The FreeBSD Diary

NOTE: You will need at least AllowOverride AuthConfig on the directory you are trying to protect.

e.g.:

<Directory "/path/to/protected/directory">
        AllowOverride AuthConfig
</Directory>

The above goes into the section of your apache configuration file (either http.conf or apache.conf depending on your installation) for the website in question.   Something like this:

<VirtualHost    192.168.0.78>
.
.
.
        <Directory "/path/to/protected/directory">
                AllowOverride AuthConfig
        </Directory>
.
.
.                
</VirtualHost>
    

See also the bit about symlinks.

The first step is creating a password file.  Your website may already have one.  You might want to use that.  The -c option creates a new file and deletes it if it exists.  I was lucky and it was already on my machine.   However, I've seen many messages in the mailing list which showed that some people were having trouble creating it.  I will eventually find out how to install this program.  I found mine at:

/usr/local/bin/htpasswd

Here's how I added dan as a user.  You may have to supply the full path name as shown above.  You can always issue a locate htpasswd to find it.

$ htpasswd -c httpd_access dan
Adding password for dan.
New password:
Re-type new password:

The above creates a file httpd_access.  Within that file you will find something like this:

dan:BI130i2ltIkAz

This contains the encrypted password I entered above (don't bother trying to crack it, I made that string up).  The contents of this file needs to be added to the AuthUserFile as indicated by .htaccess.  See the next section for more information.

# -FrontPage-

IndexIgnore .*
AuthName protectthis
AuthUserFile  /home/susan/public_html/_vti_pvt/service.pwd
AuthGroupFile /home/susan/public_html/_vti_pvt/service.grp
AuthType Basic
<Limit GET>
    require user susan
</Limit>

With the above configuration, only susan can get access to this directory.  You an also use groups or just all any user.  The following statement would allow any valid user access to the directory.

require valid-user

You also need the service.pwd and service.grp files.  Here are some examples (again, I made up these encrypted passwords):

If you are adding a new user, as in the previous section, you can just add the output from htpasswd to the end of service.pwd.

For more information on this type of configuration, please try the following resources within the Apache manual.  Particularly the Run-time configuration directives.

Internal Server Error

The server encountered an internal error or misconfiguration
and was unable to complete your request.

Please contact the server administrator, dan@rock.ghis.net
and inform them of the time the error occurred, and anything
you might have done that may have caused the error.

More information about this error may be available in the 
server error log.

Apache/1.3.9 Server at myhost.mydomain.org Port 80

But I found no help in neither my access logs nor my error logs.  Eventually I read the manual entry for require and discovered that my .htaccess file did not have an AuthType directive.  I added that in and all was well.

See also the symlink issues in the next section.

28 March 2000 - This seems to be a good resource for this topic: http://kb.indiana.edu/data/abeq.html?cust=2008