Follow us on Twitter!
Hacking isn't just Computers & Exploits. It's a Philosophy. - Mr_Cheese
Thursday, April 24, 2014
Navigation
Home
HellBoundHackers Main:
HellBoundHackers Find:
HellBoundHackers Information:
Learn
Communicate
Submit
Shop
Challenges
HellBoundHackers Exploit:
HellBoundHackers Programming:
HellBoundHackers Think:
HellBoundHackers Track:
HellBoundHackers Patch:
HellBoundHackers Other:
HellBoundHackers Need Help?
Other
Members Online
Total Online: 34
Guests Online: 28
Members Online: 6

Registered Members: 82903
Newest Member: Piriformis
Latest Articles

How to password protect your site using htaccess

Arrow Image As the title says.



Htaccess can be used to password-protect directories on your web site. All files and any subdirectories within a directory protected by htaccess will also be protected. So, if you wish to protect your entire web site, simply setup htaccess in your public_html directory (the root of your web site). However, if you only wish to protect certain directories, you may do so separately.
1. Change to the directory that you wish to protect

In the following example we wish to protect a directory called private in our public_html directory.

torch: ~$ cd public_html/private
torch: ~/public_html/private$

You also need to know the fully qualified path of the directory you wish to protect. So, from this directory, type pwd and remember the fully qualified path (you will need it in step 4).

torch: ~/public_html/private$ pwd
/users/cs/johndoe/public_html/private
torch: ~/public_html/private$

In the above example, the fully qualified path is /users/cs/johndoe/public_html/private.

The remaining steps in this guide assume we are still in this directory.
2. Create a file named .htaccess

Use your favourite editor to create a file called .htaccess (note the period at the beginning of the filename). In the below example we will use pico.

torch: ~/public_html/private$ pico .htaccess

3. Add the appropriate lines to the .htaccess file.

Using the editor you chose in step 2, input the following. You will need to modify the first 2 lines to match your configuration (see modifications below).

AuthUserFile /users/cs/johndoe/public_html/private/.htpasswd
AuthName \"Title for Protected Site\"
AuthType Basic
Require valid-user

Modifications:

1. Beside AuthUserFile, put the fully qualified path you obtained in Step 1, with /.htpasswd immediately following it. The above example shows /users/cs/johndoe/public_html/private/.htpasswd
2. Beside AuthName, input the words or phrase that you wish to appear as the title for the username/password input box. An image of what this looks like can be seen below.

HTAccess Password prompt box showing title placement
4. Create the .htpasswd file by adding users

Next use the htpasswd command to create your password file and username/password pairs:

torch: ~/public_html/private$ htpasswd -c .htpasswd bob
New password:
Re-type new password:
Adding password for user bob
torch: ~/public_html/private$

This creates the .htpasswd file and the username bob. You will then be prompted for a password for bob, which will be stored in the .htpasswd file (note that it will be encrypted in this file for security).

So, to create new users and change the password for existing users, switch to the protected directory you wish to add a user for, and type htpasswd -c .htpasswd username

torch: ~$ cd public_html/private
torch: ~/public_html/private$ htpasswd -c .htpasswd username

5. Set the permissions on your .htaccess and .htpasswd file

Finally, from within your protected directory, make both the .htaccess and .htpasswd files world-readable. You can do this with the command chmod a+r .htaccess .htpasswd.

torch: ~/public_html/private$ ls -al
total 10
drwxr-xr-x 2 johndoe csugrad 512 Jan 7 14:30 .
drwxr-xr-x 8 johndoe csugrad 512 Jan 7 11:50 ..
-rw------- 1 johndoe csugrad 156 Jan 7 12:05 .htaccess
-rw------- 1 johndoe csugrad 18 Jan 7 11:59 .htpasswd
torch: ~/public_html/private$ chmod a+r .htaccess .htpasswd
torch: ~/public_html/private$ ls -al
drwxr-xr-x 2 johndoe csugrad 512 Jan 7 14:30 .
drwxr-xr-x 8 johndoe csugrad 512 Jan 7 11:50 ..
-rw-r--r-- 1 johndoe csugrad 156 Jan 7 12:05 .htaccess
-rw-r--r-- 1 johndoe csugrad 18 Jan 7 11:59 .htpasswd
torch: ~/public_html/private$

Above we can see that the permissions on .htaccess and .htpasswd change from -rw------- to -rw-r--r--.
All done!

Now, anytime you attempt to view your protected directory, any file within it, or recursively any subdirectory of it, you will be prompted for a username and password. Please refer back to Step 4 if you wish to add more users or change a user\'s password.
Troubleshooting / Common Problems

Below are the most common problems experienced by users attempting to setup htaccess.

1. Permissions on both .htaccess and .htpasswd - Both the .htaccess and .htpasswd files need to be world readable. Please refer to Step 5 to ensure this has been done properly.
2. Fully qualified path to .htpasswd incorrect - The correct fully qualified path to a valid .htpasswd file must appear beside AuthUserFile in the .htaccess file. Please refer to Step 3 and verify this is correct.
3. The username doesn\'t exist in .htpasswd - When attempting to login as a user, they need to have been correctly added to the .htpasswd file using the htpasswd command. Please refer to Step 4 to double-check.

How do I remove htaccess protection?

To remove htaccess protection, simply delete or rename the .htaccess file in the directory you wish to remove protection from. The below example shows how to rename .htaccess to .htaccess-old.

torch: ~/public_html/private$ mv .htaccess .htaccess-old

Security Concerns
Should I be using .htaccess to protect highly sensitive data?

If you decide to protect something using .htaccess, be sure to understand one thing: the protection of your data relies upon the web server configuration. This means if the configuration changes, it might be possible for someone to retreive your data. As a general rule, it\'s bad practice to place anything highly confidential or critical on a web server, period. There are numerous other options for storing and accessing sensitive data. Always remember, the web was originally designed for public access, and so access control is really an addition.
Username/Password Transmission

If the page you are protecting is http and not secure http, then your username and password will be sent across the network in plain text. A secure http address is always prefixed with https:// instead of http://. If you are accessing any site through http://, you should be aware that it is possible for someone to capture your traffic and extract your password. A good guideline to follow is ensuring that all htaccess passwords do not correspond with any other passwords. Do not forget that you are solely responsible for keeping your password private.
Note

If you\'re looking to implement this on your own web server, then you should bypass htaccess altogether and simply enter the commands into the httpd.conf (apache configuration) file and specify which directories to which this should apply. The commands that are valid within htaccess are also valid in your apache configuration file. Putting it in the apache configuration helps to speed things up and simplifies web server management.

All credit goes to: http://www.cs.dal.ca/studentservices/faq/tutorials/web_sites/htaccess.shtml

Comments

bigggnickon April 10 2007 - 01:50:00
http://www.cs.dal. . .cess.shtml exactly the same
bigggnickon April 10 2007 - 01:51:11
o- sorry didnt realize you credited it in the end. i just dont like it when articles are simply copied and pasted. its just annoying.
minermonkon April 10 2007 - 01:59:55
very informative, i can see myself using this page as a reference in the future
mikispagon April 10 2007 - 13:36:26
Rated Good Grin
Zephyr_Pureon April 29 2007 - 01:03:08
Yeah, kinda defeats the purpose of getting points / credit for an article... could've at least changed the example command lines. Write an original article.
Post Comment

Sorry.

You must have completed the challenge Basic 1 and have 100 points or more, to be able to post.