuthConfig resulting in: <Directory /var/www/ninja/www/> Options Indexes ...


8

It seems that AuthType is provided by the mod_authn_core in Apache 2.4. I don't see that module loaded in the list you provided.


7

You are having this problem because of SELinux security context. To overcome this you need to change the selinux label of the directory/file in question. You can find out the apache process security context using ps axZ | grep httpd. And check the same for ls -Z /var/www/html/server-auth/.htpasswd To adjust the directory labeling try: chcon command (it's ...


5

Your configuration should add AuthConfig Limit at AllowOverride FileInfo Indexes Becomes AllowOverride FileInfo Indexes AuthConfig Limit


3

So can I achieve this: When I go to: www.websitename.com/data/ it should give an 404 error. And when do www.websitename.com/data/welcome.php it should work. You can simply rewrite every request to a 404 not found status with an exception to welcome.php. In the code below you will see that every rule gets rewritten tot a 404 status with the exception of ...


3

With SELinux enabled Apache is unable to read files unless they are of the same type domain as the running process. First, check the type domain of the httpd process. ps axZ|grep httpd Second, check the type domain of the .htpasswd file. ls -Z /var/www/html/server-auth/.htpasswd Use the command chcon to change the domain of the file to match that of the ...


2

I'm not sure <Proxy> directive handle HTTP Basic auth (documentation suggest only restriction by IP/domain). I think you should just use general method like: <Location /> AuthType Basic AuthName "Dev Server" AuthUserFile "/home/.htpasswd" Require valid-user </Location>


2

You should use the htpasswd program to create and add users to the .htpasswd file as plaintext passwords are not supported on linux e.g. htpasswd -c /home/.htpasswd john New password: Re-type new password: Adding password for user john will create the file and add the user john with the password you provide. You can then add other users like this htpasswd ...


2

Without the complete error message (I would expect the module and ip-address) it's a bit of a guess but you're mixing directives from two different modules in Apache 2.4 , the Require directive from mod-authz-core and the "legacy" directives Allow and Order from mod-access-compat, which might not stack very well. You could try replacing the lines Order ...


2

To protect the entire subdomain, the statements should appear in the existing server block: server { server_name dev.example.com; auth_basic "Administrator Login"; auth_basic_user_file /home/path/to/.htpasswd; ... }


2

I found the culprits here: /etc/nginx/conf.d/wordpress_http.conf and /etc/nginx/conf.d/wordpress_https.conf I commented out these lines: # auth_basic "Restricted"; # auth_basic_user_file /etc/nginx/htpasswd/wpadmin; # # location ~* \.(htaccess|htpasswd) { # deny all; # }


1

Looking at Apache documentation on Authentication, Authorization, and Access Control, unfortunately it seems that it is not possible to logout. So the problem is not that http://mysite/fill/do.php is not asking for credentials. The actual problem here is that you are not able to reset the authentication. How do I log out? Since browsers first ...


1

As Orphans suggests, you do basically just "remove it". You need to remove the relevant code from the .htaccess file (probably in the protected directory), or delete the file altogether if that is the only code in it (although this being WordPress it's quite probable that there are WP specific directives there as well). The code in .htaccess will also ...


1

Assuming you've already set up something to require the authentication on all of the target URLs (both wp-admin and the secret URL), put this in your virtual host block: RewriteCond %{LA-U:REMOTE_USER} ^$ RewriteRule wp-admin/ - [R=404] I haven't tested so I'm not entirely sure if it'll successfully short-circuit the 401 response that the authentication ...


1

SSL is not enabled in this server. Try http://www.example.com:8081/ To get SSL to work, you'll need something like: listen 8081 ssl; ssl_certificate /path/to/your.crt; ssl_certificate_key /path/to/your.key; error_page 497 https://$host:$server_port$request_uri; The error page line will redirect http://... to https://... EDIT: here's a full server block ...


1

There is an SSLRequireSSL directive which might work for you here - http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslrequiressl


1

First of all .htaccess files are intended to have effect in the directory they're placed, so rather than having one in /var/www/ typically you would have two: one in each of /var/www/impdata/ and /var/www/data/ Or rather have no .htaccess files at all: my pet peeve, quoted from from the manual on .htaccess files: You should avoid using .htaccess files ...


1

It seems basic authentication does not support any non-ASCII characters as detailed in this SO question


1

In the directory you want to "unprotect", have a .htaccess file containing this: Satisfy any It will remove any restrictions inherited from .htaccess file in higher-level directories. Note that it will remove such restrictions for all subdirectories as well (because this is how htaccess checking works).


1

Does Apache? No. The only one it does normally use is .htaccess, but that's really only due to the default of AccessFileName being AccessFileName .htaccess - change that configuration and Apache will have no special interest whatsoever in files that start with .ht. .htpasswd isn't a normal standard, and really isn't even a good idea; the general ...


1

.htaccess is the default AccessFileName used by apache. There is nothing special about `.htpasswd' just that most people use it so it makes the ACL to block access to them easier. There is nothing that says you need to use those filenames, and if you have access to the httpd.conf file, you really shouldn't use them at all as they slow down access to the ...


1

The generator in the accepted answer seems to no longer be active. However, this one seems to work: https://www.askapache.com/online-tools/htpasswd-generator/


Only top voted, non community-wiki answers of a minimum length are eligible