Configuring mod_auth in Apache
Configuring Apache's mod_auth module is fairly easy
and straightforward. First you'll need to create the
file that will store usernames and passwords for
everyone who will have access to your site (sometimes
called the credentials database). Do this by running
the program htpasswd, supplied in the support
directory of Apache. If it has not already been built,
check your Apache documentation for instructions on
how to compile it.
In this example, we'll add a user named "paul" to the system and store the information in the file /usr/local/etc/httpd/users:
htpasswd -c /usr/local/etc/httpd/users paul
Note that here we're using the -c argument, which
tells htpasswd to create a new credentials database.
Other users may be added in the same way, except that
the -c argument should not be used once the file
exists.
After running this command, you'll be prompted twice to enter a new password for user "paul". The program can also be used to modify the password of an existing user.
After adding a few users, /usr/local/etc/httpd/users might look something like:
paul:WrU808BHQai33 joan:iABCQFQs4032M jason:Fdf3N3W753sSU
The first field is the username, and the second field is the encrypted password.
Next, create a file named .htaccess in the directory to which access will be restricted. The directives in this file will describe the access controls you want imposed. Those same controls will automatically apply to any subdirectories beneath it as well, unless one of those subdirectories contains its own .htaccess file.
A sample .htaccess file might look something like this:
AuthName "restricted information" AuthType Basic AuthUserFile /usr/local/etc/httpd/users require valid-user
The first directive, AuthName, specifies a name for
the realm that is being protected. Once a user has
been authenticated, all resources within the realm can
be accessed.
AuthType specifies what type of HTTP authentication
protocol to use. Typically there are two options:
Basic and Digest (see article for more details).
AuthUserFile tells Apache where to find the
credentials database (the file you created using
htpasswd).
The final directive tells the server which usernames are allowed access to the protected realm. By specifying valid-user here, we're saying that any user found in the credentials database should be given access. You can restrict access to fewer individuals by specifying their usernames as part of the require directive. For example:
require paul, joan
This would allow only users paul and joan to access the protected realm.
You will also want to make sure that the .htaccess file is hidden from Web clients. The following entry in the httpd.conf file will guarantee this:
<code>
<Files ~ "^\.ht">
Order allow,deny
Deny from all
<Files>
</code>
This will also prevent .htpasswd files from being seen by Web clients. Most Apache distributions come preconfigured in this way.
--PS
