Posts Tagged ‘htpasswd’
Saturday, August 21st, 2010 
In my previous post I've blogged how to install and configure Trac on Debian
The next logical question for me was how to use trac with multiple user accounts.
Thanksfully this happened to be very easy. All I had to do to setup different trac users was to add different Apache htaccess authentication accounts.
Consequently you will be logged in in Trac's interface after you login with your Apache htaccess user and password with the same user as provided in the Apache authentication dialog.
Of course to create the required Trac login accounts, you need to first have setup an Apache AuthType Basic declaration.
For example you will have to add something similar to:
<Location "/">
AuthType Basic
AuthName "Trac - projects"
AuthUserFile /etc/apache2/trac.passwd
Require valid-user
</Location>
your Apache virtualhost or domain configuration file.
In order to add the two users user1 and user2 then I simply had to add the users with the htpasswd Apache password tool.
debian:~# htpasswd -c /etc/apache2/trac.passwd user1
debian:~# htpasswd -c /etc/apache2/trac.passwd user2
Thanks God this was easy 🙂
Tags: apache, apache authentication, apache htaccess, apache password, apache virtualhost, apache2, authentication dialog, AuthType, AuthUserFile, configuration file, configure, course, dialog, domain, domain configuration, file, god, How to, How to add/create user accounts to be used with Trac (issue tracking system) on Linux, htaccess authentication, htpasswd, interface, issue, Linux, logical question, login, lt, order, passwd, password, password tool, question, quot, setup, something, system, Thanksfully, tool, trac, user accounts, Virtualhost
Posted in Linux, System Administration, Web and CMS | No Comments »
Tuesday, December 2nd, 2014 
If you're migrating a website from Apache Webserver to Nginx to boost performance and better Utilize your servers hardware and the websites (Virtualhosts) has sections with implemented Apache .htaccess / .htaccess password authentication, you will have to migrate also Apache directory password protection to Nginx.
This is not a hard task as NginX's password protection uses same password format as Apache and Nginx password protection files are generated with standard htpasswd part of apache2-utils package (on Debian / Ubuntu servers) and httpd-tools on CentOS / Fedora / RHEL. If you're migrating the Apache websites to Nginx on a fresh new installed server and website developers are missing htpasswd tool to install it depending on Linux distro:
On Debian / Ubuntu deb based servers, install htpasswd with:
apt-get install –yes apache2-utils
…
On CentOS / Fedora … other RPM based servers:
yum -y install httpd-tools
…
Once installed if you need to protect new section site still being in development with password with Nginx, do it as usual with htpasswd
htpasswd -c /home/site/nginx-websitecom/.htpaswd admin
Note that if .htpasswd file has already exist and has other user records, to not overwritted multiple users / passes and let all users in file login to Nginx HTTP auth with separate passwords, do:
htpasswd /var/www/nginx-websietcom/.htpasswd elijah
Now open config file of Nginx Vhost and modify it to include configuration like this:
server {
listen 80;
server_name www.nginx-website.com nginx-website.com;
root /var/www/www.nginx-website.com/www;
[…]
location /test {
auth_basic "Restricted";
auth_basic_user_file /var/www/www.example.com/.htpasswd;
}
[…]
}
Do it for as many Vhosts as you have and to make the new settings take affect restart Nginx:
/etc/init.d/nginx restart
Enjoy 🙂
Tags: com, file, htpasswd, HTTP, passwords, protection, servers, var, website, www
Posted in Linux, Nginx, Various, Web and CMS | 3 Comments »
Thursday, December 2nd, 2010 It’s actually very easy in order to enable this authentication via your website VirtualHost find the;
<Directory /var/www/yourwebsite>
....
</Directory>
Substitute the /var/www/yourwebsite with your correct website location in between the opening and closing Directory apache directive place something similar to the following lines:
AllowOverride All
AuthName “Add your login message here.”
AuthType Basic
AuthUserFile /etc/apache2/.htpasswd
AuthGroupFile /dev/null
require user name-of-user
Eventually your Directory directive in your let’s say /etc/apache2/apache2.conf should look something like the example in below
<Directory /var/www/yourwebsite>
AllowOverride All
AuthName "Add your login message here."
AuthType Basic
AuthUserFile /etc/apache2/.htpasswd
AuthGroupFile /dev/null
require user name-of-user
</Directory>
Of course in this example you need to set the name-of-user to an actual user name let’s say you want your login user to be admin, then substitute the name-of-user with admin
Of course set the desirable location for your .htpasswd in the AuthUserFile. Just in case if you decide to keep the same location as in my example you will further need to create the /etc/apache2/.htpasswd file.
Note here that in the above exapmle the AllowOverride All could also be substituted for AllowOverride AuthConfig , you might need to put this one if you don’t want that all .htaccess directives are recognized by Apache.
To create the .htpasswd issue the command:
debian~:# htpasswd -c /etc/apache2/.htpasswd admin
New password:
Re-type new password:
In the passwords prompts just type in your password of choice. Now we’re almost ready to have the website apache authentication working, only thing left is to reastart Apache.
I’m using Debian so restarting my apache is done via:
debian:~# /etc/init.d/apache2 restart
In other Linux distributions exec the respective script for Apache restart.
Now access your website and the password protection dialog asking for your credentials to login should popup.
Tags: Allowoverride, apache authentication, apache configuration, AuthConfig, AuthType, AuthUserFile, course, desirable location, directive, file, How to secure site with htpassword using Apache configuration instead of through external .htaccess file, htpasswd, init, Linux, location, login, login user, lt, opening, password, passwords, place, protection, quot, script, something, type, Virtualhost, website location, working
Posted in Linux, System Administration, Web and CMS | No Comments »
Thursday, October 27th, 2011 I just installed munin to track in web the performance of few Debian servers. I’ve configured munin to open via a Virtualhosts in Apache. As its always wise to protect any statistics data about the server from the unwanted possible security violators, I decided to protect Munin with Apache .htaccess.
The munin htmldir output dir is configured to be in /var/www/munin, hence I protected my munin with password by:
1. Creating .htaccess file in /var/www/munin with following content
AuthUserFile /etc/apache2/.munin_htpasswd
AuthGroupFile /dev/null
AuthName EnterPassword
AuthType Basic
require user admin
2. Creating /etc/apache2/.munin_htpasswd with htpasswd (htaccess password generator cmd)
debian:/var/www/munin# htpasswd -c /etc/apache2/.munin_htpasswd admin
New password:
Re-type new password:
Adding password for user admin
Another important thing I had to do is set my VirtualHost file to be configured with AllowOverride All , if AllowOverride All is missing the .htaccess and .htpasswd are not red at all.
Afterwards munin is protected with password, and when my virtualdomain where munin lays e.g. http://munin.mydomain.com is accessed the .htpasswd password dialog pops up 😉
Tags: Allowoverride, apache, apache htaccess, AuthGroupFile, AuthType, AuthUserFile, Creating, data, dev, dialog, dir, EnterPassword, generator, GNU, htaccess password generator, htpasswd, Linux, null, password, performance, pops, security, servers, statistics data, var, Virtualhost, web statistics, www
Posted in Linux, System Administration, Web and CMS | No Comments »
Sunday, April 11th, 2010 I have a running awstats installation and needed a way to protect the cgi-bin statistics with a password. Thanksfully there is a way to achieve that through the Apache. To secure your let’s say awstats.pl or any other /cgi-bin/ executable with a password here is what you need to do:
First make sure you have:
Allowoverride All directive enabled in your Apache Directory permissions for the /cgi-bin/.
Next you will need to create an .htaccess file in your /cgi-bin/ directory .The file should contain something close to:
<FilesMatch "awstats.pl">AuthName "Login Required"
AuthType Basic
AuthUserFile /var/www/awstats/.htpasswd
require valid-user
</FilesMatch>
The above example presumes that you have created the .htpasswd in /var/www/awstats/.
To create this file issue the command:
debian:~# htpasswd -c /var/www/awstats/.htpasswd admin
That’s all now your awstats installation or any other executable specified in FileMatch would be created with a password.
Tags: Allowoverride, apache, AuthType, AuthUserFile, awstats, cgi bin directory, command, directive, directory permissions, file, htaccess file, htpasswd, installation, issue, login, lt, password, Password Protecting single file with htaccess password / Securing single exetubale in Apache with password through htaccess, pl, Protecting, quot, Securing, single file, something, statistics, Thanksfully, var, way, www
Posted in Linux, System Administration, Web and CMS | No Comments »
