View source for Protecting Folders with .htpasswd/.htaccess

===Protecting Folders with .htpasswd/.htaccess===

When setting up a web server, there are often sections of the site that you wish to restrict access to. Web applications often provide their own authentication and authorization methods, but the web server itself can be used to restrict access if these are inadequate or unavailable.

===Install the Apache Utilities Package===
You'll need the htpassword command to configure the password that will restrict access to the target website. This command is part of the httpd-tools package, so the first step is to install that package.

 yum install -y httpd-tools

===Create a password file with htpasswd===
The htpasswd command is used to create and update the files used to store usernames and password for basic authentication of Apache users. We will create a hidden file .htpasswd in the /etc/httpd/ configuration directory.

Let's begin by creating a .htpasswd file for user1.

 htpasswd -c /etc/httpd/.htpasswd user1
You will be asked to supply and confirm a password for user1.

'''Note: Only use -c the first time you create the file. Do not use -c when you add a user in the future.'''
Let's create another user named user2:

 htpasswd  /etc/httpd/.htpasswd user2
After creating user2, you can see the username and the encrypted password for each record:

 cat /etc/httpd/.htpasswd

The output will look something like this:

 user1:$apr1$0r/2zNGG$jopiWY3DEJd2FvZxTnugJ/
 user2:$apr1$07FYIyjx$7Zy1qcBd.B8cKqu0wN/MH1

Now, you need to allow the apache user to read the .htpasswd file.

 chown apache:apache /etc/httpd/.htpasswd
 chmod 0660 /etc/httpd/.htpasswd

===Configure Apache password authentication===
Now you need to create a .htaccess file in the web directory you wish to restrict.

For this example, we will create the .htaccess file in the /var/www/html/ directory to restrict the entire document root.

 vim /var/www/html/.htaccess
Add the following content:

 AuthType Basic
 AuthName "Restricted Content"
 AuthUserFile /etc/httpd/.htpasswd
 Require valid-user

Save and close the file, then restart Apache to make these changes take effect.

 service httpd restart
or
 httpd -k restart

===Conclusion===
Your website is now secure with password authentication. Remember that password protection should be combined with SSL, so that your credentials are not sent to the server in plain text.