You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Egon Frerich <eg...@frerich.eu> on 2026/03/11 13:07:03 UTC
[users@httpd] apache2.conf AuthType Basic
I want to allow only user with password to see /gitweb. I put this into
apache.conf:
|<Directory /opt/gitweb> Options Indexes FollowSymLinks AllowOverride
None #Require all granted AuthType Basic AuthName "flora"
AuthBasicProvider file AuthUserFile "/etc/apache2/passwd/passwords"
Require user xxx </Directory> |
But could see gitweb without a password.
What should I do?
Egon
Re: [users@httpd] apache2.conf AuthType Basic
Posted by Egon Frerich <eg...@frerich.eu>.
On 3/11/26 14:33, Adam Mihai Gergely wrote:
>
> People... Learn how to use AI (securely or with anonymous data),
> seriously...
>
> 1. Does that path exist ?
> 2. Does the passwords file have the exact format a htpasswd file
> should have ?
> 3. Did you restart apache2 if you modified the config file ?
> 4. Do you have user xxx in /etc/apache2/passwd/passwords defined
> correctly with the correct form of the password ?...
>
everything is ok
Egon
> I use this script for generating htpasswd conf files:
> (of course, you need to adapt it to your paths)
>
> compile.sh:
>
> #!/bin/bash
>
> # Path to your existing htpasswd file
> HTPASSWD_FILE=/etc/apache2/htpwd/htpasswd
>
> # Your source file with plain passwords
> SRC=/etc/apache2/htpwd/src.txt
>
> # Truncate existing file (empty it)
> > "$HTPASSWD_FILE"
>
> # Loop through your source file and add users/passwords
> while IFS=: read -r user pass; do
> # -b = use password from command line (non-interactive)
> # -B = bcrypt (better security than SHA; but Apache must support)
> # You can use -s for SHA1, but bcrypt (-B) is better if supported
> htpasswd -bB "$HTPASSWD_FILE" "$user" "$pass"
> done < "$SRC"
> echo ""
> echo "Restarting Apache..."
> systemctl restart apache2
> echo "... done !"
> echo ""
>
> I enter "username:password" in my src.txt and run this script.
> It produces the entry with hashed password in htpasswd.
>
> Then, I point my conf to that file:
>
> <Directory "/path/to/secure/dir">
> SSLRequireSSL
> Options -Indexes +FollowSymLinks
> AllowOverride None
>
> AuthType Basic
> AuthName "<> Red Authentication Required <>"
> AuthBasicProvider file
> AuthUserFile /etc/apache2/htpwd/htpasswd
> Require user RedUser
> ErrorDocument 401 /401.html
> </Directory>
>
> Ensure that this declaration is in a VirtualHost 443 or some form of
> SSL ! (HTTPS !)
>
> Do NOT use this in non-https because it exposes your password as
> plain-text. Someone on the network could sniff your password in
> certain conditions.
>
> Cu stima,
> Adam Mihai Gergely
> Informatician
> www.infosky.ro
> On 3/11/26 15:07, Egon Frerich wrote:
>>
>> I want to allow only user with password to see /gitweb. I put this
>> into apache.conf:
>>
>> |<Directory /opt/gitweb> Options Indexes FollowSymLinks AllowOverride
>> None #Require all granted AuthType Basic AuthName "flora"
>> AuthBasicProvider file AuthUserFile "/etc/apache2/passwd/passwords"
>> Require user xxx </Directory> |
>>
>> But could see gitweb without a password.
>>
>> What should I do?
>>
>> Egon
>>
>>
Re: [users@httpd] apache2.conf AuthType Basic
Posted by Adam Mihai Gergely via users <us...@httpd.apache.org>.
People... Learn how to use AI (securely or with anonymous data),
seriously...
1. Does that path exist ?
2. Does the passwords file have the exact format a htpasswd file should
have ?
3. Did you restart apache2 if you modified the config file ?
4. Do you have user xxx in /etc/apache2/passwd/passwords defined
correctly with the correct form of the password ?...
I use this script for generating htpasswd conf files:
(of course, you need to adapt it to your paths)
compile.sh:
#!/bin/bash
# Path to your existing htpasswd file
HTPASSWD_FILE=/etc/apache2/htpwd/htpasswd
# Your source file with plain passwords
SRC=/etc/apache2/htpwd/src.txt
# Truncate existing file (empty it)
> "$HTPASSWD_FILE"
# Loop through your source file and add users/passwords
while IFS=: read -r user pass; do
# -b = use password from command line (non-interactive)
# -B = bcrypt (better security than SHA; but Apache must support)
# You can use -s for SHA1, but bcrypt (-B) is better if supported
htpasswd -bB "$HTPASSWD_FILE" "$user" "$pass"
done < "$SRC"
echo ""
echo "Restarting Apache..."
systemctl restart apache2
echo "... done !"
echo ""
I enter "username:password" in my src.txt and run this script.
It produces the entry with hashed password in htpasswd.
Then, I point my conf to that file:
<Directory "/path/to/secure/dir">
SSLRequireSSL
Options -Indexes +FollowSymLinks
AllowOverride None
AuthType Basic
AuthName "<> Red Authentication Required <>"
AuthBasicProvider file
AuthUserFile /etc/apache2/htpwd/htpasswd
Require user RedUser
ErrorDocument 401 /401.html
</Directory>
Ensure that this declaration is in a VirtualHost 443 or some form of SSL
! (HTTPS !)
Do NOT use this in non-https because it exposes your password as
plain-text. Someone on the network could sniff your password in certain
conditions.
Cu stima,
Adam Mihai Gergely
Informatician
www.infosky.ro
On 3/11/26 15:07, Egon Frerich wrote:
>
> I want to allow only user with password to see /gitweb. I put this
> into apache.conf:
>
> |<Directory /opt/gitweb> Options Indexes FollowSymLinks AllowOverride
> None #Require all granted AuthType Basic AuthName "flora"
> AuthBasicProvider file AuthUserFile "/etc/apache2/passwd/passwords"
> Require user xxx </Directory> |
>
> But could see gitweb without a password.
>
> What should I do?
>
> Egon
>
>
Re: [users@httpd] apache2.conf AuthType Basic
Posted by Eric Covener <co...@gmail.com>.
On Wed, Mar 11, 2026 at 9:08 AM Egon Frerich <eg...@frerich.eu> wrote:
>
> I want to allow only user with password to see /gitweb. I put this into apache.conf:
>
> <Directory /opt/gitweb>
> Options Indexes FollowSymLinks
> AllowOverride None
> #Require all granted
> AuthType Basic
> AuthName "flora"
> AuthBasicProvider file
> AuthUserFile "/etc/apache2/passwd/passwords"
> Require user xxx
> </Directory>
Is there a similar Directory block where you actually configure
gitweb? Does it have access control directives?
How about access control in Location sections?
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org