A .htaccess file (pronounced ‘dot aitch tee access’ or simply ‘aitch tee access’) is aspecial configuration file used on web servers running the Apache httpd web server software. When someone visits a page that is sitting in a directory alongside, or in the same branch as, a .htaccess file then that configuration file will be loaded by the server and processed.
.htaccess files are used to reconfigure the web server without needing to restart it. These files can be used to enable or disable additional functionality and features, such as creating redirects, disabling directory listings and password protecting directories.
AuthType Basic AuthName "Restricted access" AuthUserFile /home/USERNAME/.htpasswd require valid-user
If you want to password protect some of your web pages, then you need to use a .htaccess file with a .htpasswd password file. This tutorial will tell you step-by-step what you need to do.
Step By Step Instructions
Let's suppose you want to restrict files in a directory called members to username memberone with password memberonepassword. Here's what to do:
1. Create a file called .htaccess in directory members that looks like this:
- In the AuthUserFile line, replace USERNAME with your ftp username.
- The .htaccess file must be an ASCII text document.
- A .htaccess file can be created in any word processor but must be saved as text only.
- IF you upload your .htaccess file via FTP, the FTP client must be set to ASCII mode for transfer.
- For security reasons, the .htaccess file on the server cannot be seen in a directory listing. If you don't see it after uploading it, don't worry.
Also note that AuthName can be anything you want. The AuthName field gives the Realm name for which the protection is provided. This name is usually given when a browser prompts for a password, and is also usually used by a browser in correlation with the URL to save the password information you enter so that it can authenticate automatically on the next challenge.
2. Use the htpasswd command, from your home directory, to create a password file called .htpasswd in your home directory:
SSH to your home directory. This is simply done by connecting with your SSH client and NOT entering any path, and NOT changing directories after connecting. After connecting to your home directory via SSH, enter:
# htpasswd -c .htpasswd memberone
Type the password -- memberonepassword -- twice as instructed.
# htpasswd .htpasswd membertwo New password: Re-type new password: Adding password for user membertwo
3. That's the setup done. Now test by trying to access a file in the directory members; your browser should demand a username and password, and not give you access to the file if you don't enter memberone and memberonepassword.
If you want to give access to a directory to more than one username/password pair, follow the steps above to create the .htaccess file and to create the .htpasswd file with one user. Then, add additional users to the .htpasswd file by using the htpasswd command without the -c:
If you want to change the password for an existing user, simply issue the same command as when you added the user. You will then be prompted for a new password. For example, if the user membertwo already exists and you want to change the password, just SSH to your home directory and enter:
# htpasswd .htpasswd membertwo
AuthType Basic AuthName "Restricted access" AuthUserFile /home/USERNAME/.htpasswd.members require valid-user AuthType Basic AuthName "Restricted access" AuthUserFile /home/USERNAME/.htpasswd.admins require valid-user AuthType Basic AuthName "Restricted access" AuthUserFile /home/USERNAME/.htpasswd.board require valid-user
Password Protecting Multiple Directories
If you want to password protect multiple directories, and allow all users access to all password protected directories, then all you need to do is put the same .htaccess file in each directory that you want to password protect.
However, if you want to password protect multiple directories, and only allow certain users access to each directory, then you can create a different password file (all in your home directory) for each password protected directory.
Let's say you have 3 different directories (members, admins, board) you want password protected, and each one has a different set of users that you want to allow access. Then just do the following:
Create three .htaccess files and put them in their appropriate directory:
Remember to replace USERNAME with your ftp username (in lower case).
# htpasswd -c .htpasswd.members memberone # htpasswd -c .htpasswd.admins adminone # htpasswd -c .htpasswd.board boardmemberone
Create three .htpasswd files in your home directory:
That's it. Now when you need to add a user to one of the directories, just issue the htpasswd command on the appropriate .htpasswd file.