Calling all techies...

[sexybomber]

I've recently set up the Apache HTTP server so I can some pictures from school on my computer, somewhat like Ofoto and whatnot. However, I'd like to put a password on the site so I know who's looking at it.

The problem is, I could barely get the program itself installed and working right, so I'm in a little over my head. :argh:

Any advice would be much appreciated.

[Commie Pinko Dirtbag]

1. You want Basic Authentication

Is it Apache 1.3.x or 2.0.x? Is it runing under Linux, Windows or what?

You'll need to create a password file using the htpasswd utility that comes with Apache, and then change httpd.conf so the directory in question becomes accessible only through a given username/password pair from this file.

[sexybomber]

2. Apache 2.0.48 running under Windows XP Pro

Where do I find said htpasswd utility?

[Commie Pinko Dirtbag]

3. Probably, in the same directory where the Apache executable is

C:\Program Files\Apache-blahblah... ?

[sexybomber]

5. OK, I found it, but it doesn't seem to want to run.

Whenever I type in the required parameters, it keeps giving me the help file for the command. Very strange.

[Commie Pinko Dirtbag]

6. Try it like this

htpasswd -c c:\webserver.pwd sbomber

It should ask you for a password, and then create the file with one username and its encrypted password.

Additional users can be created ommiting the -c parameter:

htpasswd c:\webserver.pwd jcastro

Did you know I used to give CLASSES on this thing? But running on Linux, not Windows.

Edit: of course, you'll have to use a different username for subsequent calls. Or else you'll just be changing an existing user's password.

[sexybomber]

7. Wonderful!

I think I can take it from here. I remember a section about this in the manual.

Undoubtedly, I'll have more questions, but that's the first hurdle :D

[Commie Pinko Dirtbag]

8. What to do after that

Somewhere in the httpd.conf file, there has to be a section starting with

<Directory xxxxx>

where xxxxx the directory where your published files are. Right after that line, you put this:

AuthType Basic
AuthName "SexyBomber's Server"
AuthUserFile C:\webserver.pwd
Require valid-user

And then you restart Apache. Going to the page should require a login now. If it doesn't, hit Refresh on your browser -- it may have the lingering memory of the pages captured when the server didn't require auth.

Edit: the documentation you want is here.

[Commie Pinko Dirtbag]

9. More useful tips:

http://httpd.apache.org/docs/windows.html

Lots of useful tips like this one:

"The directives that accept filenames as arguments now must use Windows filenames instead of Unix ones. However, because Apache uses Unix-style names internally, you must use forward slashes, not backslashes. Drive letters can be used; if omitted, the drive with the Apache executable will be assumed."

[sexybomber]

10. OK, I did all that and it requires a password now... but...

I gathered from the documentation that you need to "tag" certain directories as being restricted. (It actually says this:

"So, for example, once a client has authenticated in the "Restricted Files" area, it will automatically retry the same password for any area on the same server that is marked with the "Restricted Files" Realm." (emphasis mine))

Is there some line of code I can write into httpd.conf so that the right directories are tagged?

[Commie Pinko Dirtbag]

11. Create <directory xxx> sections for the subdirectories requiring auth

...at the end of the file. You may then delete the auth-related lines from the main section so the main site doesn't require a password:

Like this:

<Directory c:/apache/html/sexybomber/secretpics>
AuthType Basic
AuthName "SexyBomber's Pics"
AuthUserFile C:\webserver.pwd
Require valid-user
</Directory>

<Directory c:/apache/html/sexybomber/damningevidence>
AuthType Basic
AuthName "SexyBomber's Other Classified Info"
AuthUserFile C:\webserver.pwd
Require valid-user
</Directory>

Can you create a username for me and PM me the password so I can see it in action?

[sexybomber]

12. OK, done

Check your inbox.

on edit: It's working now! Yay! :D

[area51]

4. This may help

link to some Apache authentication info.