Tutorial on .htpasswd and .htaccess with apache(httpd) in Linux

By Raaz -
If there is a situation that have to dealt with like a public website but with some secret information.
How can we protect the information ? .

We can use .htpasswd and .htaccess in that time.

How  ? Lets see................

Open your terminal and type as

                        vim /etc/httpd/conf/httpd.conf

and find line no : 334 to 338. This is the area of httpd.conf that dealt with .htaccess

    334 # AllowOverride controls what directives may be placed in .htaccess files.
    335 # It can be "All", "None", or any combination of the keywords:
    336 #   Options FileInfo AuthConfig Limit
    337 #
    338     AllowOverride AuthConfig
 

Now look at line no 338 , before modifying it will look like

                     AllowOverride None

You have to modify it to

                     AllowOverride AuthConfig

Now make sure that if you have some website and VirtualHost configuration of that website is successfully completed.



For my case that website is website1.com and now open your terminal and type as

                   #  vim /var/www/html/website1/protected/.htaccess

Then Write below lines

                   AuthUserFile /var/www/html/website1/protected/.htpasswd
                   AuthType basic
                   AuthName " My Personal Files"
                   Require valid-user

So what they means , here we go.....

AuthUserFile  : This is the path of .htpasswd file. Make sure you are giving proper path. If you give wrong path , it wont allow to login. Dont panic we are admins , we can make it solve by giving proper path.

AuthType : The AuthType directive selects that method that is used to authenticate the user. The most common method is Basic, and this is the method implemented by mod_auth_basic. It is important to be aware, however, that Basic authentication sends the password from the client to the server unencrypted. This method should therefore not be used for highly sensitive data, unless accompanied by mod_ssl. Apache supports one other authentication method: AuthType Digest. This method is implemented by mod_auth_digest and was intended to be more secure. This is no longer the case and the connection should be encrypted with mod_ssl instead.

AuthName : So AuthName can be anything , its the name get displayed on that password window.

Require : So this is to define to whom we have to allow to access.

For Example :

Require valid-user  # means only the valid user who are in .htpasswd file
Require raja raaz # means among the users of .htpasswd file allow only raja and raaz

But

Require valid-user raja is wrong way of usage because if you give so it doesnt make any sense.

I hope that explanation is fine. Now save and close that file and now we are going to create users for it.

# htpasswd -c /var/www/html/website1/protected/.htpasswd raja  Password

Location of htpasswd file is completely upto you but .htaccess must be inside of protected directory which intended to be protected.

To add one more user you can use this command
# htpasswd  /var/www/html/website1/protected/.htpasswd raaz  Password

If you mentioned -c here then it will overwrite old .htpasswd file. So dont  mention -c while adding one more user.
Now raja is username and Password is password to access. This will store in  /var/www/html/website1/protected/.htpasswd location. After you added user.

You can try. Just try to access  website1.com/protected in your browser and it will ask you username and password and only allowed are able to access those content.

Hope it helps.

In case of any queries please let me know.


References:

http://www.colostate.edu/~ric/htpass.html
http://www.anchor.com.au/hosting/support/password_protection_using_htaccess
http://www.seas.upenn.edu/cets/answers/auth-htpasswd.html
http://httpd.apache.org/docs/2.2/howto/auth.html


 Thank you

Comments

Post a Comment

Popular posts from this blog

grep: unknown device method

By Raaz -
Today while using grep command via rundeck I was through grep: unknown device method  error. And the reason is due to I am having ' - ' in my search pattern I was through this error. I mean search includes grep "-search.this" /path/to/file Then you may get error with grep. So remove ' - ' in pattern and repeat your search. grep "search.this" /path/to/file Hope that helps.
Read more

Uploading files to FTP/SFTP using CURL

By Raaz -
Hello, Today I am writing below article which can help you to upload files to SFTP/FTP by using CURL. Ok why we need that ? Let me tell explain!! How we login into SFTP/FTP ? [root@virt03 test]# sftp 192.168.56.110 Connecting to 192.168.56.110... root@192.168.56.110's password: sftp> ls anaconda-ks.cfg       nodes                 post-install          post-install.log sftp> exit and uploading files with put command. Its a lengthy way. So recently I have gone through few articles and with some R&D I have modified it as script and command-line argument support.So you can call the script with filename as argument.  So Lets do this!!! Command 1 : This is for uploading a single to SFTP/FTP by using CURL.  SFTP curl -k  -u virt03:virt03 -T file4  sftp://192.168.56.110/home/virt03/ Syntax :  curl -k  -u username:password -T filename sftp://IP_Addreess OR Hostname:/path/to/upload  FTP curl -k  -u virt03:virt03 -T f
Read more

How to find outgoing IP in Linux ?

By -
Here is a small snippet to find outgoing IP of your Linux box. 1. To find the outgoing internal IP only         # ip route get 8.8.8.8 | head -1 | gawk '{ print $7 }' 2. To find the outgoing internal IP along with interface.   # ip route get 8.8.8.8 | head -1 | gawk '{ print $5,$7 }' 3. In-case if your system is connected to Internet, to find the outgoing external IP   # curl ifconfig.me Note:   In case if your system having public IP assigned then there is no difference between outgoing internal IP and external IP (both are same).
Read more