Access control on webpages

General info

Normally you cannot protect single files, [1] but you can protect a whole directory so everyone that wants to access a document or a sub directory in that directory will be asked for a username and password.

To do this you add a file called .htaccess in the directory you want to protect. In this file you need to specify which users shall have access and what password file the users shall have their password verified against. The password file is made with a program called htpasswd.

The web server must be able to read the content of the documents it is going to send out so these files needs to be set readable for everyone. This means that a password protected document is only protected through the web server. Other users can read the content of the documents by going directly into your public_html directory (and subdirectories). In other words the password protection is only valid for downloading through the webserver.

.htaccess

This file can be used in several different ways, amongst them, for access control on directories, or with cgi scripting.

If this file is gonna work everybody has to have read access to it. You can set that by typing the following in a terminal window[2]

chmod a+r .htaccess

Syntax in .htaccess:

To add access control you need to add the following lines in .htaccess (which you need to place in the directory you want to control). Also, if the file does not exist you need to create it first.

AuthUserFile /path/to/file/name.offile

path/to/file is the full path to the file you make with htpasswd The password file must be in your web directory. To be on the safe side you should specify the path to this file as /local/www.stud/users/user/passwordfile not /home/home??/??/user/public_html/passwordfile. (The last one only works if you have given other access to your home directory).

AuthGroupFile /path/to/file/name.ofafile

This line specifies what group password file which should be used. It can be /dev/null, representing nothing, but the line must be there.

AuthName NameOnPasswordPopUp

NameOnPasswordPopUp is the name on the dialog box that appears prompting you to type in your username/password

AuthType Basic

This must be included.

Limit GET POST

This line starts the list of all users that can access the directory. The list ends with

/Limit

In this list you need to have some lines for each user, which looks like this:

require user testuser

Testuser is the username for a user that you want to grant access. Every user needs to have a line like this and a password in the password file which matches the username. You can also use

require valid-user

Example of .htaccess:

Here is an example of a .hraccess file which opens a popup box named "Family photo album". The users testuser1 and testuser2 will be able to log in, and their passwords are verified against the file webpasswd which is in the directory /local/www.stud/users/user/webpasswd

			AuthUserFile /local/www.stud/users/bruker/webpasswd
			AuthGroupFile /dev/null
			AuthName "Family photo album"
			AuthType Basic
			<Limit GET POST>
			require user testuser1
			require user testuser2
			</Limit>
			

htpasswd

To create a password file that the web server can understand you need to use the program htpasswd in UNIX. This program encrypts the passwords and puts them in the password file. You should put the password file in its own directory to be able to set the right access settings for it. This directory must be readable for you and browse able for everyone else (use "chmod 701" etc described below). The file itself needs to be readable for the web server (use "chmod o+r file"), and the home directory needs to be accessible for the web server (use "chmod o+x ~/.").

NB! The password on the webserver is transmitted unencrypted so DO NOT use the same password as you generally use.

htpasswd is used this way:

htpasswd name-on-passwordfile username

name-on-passwordfile is the name and path to your password file, the username is the name on the user you want to add.

To make a new password file user the option -c like this:

htpasswd -c name-on-passwordfile username

When you now start htpasswd the program will ask for the password to the user twice and then encrypt it to the file. Every user which you want to have access to the protected directory needs to have a password in the password file. All users are added the same way.

Example:

Based on .htaccess which is described above.
cd ~/public_html - browsing to the web directory
mkdir etc - makes a directory for the password file
chmod 701 etc - sets the permissions for the password file directory
htpasswd -c etc/webpasswd testuser1 - Makes the password file and adds the user testuser1.
chmod o+r etc/webpasswd - sets the right permissions to the file