Password-protect your site

Again, this has been done -- better -- by others. But I've recently been asked by the head of our IT division to put up the statistics on internet usage as generated by SARG in a protected directory on the website, and I have to do some quick-and-dirty stuff. This is for *my* documentation purposes only. YMMV.

1. Create the directory, e.g. /var/www/html/reports.


2. In httpd.conf, add the following directives:
   
   
   Alias /reports /var/www/html/reports
   
   <Directory /var/www/html/reports>
   
      AllowOverride All
   
      DirectoryIndex index.html
   
   </Directory>
   
   
   
   

   This lets the local .htaccess to override the global directives.




3. Inside the /var/www/html/reports, create a .htaccess file with the following directives:
   
   
   AuthName "Internet Access Statistics"
   
   AuthType Basic
   
   AuthUserFile /var/www/secret/.htpasswd
   
   <Limit GET>
   
   require user username
   
   </Limit>
   
   
   
   

   Make sure that the .htaccess file is owned by the effective user and group as specified in httpd.conf, which, in my case, was apache.apache. Don't know the deep reason, but it worked for me; without this ownership, it didn't work.




4. Create the password file /var/www/secret/.htpasswd. This, of course, assumes that /var/www/secret/ exists:
   
   
   $ sudo `which htpasswd` -c /var/www/secret/.htpasswd username
   
   
   
   

   It will ask for the password to be entered twice. Check the file to make sure the user/password combination was added.




5. To check if this worked, fire up your browser and point it to the protected directory. You should be prompted for a username and password.

For multiple users:

1. Create a /var/www/secret/.htgroup that contains the list of users with access to the protected directory:
   
   
   groupname: user1 user2 user3 ... etc.



2. Modify .htaccess, and add this:
   
   
   AuthGroupFile /var/www/secret/.htgroup
   # Change this line accordingly:
   require group groupname



3. Add users to .htpasswd:
   
   
   
   $ sudo `which htpasswd` /var/www/secret/.htpasswd user1
   
       .
   
       .
   
       .
   
   $ sudo `which htpasswd` /var/www/secret/.htpasswd user4