Killersites.com Homepage Welcome Guest   |   Register  |  Login
Login Name Password
  Search  
  Index  | Recent Threads  | Unanswered Threads  | Who's Online  | User List  | Help


  Killersites.com Forum
  Category: General Web Design
  Forum: Killer Web Design Tips, Secrets and Techniques.
  Thread: Password Protecting Web Server Directories - Apache Only

Quick Go »

No member browsing this thread
Thread Status: Active
Thread Type: Sticky Thread
Total posts in this thread: 21
Posts: 21   Pages: 3   [ 1 2 3 | Next Page ]
[ Jump to Last Post ]
Post new Thread
Author
Previous Thread This topic has been viewed 12312 times and has 20 replies Next Thread
Male shelfimage
Advanced Member
Member's Avatar

USA
Joined: Mar 24, 2005
Post Count: 3000
Status: Offline
Reply to this Post  Reply with Quote 
smile Password Protecting Web Server Directories - Apache Only
Password Protection using .htaccess and Apache Servers. cool

You may recgonize this type of protection as the log on box that looks like this:

If you don't pass authentication, you'll see a 401 error.

Note: there are other methods to create password protection using .htaccess that require one less file. I feel the the method I use provides one more layer of protection. The server will first check for authorized "agents" or users before checking to see if the user's password is vaild.


Tools:


We will create 3 files: .htaccess; .htgroup; .htpasswd. When saved on the server, the default CHMOD value of 644 should be kept.

Steps:

  • Decide to EDIT or CREATE your .htaccess file - it will be in the directory that you want to PROTECT (only 1 per directory).

  • Open your text editor and enter the following lines:

    AuthType Basic
    AuthName "This is the message you will see in the Log on Box - - EDIT THIS to your Liking, for example, Authorized Users only::Log in Below."
    AuthUserFile /.htpasswd
    AuthGroupFile /.htgroup

    <Limit GET>
    require group agents
    </Limit>


  • Save as " .htaccess " *if your text editor does not allow this, save as htaccess.txt. We will change on the web server later.
  • Create a new (blank) text document. This will be Groups file with the authorized Agents list.
  • Add the line:

    agents:

    And create your authorized Agents.
    For example,
    agents: admin user guest shelfimage

    Notice that the agents are separated by ONE space and there is no punctuation at all. Also, no Line Returns.

  • Save as .htgroup, or htgroup.txt.


  • Next, you will create the Passwords file. This involves both your authorized agents and the website link given earlier.

  • Open another blank/new text document. We will paste the results of http://www.inch.com/info/tech/faqs/htaccess/htaccess.php into this file.
  • Go to the Link Above and enter in each Agent as the User Name. This is CASE SENSITIVE and must be the same as your .htgroup file.

  • Choose a password and enter it where indicated. Press OK.

  • In the next window, copy and paste the results in your open text document. Repeat for each Agent. The file might look like:

    admin://aqbwuSyyw2s
    user://Y/HCTIPpX/g
    guest:A.nQYk46zNQko
    shelfimage:0.KHcaRGaBefk

    No punctuation. User name and password combos are separated by one line.

  • SUGGESTION: Record both the encrypted and unencrypted user name and password for your files - but do not upload to you web server.
  • When completed, save the file as .htpasswd or htpasswd.txt.


  • Upload all 3 files via FTP to your server placing the .htaccess in the directory that should be protected. The .htgroup and .htpasswd should be placed in the ROOT directory (sometimes called public)_html, html, or www).

  • Finally, if the files could not be named correctly on your computer, rename them on your server.


TEST, TEST, and TEST again. Post any question and I'll be happy to help. PM or IM anything that might be specific to your site regarding this subject please because this board is public...


-
----------------------------------------
"The art of life lies in a constant readjustment to our surroundings." -Okakura Kakuzo
Save the developers<!>
Maine Webworks
----------------------------------------
[Edit 1 times, last edit by shelfimage at Oct 4, 2005 6:19:49 PM]
[Oct 4, 2005 6:01:52 PM] Show Printable Version of Post    View Member Profile    Send Private Message    mainewebworks    mainewebworks [Link] Report threatening or abusive post: please login first  Go to top 
Male Meet
Newbie
Member's Avatar

India
Joined: Oct 4, 2005
Post Count: 43
Status: Offline
Reply to this Post  Reply with Quote 
Re: Password Protecting Web Server Directories - Apache Only
I was wondering if there is any other way to implement password protection on IIS. thinking
----------------------------------------
Regards,
--------------------
Amit Choudhary
[Oct 7, 2005 2:08:03 AM] Show Printable Version of Post    View Member Profile    Send Private Message [Link] Report threatening or abusive post: please login first  Go to top 
Male shelfimage
Advanced Member
Member's Avatar

USA
Joined: Mar 24, 2005
Post Count: 3000
Status: Offline
Reply to this Post  Reply with Quote 
Re: Password Protecting Web Server Directories - Apache Only
I only know about local authentication on window based systems and intranets... But I'm fairly certain it can be done via FrontPage.

I found some links though for you:

http://www.msfrontpage.net/fp/protect.htm
http://www.powerasp.com/content/code-snippets/advanced-password-protection.asp
http://www.topshareware.com/IISPassword-download-14007.htm

I didn't read any of them, just bookmarked for later use....

-
----------------------------------------
"The art of life lies in a constant readjustment to our surroundings." -Okakura Kakuzo
Save the developers<!>
Maine Webworks
[Oct 7, 2005 9:14:26 AM] Show Printable Version of Post    View Member Profile    Send Private Message    mainewebworks    mainewebworks [Link] Report threatening or abusive post: please login first  Go to top 
Male admin
Advanced Member
Member's Avatar


Joined: Jun 14, 2003
Post Count: 2933
Status: Offline
Reply to this Post  Reply with Quote 
Re: Password Protecting Web Server Directories - Apache Only
Good post shelfimage.
----------------------------------------
Stefan Mischook

Video Tutorial Store | Web Templates
[Oct 7, 2005 10:11:18 AM] Show Printable Version of Post    View Member Profile    Send Private Message [Link] Report threatening or abusive post: please login first  Go to top 
Male admin
Advanced Member
Member's Avatar


Joined: Jun 14, 2003
Post Count: 2933
Status: Offline
Reply to this Post  Reply with Quote 
Re: Password Protecting Web Server Directories - Apache Only
@Meet,

Authentication and protecting directories on IIS is tied into the operating system - Windows. When I ran my Windows 2000 servers, I would protect directories via the OS.

That would be a problem if your just renting space on a Win2k server since I doubt you would have admin access!

I think you can do this via FrontPage extensions - BTW FP extensions are server components that don't require that you use FrontPage to use them ...
----------------------------------------
Stefan Mischook

Video Tutorial Store | Web Templates
[Oct 7, 2005 10:15:09 AM] Show Printable Version of Post    View Member Profile    Send Private Message [Link] Report threatening or abusive post: please login first  Go to top 
Male shelfimage
Advanced Member
Member's Avatar

USA
Joined: Mar 24, 2005
Post Count: 3000
Status: Offline
Reply to this Post  Reply with Quote 
Re: Password Protecting Web Server Directories - Apache Only
UPDATE**
Two small but important details to consider when using this method should be explained. Thank-you Susie biggrin.

First.
We learned that the .htaccess file needs to include the full path to server when pointing to the files.

Details:
Reference Step #2 above:
Open your text editor and enter the following lines:

AuthType Basic
AuthName "This is the message you will see in the Log on Box - - EDIT THIS to your Liking, for example, Authorized Users only::Log in Below."
AuthUserFile /.htpasswd
AuthGroupFile /.htgroup

<Limit GET>
require group agents
</Limit>
In some case, the lines in bold above will have to be written differently so the server can locate .htpasswd and .htgroup.

AuthUserFile /full/path/to server/.htpasswd
AuthGroupFile /full/path/to server/.htgroup

replacing /full/path/to server/ with your server's path. This is not the www address of your website. It is often the path to Perl or somethimes the cg-bin. It is where your account resides on your shared hosting plan.


Examples would be:

AuthUserFile /vws/UserName/public_html/.htpasswd
AuthGroupFile /vws/UserName/public_html/.htgroup

AuthGroupFile /home/UserName/www/.htgroup
AuthGroupFile /home/UserName/www/.htpasswd


Second.
FrontPage will rewrite your .htaccess file when FP Extensions are installed and when Extensions are uninstalled.

Also, there may or may not be a conflict between FP extensions on an Apache based server and .htacess using this method.

So test again after making any changes to your server. wink


Does anyone have more information to share about FP and .htaccess usage? confused


Here are some links about password protection using FP 2003:

http://support.microsoft.com/default.aspx?scid=kb;en-us;825498

http://www.frontpagetalk.com/forums/How_to_Pa..._1/tmode_1/smode_1/tm.htm

http://www.msfrontpage.net/fp/protect.htm

Enjoy! smile
----------------------------------------
"The art of life lies in a constant readjustment to our surroundings." -Okakura Kakuzo
Save the developers<!>
Maine Webworks
[May 1, 2006 8:16:48 PM] Show Printable Version of Post    View Member Profile    Send Private Message    mainewebworks    mainewebworks [Link] Report threatening or abusive post: please login first  Go to top 
Male Gameacholic908
Newbie




Joined: Apr 26, 2006
Post Count: 20
Status: Offline
Reply to this Post  Reply with Quote 
Re: Password Protecting Web Server Directories - Apache Only
He shelfimage, nice tutorial and I need this really bad at the moment. I was going to do this tutorial until I found out that your links were dead... Is there anything anyone can do about it?
[May 10, 2006 11:00:28 PM] Show Printable Version of Post    View Member Profile    Send Private Message    Hidden to Guest [Link] Report threatening or abusive post: please login first  Go to top 
Male billyboy
Advanced Member
Member's Avatar


Joined: Sep 3, 2005
Post Count: 2206
Status: Offline
Reply to this Post  Reply with Quote 
Re: Password Protecting Web Server Directories - Apache Only
Links work fine for me.
----------------------------------------
Quiquid latine dictum sit altum viditur
[May 10, 2006 11:12:59 PM] Show Printable Version of Post    View Member Profile    Send Private Message [Link] Report threatening or abusive post: please login first  Go to top 
Male shelfimage
Advanced Member
Member's Avatar

USA
Joined: Mar 24, 2005
Post Count: 3000
Status: Offline
Reply to this Post  Reply with Quote 
Re: Password Protecting Web Server Directories - Apache Only
He shelfimage, nice tutorial and I need this really bad at the moment. I was going to do this tutorial until I found out that your links were dead... Is there anything anyone can do about it?


hmm, which links?
----------------------------------------
"The art of life lies in a constant readjustment to our surroundings." -Okakura Kakuzo
Save the developers<!>
Maine Webworks
[May 11, 2006 10:27:56 PM] Show Printable Version of Post    View Member Profile    Send Private Message    mainewebworks    mainewebworks [Link] Report threatening or abusive post: please login first  Go to top 
Male Gameacholic908
Newbie




Joined: Apr 26, 2006
Post Count: 20
Status: Offline
Reply to this Post  Reply with Quote 
Re: Password Protecting Web Server Directories - Apache Only
http://www.inch.com/info/tech/faqs/htaccess/htaccess.php

http://www.inch.com/info/tech/faqs/htaccess/htaccess.php

In your first post
[May 13, 2006 10:03:16 PM] Show Printable Version of Post    View Member Profile    Send Private Message    Hidden to Guest [Link] Report threatening or abusive post: please login first  Go to top 
Posts: 21   Pages: 3   [ 1 2 3 | Next Page ]
[ Jump to Last Post ]
Show Printable Version of Thread  Post new Thread

RSS feeds Current timezone is GMT
Mar 22, 2010 8:48:24 AM

Powered by mvnForum 1.2.1 GA (Build: 20 November 2008)
Copyright © 2002-2008 by MyVietnam.net