45

I am trying to password protect a subdomain and all of it's subdirectories and files, but my knowledge on the matter is very limited, how can I go about doing that?

Ronan Boiteau
  • 9,608
  • 6
  • 34
  • 56
Odyss3us
  • 6,457
  • 18
  • 74
  • 112

6 Answers6

64

It's a simple two step process

In your .htaccess put

AuthType Basic
AuthName "restricted area"
AuthUserFile /path/to/the/directory/you/are/protecting/.htpasswd
require valid-user

use http://www.htaccesstools.com/htpasswd-generator/ or command line to generate password and put it in the .htpasswd

Note 1: If you are using cPanel you should configure in the security section "Password Protect Directories"

EDIT: If this didn't work then propably you need to do a AllowOverride All to the directory of the .htaccess (or atleast to previous ones) in http.conf followed by a apache restart

<Directory /path/to/the/directory/of/htaccess>
      Options Indexes FollowSymLinks MultiViews
      AllowOverride All
</Directory>
Mahesh
  • 2,186
  • 16
  • 17
  • 1
    So do I put both the `.htaccess` file and the `.htpasswd` files in the sudomain's directory? Or do I put the `.htpasswd` file inside of the directory I want protected and the `.htaccess` in the subdomain's directory? – Odyss3us Mar 08 '11 at 08:43
  • @user270311 you need to put the .htaccess in the directory where you need to protect. so here in the subdomain's directory. and .htpasswd in directory anywhere with proper permissions which is specified in AuthUserFile – Mahesh Mar 08 '11 at 11:42
  • 7
    I will formulate this differently: put the .htpasswd into a directory that is not exposed to the web in any way (protected or not) yet is available to the apache. – Sergey Snegirev May 14 '14 at 18:48
  • Worked like a charm, although I didn't use any of those options in my http.conf, just the `AllowOverride All`. (Actually there is no more http.conf; Apache now uses a separate file for each site in the sites-available directory). – felwithe May 22 '18 at 04:06
  • 1
    Does not work on Apache 2.4 I tried it and nothing happens – Black May 03 '19 at 12:53
  • 1
    I put the wrong password. Now every time I reload it returns: Internal Server Error. I can't see the username password input option. even my site not works, it returns Internal Server Error. @Mahesh – Jakir Hossen Jun 26 '21 at 05:22
  • "or command line" what is the algorithm used, thus the Linux command? – Rodrigo Jul 26 '21 at 03:19
  • 1
    Answering my question, the command is `htpasswd` (at least on Debian). – Rodrigo Aug 08 '21 at 06:18
18

Just extend Mahesh's answer.

.htaccess

AuthType Basic
AuthName "restricted area"
AuthUserFile /path/to/the/directory/you/are/protecting/.htpasswd
require valid-user

If you don't want to use online password generator, you could use htpasswd or openssl:

1. Using htpasswd

htpasswd -c /path/to/the/directory/you/are/protecting/.htpasswd my_username
# then enter a password
# -c means Create a new file

2. Using openssl

openssl passwd -apr1 your_password

Then put the generated password to .htpasswd with format:

username:<generated_password>

Example:

.htpasswd

my_username:$apr1$ydbofBYx$6Zwbml/Poyb61IrWt6cxu0
ninhjs.dev
  • 7,203
  • 1
  • 49
  • 35
  • 2
    Note that the htpasswd file does not need to be named .htpasswd, and it does not need to be located in the folder that you want to protect. For security you can locate it outside of the http / httpdocs folder so it is not accessible through HTTP/S. For example /var/www/private-files/password-list-for-protected-folder – Dave S Mar 29 '23 at 23:39
17

To password protect a directory served by Apache, you need a .htaccess file in the directory you want to protect and a .htpasswd file that can be anywhere on your system that the Apache user can access (but put it somewhere sensible and private). You most likely do not want to put .htpasswd in the same folder as .htaccess.

The .htaccess file may already exist. If not, create it. Then insert:

AuthType Basic
AuthName "Your authorization required message."
AuthUserFile /path/to/.htpasswd
require valid-user

Then create a .htpasswd file using whatever username and password you want. The password should be encrypted. If you are on a Linux server, you can use the htpasswd command which will encrypt the password for you. Here is how that command can be used for this:

htpasswd -b /path/to/password/file username password

Reflexorozy
  • 360
  • 2
  • 10
3

You need to generate a password (username+password) string for authentication, write it to a file and place it inside the subdirectory you want to restrict access.

String looks like,

username:hashkey
  • You can use HTTP password generator tool to do this.
  • Copy and paste the string you obtained from the above site to a new file (.htpasswd) anywhere outside your site's webroot (better to keep anywhere inside home directory of the user).
  • Add following lines in your .htaccess file.
AuthType Basic
AuthName "Require Authentication"
AuthUserFile [PATH_TO_FILE]/.htpasswd
Require valid-user

  • If the password is not triggering, check the permission of .htaccess file.

  • If authentication fails, check the existence of .htpasswd file in the specified location. (Make sure your user account has enough privileges on .htpasswd file to read)

  • You do not need to restart the server to achieve this.

Please let me know if you have any queries.

Peter
  • 323
  • 4
  • 15
Deepak R
  • 423
  • 8
  • 9
1

You'd probably want to use the mod_auth_digest module. Apache has provided a very nice guide to using the full range of authentication and authorization modules.

sarnold
  • 102,305
  • 22
  • 181
  • 238
  • 1
    Check this out: "This module implements HTTP Digest Authentication (RFC2617), and provides an alternative to mod_auth_basic where the password is not transmitted as cleartext. However, this does not lead to a significant security advantage over basic authentication. On the other hand, the password storage on the server is much less secure with digest authentication than with basic authentication. Therefore, using basic auth and encrypting the whole connection using mod_ssl is a much better alternative." – biocyberman Feb 24 '17 at 10:08
  • 1
    @biocyberman, thanks for the correction. I'll leave the post as a warning to the future. – sarnold Feb 27 '17 at 06:48
-3

To create a proper password, you may create a php file and run it locally (on your computer, not on the webserver) with the following content:

<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8" />
</head>
<body>
<form method="post" accept-charset="utf-8">
    <input type="text" name="clear"/>
    <input type="submit" name="submit" value="generate" />
</form>

<?php
header("Content-Type: text/html; charset=utf-8");

if (isset($_POST['clear']) && $_POST['clear'] != '') {
    $cl = $_POST['clear'];
    $pw = crypt($cl, base64_encode($cl));
    echo $pw;
}
?>
</body>
</html>

I usually put my .htpasswd file in a directory called /htpasswd/ outside of the webcontent directory, like AuthUserFile /home/www/usr122/files/htpasswd/.sportsbar_reports_htpasswd (and not in the webcontent folder /home/www/usr122/html/htpasswd/) and rename .htpasswd file to what it is for, e.g. .sportsbar_reports_htpasswd

The password file itself should look like

testusername:dGATwCk0tMgfM

where the username is testusername and the password is testuserpassword

ddlab
  • 918
  • 13
  • 28
  • It's wrong to assume that everyone runs PHP on their server. – Arslan Khan May 27 '20 at 22:11
  • 1
    @ArslanKhan You're right. But sorry, at this time i wrote this, for me apache and php were the only things existing in the web universe :-) – ddlab May 29 '20 at 07:56