Password Tutorial (using .htaccess)

At some point you may want to have a set of web pages that are protected, requiring a username/password to gain access to. This tutorial will show you how to set that up. This is geared towards the Apache web server. If you are using another web server, you'll need to check that server's documentation to see how to do this.

These instructions assume you have shell access to the web server. If your ISP doesn't provide shell access, you'll want to ask them if they have a web-based tool to allow you to create password files.

Steps to Password-protect a Directory

First, create a subdirectory in your web area. For the sake of this tutorial I'm creating one beneath the toolbox directory, and naming it "secure". Set the permissions on the directory so that it's world readable/executable (so the web server can get to it), then cd into it.

mkdir secure
chmod 755 secure
cd secure

Next you must create a .htaccess file inside the directory you want protected. Make it a new file, and enter the following data. The items in bold are things you will want to change depending on the location of these files and directories on your server.

AuthUserFile /www/kira/secure/.htpasswd
AuthName "Toolbox Example"
AuthType Basic

<Limit GET>
require valid-user
</Limit>

The AuthName is what the user will see when they're prompted for a password - something to the effect of "Enter Authorization for Toolbox Example". Be sure to put quotes around the AuthName if it is more than one word.

Now you'll have to set up the password file. You'll need to use the htpasswd program. It is included with NCSA and Apache httpd servers, usually in the support subdirectory under the server root (try /usr/local/etc/httpd/support). You can also write your own program to generate encrypted passwords. You just want to have crypt(actual-password) be stored in the file.

Now for every userid you want to add to the password file, enter the following. (the -c is only required the first time; it indicates that you want to create the .htpasswd file).

   htpasswd -c /www/kira/secure/.htpasswd user1
     [ you're prompted for the password for user1]
   htpasswd /www/kira/secure/.htpasswd user2
   htpasswd /www/kira/secure/.htpasswd user3

Be sure to chmod these files (755, or readable by the web server), and now you're set.

Here is an example file using the above code to check for security. The username is "kira" and password is "blee1".

For more information and another tutorial, you may also want to consult the NCSA Mosaic User Authentication Tutorial.