Re: apache2.conf AuthType Basic
"Adam Mihai Gergely via users" <[email protected]> Wed, 11 Mar 2026 15:33:02 +0200
| Newsgroups | gmane.comp.apache.user |
|---|---|
| Message-ID | <[email protected]> |
--------------eWeBxOVmBJx6v0dfl0YnaWNV
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
People... Learn how to use AI (securely or with anonymous data),
seriously...
1. Does that path exist ?
2. Does the passwords file have the exact format a htpasswd file should
have ?
3. Did you restart apache2 if you modified the config file ?
4. Do you have user xxx in /etc/apache2/passwd/passwords defined
correctly with the correct form of the password ?...
I use this script for generating htpasswd conf files:
(of course, you need to adapt it to your paths)
compile.sh:
#!/bin/bash
# Path to your existing htpasswd file
HTPASSWD_FILE=/etc/apache2/htpwd/htpasswd
# Your source file with plain passwords
SRC=/etc/apache2/htpwd/src.txt
# Truncate existing file (empty it)
> "$HTPASSWD_FILE"
# Loop through your source file and add users/passwords
while IFS=: read -r user pass; do
# -b = use password from command line (non-interactive)
# -B = bcrypt (better security than SHA; but Apache must support)
# You can use -s for SHA1, but bcrypt (-B) is better if supported
htpasswd -bB "$HTPASSWD_FILE" "$user" "$pass"
done < "$SRC"
echo ""
echo "Restarting Apache..."
systemctl restart apache2
echo "... done !"
echo ""
I enter "username:password" in my src.txt and run this script.
It produces the entry with hashed password in htpasswd.
Then, I point my conf to that file:
<Directory "/path/to/secure/dir">
SSLRequireSSL
Options -Indexes +FollowSymLinks
AllowOverride None
AuthType Basic
AuthName "<> Red Authentication Required <>"
AuthBasicProvider file
AuthUserFile /etc/apache2/htpwd/htpasswd
Require user RedUser
ErrorDocument 401 /401.html
</Directory>
Ensure that this declaration is in a VirtualHost 443 or some form of SSL
! (HTTPS !)
Do NOT use this in non-https because it exposes your password as
plain-text. Someone on the network could sniff your password in certain
conditions.
Cu stima,
Adam Mihai Gergely
Informatician
www.infosky.ro
On 3/11/26 15:07, Egon Frerich wrote:
>
> I want to allow only user with password to see /gitweb. I put this
> into apache.conf:
>
> |<Directory /opt/gitweb> Options Indexes FollowSymLinks AllowOverride
> None #Require all granted AuthType Basic AuthName "flora"
> AuthBasicProvider file AuthUserFile "/etc/apache2/passwd/passwords"
> Require user xxx </Directory> |
>
> But could see gitweb without a password.
>
> What should I do?
>
> Egon
>
>
--------------eWeBxOVmBJx6v0dfl0YnaWNV
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>People... Learn how to use AI (securely or with anonymous data),
seriously...</p>
<p>1. Does that path exist ?<br>
2. Does the passwords file have the exact format a htpasswd file
should have ?<br>
3. Did you restart apache2 if you modified the config file ?<br>
4. Do you have user xxx in /etc/apache2/passwd/passwords defined
correctly with the correct form of the password ?...</p>
<p>I use this script for generating htpasswd conf files:<br>
(of course, you need to adapt it to your paths)</p>
<p>compile.sh:</p>
<p>#!/bin/bash<br>
<br>
# Path to your existing htpasswd file<br>
HTPASSWD_FILE=/etc/apache2/htpwd/htpasswd<br>
<br>
# Your source file with plain passwords<br>
SRC=/etc/apache2/htpwd/src.txt<br>
<br>
# Truncate existing file (empty it)<br>
> "$HTPASSWD_FILE"<br>
<br>
# Loop through your source file and add users/passwords<br>
while IFS=: read -r user pass; do<br>
# -b = use password from command line (non-interactive)<br>
# -B = bcrypt (better security than SHA; but Apache must
support)<br>
# You can use -s for SHA1, but bcrypt (-B) is better if
supported<br>
htpasswd -bB "$HTPASSWD_FILE" "$user" "$pass"<br>
done < "$SRC"<br>
echo ""<br>
echo "Restarting Apache..."<br>
systemctl restart apache2<br>
echo "... done !"<br>
echo ""</p>
<p>I enter <a class="moz-txt-link-rfc2396E" href="username:password">"username:password"</a> in my src.txt and run this script.<br>
It produces the entry with hashed password in htpasswd.</p>
<p>Then, I point my conf to that file:</p>
<p> <Directory "/path/to/secure/dir"><br>
SSLRequireSSL<br>
Options -Indexes +FollowSymLinks<br>
AllowOverride None<br>
<br>
AuthType Basic<br>
AuthName "<> Red Authentication Required <>"<br>
AuthBasicProvider file<br>
AuthUserFile /etc/apache2/htpwd/htpasswd<br>
Require user RedUser<br>
ErrorDocument 401 /401.html<br>
</Directory></p>
<p>Ensure that this declaration is in a VirtualHost 443 or some form
of SSL ! (HTTPS !)</p>
<p>Do NOT use this in non-https because it exposes your password as
plain-text. Someone on the network could sniff your password in
certain conditions.</p>
<pre class="moz-signature" cols="72">Cu stima,
Adam Mihai Gergely
Informatician
<a class="moz-txt-link-abbreviated" href="http://www.infosky.ro">www.infosky.ro</a></pre>
<div class="moz-cite-prefix">On 3/11/26 15:07, Egon Frerich wrote:<br>
</div>
<blockquote type="cite"
cite="mid:[email protected]">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<p>I want to allow only user with password to see /gitweb. I put
this into apache.conf:</p>
<pre><code><Directory /opt/gitweb>
Options Indexes FollowSymLinks
AllowOverride None
#Require all granted
AuthType Basic
AuthName "flora"
AuthBasicProvider file
AuthUserFile "/etc/apache2/passwd/passwords"
Require user xxx
</Directory>
</code></pre>
<p>But could see gitweb without a password.</p>
<p>What should I do?</p>
<p>Egon</p>
<p><br>
</p>
</blockquote>
</body>
</html>
--------------eWeBxOVmBJx6v0dfl0YnaWNV--