How to set up Apache htpasswd Authentication in Ubuntu

Using Apache’s htpasswd authentication is a simple way to add basic access control to your web directories, requiring users to provide a username and password before accessing certain parts of your website. This type of authentication is often used to restrict access to sensitive areas, like admin panels or development sites, and can be set up easily on an Ubuntu server running Apache.

Prerequisites

• A server running Ubuntu with Apache2 installed.
• Root or sudo access to the server.
• A basic understanding of using the command line.

Step 1: Install Apache (If Not Already Installed)

If Apache is not installed on your Ubuntu server, you can install it with the following command:

Step 2: Enable the htpasswd Utility

The htpasswd utility is provided by the apache2-utils package, which is typically installed with Apache. If it’s not installed, you can install it by running:

This command installs the necessary tools for managing password files for htpasswd authentication.

Step 3: Create the .htpasswd File

The .htpasswd file is used to store the usernames and encrypted passwords for authentication.

1. Create a New .htpasswd File:To create a new .htpasswd file and add a user, run the following command:
   sudo htpasswd -c /etc/apache2/.htpasswd your_username

   Replace your_username with the username you want to create.

   • The -c option creates a new .htpasswd file. If the file already exists and you use -c, it will be overwritten, so use it only when creating the file for the first time.
2. Enter and Confirm the Password:After running the command, you will be prompted to enter and confirm a password for the user.

   The file /etc/apache2/.htpasswd will be created with the encrypted password for your_username.

3. Add Additional Users (Optional):To add more users without overwriting the existing .htpasswd file, run:
   sudo htpasswd /etc/apache2/.htpasswd another_username

   Replace another_username with the new username. This command appends the new user to the existing .htpasswd file.

Step 4: Configure Apache for Password Protection

You need to specify which directory or location you want to protect with the password. This is done using an .htaccess file or by editing the Apache configuration file directly.

Option 1: Using .htaccess File

1. Enable .htaccess Files:If you want to use .htaccess files to set up password protection, ensure that the AllowOverride directive is set to All for the directory you want to protect. Edit the appropriate Apache configuration file (e.g., /etc/apache2/sites-available/000-default.conf):
   sudo nano /etc/apache2/sites-available/000-default.conf

   Find the <Directory> section for your web root (e.g., /var/www/html) and set AllowOverride to All:

   <Directory /var/www/html>
   AllowOverride All
   </Directory>
2. Restart Apache:After editing the configuration, restart Apache to apply the changes:
   sudo systemctl restart apache2
3. Create an .htaccess File:Inside the directory you want to protect (e.g., /var/www/html), create or edit an .htaccess file:
   sudo nano /var/www/html/.htaccess
4. Add the Following Directives:Add the following lines to the .htaccess file:
   AuthType Basic
   AuthName “Restricted Content”
   AuthUserFile /etc/apache2/.htpasswd
   Require valid-user
   • AuthType Basic: Specifies basic authentication.
   • AuthName: A message that will be shown in the authentication prompt.
   • AuthUserFile: The path to your .htpasswd file.
   • Require valid-user: Restricts access to users listed in the .htpasswd file.
5. Save and Close the file.

Option 2: Using Apache Configuration File Directly

If you prefer to manage authentication directly in the Apache configuration files instead of using .htaccess, follow these steps:

1. Edit the Virtual Host Configuration:Open the Apache configuration file for the site you want to protect (e.g., /etc/apache2/sites-available/000-default.conf):
   sudo nano /etc/apache2/sites-available/000-default.conf
2. Add the Authentication Directives:Inside the <VirtualHost> block or the <Directory> block that corresponds to the directory you want to protect, add the following:
   <Directory “/var/www/html”>
   AuthType Basic
   AuthName “Restricted Content”
   AuthUserFile /etc/apache2/.htpasswd
   Require valid-user
   </Directory>
3. Save and Close the configuration file.
4. Restart Apache:After making changes, restart Apache:
   sudo systemctl restart apache2

Step 5: Test the Authentication

Now, navigate to the URL of the protected directory using your web browser (e.g., http://your_server_ip_or_domain). You should see a login prompt asking for a username and password.

• Enter the username and password you created with the htpasswd command.
• If the credentials are correct, you will gain access to the directory; otherwise, you will be denied access.

Step 6: Securing the .htpasswd File

For security reasons, make sure that the .htpasswd file is stored outside the web root (e.g., /etc/apache2/.htpasswd) so that it cannot be accessed directly through a web browser.

Ensure the .htpasswd file has the correct permissions:

This ensures that only the Apache user (www-data) and root have access to read the .htpasswd file.

Conclusion

Setting up htpasswd authentication in Apache is a straightforward way to add basic access control to specific directories on your website. It is suitable for low-level protection, especially in development or internal environments. However, for highly sensitive areas, consider using more robust authentication methods, such as OAuth or integrating with an identity management system.