I am trying to password protect a subdomain and all of it's subdirectories and files, but my knowledge on the matter is very limited, how can I go about doing that?
6 Answers
It's a simple two step process
In your .htaccess put
AuthType Basic AuthName "restricted area" AuthUserFile /path/to/the/directory/you/are/protecting/.htpasswd require valid-user use or command line to generate password and put it in the .htpasswd
Note 1: If you are using cPanel you should configure in the security section "Password Protect Directories"
EDIT: If this didn't work then propably you need to do a AllowOverride All to the directory of the .htaccess (or atleast to previous ones) in http.conf followed by a apache restart
<Directory /path/to/the/directory/of/htaccess> Options Indexes FollowSymLinks MultiViews AllowOverride All </Directory> To password protect a directory served by Apache, you need a .htaccess file in the directory you want to protect and a .htpasswd file that can be anywhere on your system that the Apache user can access (but put it somewhere sensible and private). You most likely do not want to put .htpasswd in the same folder as .htaccess.
The .htaccess file may already exist. If not, create it. Then insert:
AuthType Basic AuthName "Your authorization required message." AuthUserFile /path/to/.htpasswd require valid-user Then create a .htpasswd file using whatever username and password you want. The password should be encrypted. If you are on a Linux server, you can use the htpasswd command which will encrypt the password for you. Here is how that command can be used for this:
htpasswd -b /path/to/password/file username password
Just extend Mahesh's answer.
.htaccess
AuthType Basic AuthName "restricted area" AuthUserFile /path/to/the/directory/you/are/protecting/.htpasswd require valid-user If you don't want to use online password generator, you could use htpasswd or openssl:
1. Using htpasswd
htpasswd -c /path/to/the/directory/you/are/protecting/.htpasswd my_username # then enter a password # -c means Create a new file 2. Using openssl
openssl passwd -apr1 your_password Then put the generated password to .htpasswd with format:
username:<generated_password> Example:
.htpasswd
my_username:$apr1$ydbofBYx$6Zwbml/Poyb61IrWt6cxu0 You need to generate a password (username+password) string for authentication, write it to a file and place it inside the subdirectory you want to restrict access.
String looks like,
username:hashkey - You can use HTTP password generator tool to do this.
- Copy and paste the string you obtained from the above site to a new file (.htpasswd) anywhere outside your site's webroot (better to keep anywhere inside home directory of the user).
- Add following lines in your .htaccess file.
AuthType Basic AuthName "Require Authentication" AuthUserFile [PATH_TO_FILE]/.htpasswd Require valid-user
If the password is not triggering, check the permission of .htaccess file.
If authentication fails, check the existence of .htpasswd file in the specified location. (Make sure your user account has enough privileges on .htpasswd file to read)
You do not need to restart the server to achieve this.
Please let me know if you have any queries.
0You'd probably want to use the mod_auth_digest module. Apache has provided a very nice guide to using the full range of authentication and authorization modules.
To create a proper password, you may create a php file and run it locally (on your computer, not on the webserver) with the following content:
<!DOCTYPE html> <html> <head> <meta charset="utf-8" /> </head> <body> <form method="post" accept-charset="utf-8"> <input type="text" name="clear"/> <input type="submit" name="submit" value="generate" /> </form> <?php header("Content-Type: text/html; charset=utf-8"); if (isset($_POST['clear']) && $_POST['clear'] != '') { $cl = $_POST['clear']; $pw = crypt($cl, base64_encode($cl)); echo $pw; } ?> </body> </html> I usually put my .htpasswd file in a directory called /htpasswd/ outside of the webcontent directory, like AuthUserFile /home/www/usr122/files/htpasswd/.sportsbar_reports_htpasswd (and not in the webcontent folder /home/www/usr122/html/htpasswd/) and rename .htpasswd file to what it is for, e.g. .sportsbar_reports_htpasswd
The password file itself should look like
testusername:dGATwCk0tMgfM where the username is testusername and the password is testuserpassword
