APACHE2 MAKING SECURE FOLDER
############################

NOTE TO SELF – BUT MIGHT BE USEFUL TO YOU

auth can go in main config or per directory with .htaccess (.htaccess files go in to directories and set options in the direcotry)

THE WHOLE TIME IM ROOT
#######################

I want to make /var/www/secure HOW?
2 ways:
.htaccess in /var/www/secure
Or:
put in config file /var/www configs are in /etc/apache2/sites-available/default, so I put in between the virtual host lines

If your going the .htaccess way, you need to allow those files, by going to your //etc/apache2/sites-available/default
<Directory /var/www/>

AllowOverride All # this cant be set to none

</Directory>
Dont worry about the <Directory /> ALlowOverride None, although it sounds dangerous, we override that setting with the /var/www directory directives(what I was just talking about above) and thats why we dont worry about it.
In otherwords:
/ — this says no .htaccess because of AllowOverride None (which applies to all of its subfolders)
/var/www — this says yes .htaccess because of the AllowOverride Yes (which appliues to all of its subfolders) Thus it works out for /var/www/secure
/var/www/secure/.htaccess – thus this file is read because its within the /var/www directive (sure its within the /, but again that gets overridden by /var/www)
IF the above paragraph didnt make sense, there will be more explanations below with full on configs

To get there we need to make a password file with users, and if you want a group you need to make a group file, and in the config file .htaccess or default file you will need to say the right things to point at the password and group file

So there is the config examples below for single user, groups, or all users (that are in the password file, so multiple users and no need for group file)

FOR ONE USER
==============

This makes the password file:
htpasswd -c /etc/apache2/passes bobby
PW: monster

Create the file from scrach:
vim /var/www/secure/.htaccess

 

OR LIKE WISE INSTEAD OF /var/www/secure/.htaccess PUT IN THE APPROPRIATE CONFIG FILE
IN THIS CASE: /etc/apache2/sites-available/default – IGNORE WHERE SAYS 50000, usually thats 80

 

 
FOR GROUP
==========

Add user support to the password file:
htpasswd /etc/apache2/passes marketing
htpasswd /etc/apache2/passes eng

PW for marketing: woworld
PW for eng: password2

Make a file for groups bringing the users together, just a simple test file of the form:
vim /etc/apache2/groups
fredinc: marketing bobby eng

Edit the .htaccess file:
vim /var/www/secure/.htaccess

 

OR LIKE WISE INSTEAD OF /var/www/secure/.htaccess PUT IN THE APPROPRIATE CONFIG FILE
IN THIS CASE: /etc/apache2/sites-available/default – IGNORE WHERE SAYS 50000, usually thats 80

 

HOW PW FILE LOOKS LIKE IN THE END
==================================

The PW for single user config looks the same, but only has the first line, not the last 2 lines. Although it could have the last 2 lines and it wouldnt hurt it as we are only allowing “bobby” in from the config.

# cat /etc/apache2/passes

 

ANOTHER WAY TO LET MULTIPLE PPL IN THAT WOULD OF WORKED HERE:
==============================================================

There’s another way to let multiple users in that is less specific. Rather than creating a group file, you can just use the following directive:

Require valid-user

Using that rather than the “Require user bobby” line will allow anyone in that is listed in the password file, and who correctly enters their password.

DOWNLOAD WITH PASSWORD WITH WGET If you need to later get a file out
#####################################################################

wget –user=bobby –password=’monster’ http://www.server.com/secure/file.txt

IF .htaccess WAS NOT WORKING BUT /etc/apache2/…/default WAS WORKING
######################################################################

It because the AllowOverride was set to none, it needs to be set to all, as this says:

By the way this is problem #4, the other problems are make sure the file .htaccess is all lowercase and the spelling is correct and that there are not syntax errors in the file. Or maybe its being overriden by another .htaccess file as the settings do merge… to see which .htaccess files you have: “find /path/to/website/root -iname .htaccess -print”

Htaccess Problem #4: Htaccess Disabled by AllowOverride Setting

On some servers, Apache is configured to ignore some or all directives in .htaccess files. This is for security reasons. The AllowOverride directive controls which features will be allowed in .htaccess files. For example AllowOverride None can turn off htaccess files for a folder and its subfolders.

Check your Apache configuration file for which AllowOverride directive is applied to the directory containing your problem htaccess file.

If you’re not sure which configuration file to look in, start with the main Apache configuration file httpd.conf or apache2.conf. If your website is configured in a file included by httpd.conf (e.g. a virtual hosts configuration file), you will need to look in that file. See Location of httpd.conf on CentOS, Ubuntu, Mac and others to locate your httpd.conf.

To enable using a .htaccess file, change AllowOverride None to AllowOverride All.

For example, for a CentOS 5.3 server, I needed to change the AllowOverride setting in the file /etc/httpd/conf.d/virtualhosts.conf.

httpd.conf before:

Options FollowSymLinks
AllowOverride None
httpd.conf after:

Options FollowSymLinks
AllowOverride All
Be aware that enabling htaccess files has security implications, as htaccess files override your Apache configuration. For example, if your site provides uploads, a hacker could potentially upload a .htaccess file to your server and use it to gain access to your server. There are options to AllowOverride that restrict the directives that will be used from a .htaccess file. See the documentation for AllowOverride.

HOW .htaccess IS APPLIED
##########################

How directives are applied

The configuration directives found in a .htaccess file are applied to the directory in which the .htaccess file is found, and to all subdirectories thereof. However, it is important to also remember that there may have been .htaccess files in directories higher up. Directives are applied in the order that they are found. Therefore, a .htaccess file in a particular directory may override directives found in .htaccess files found higher up in the directory tree. And those, in turn, may have overridden directives found yet higher up, or in the main server configuration file itself.

—NOTE IN MY CASE FOR .htaccess TO WORK, I HAD TO CHANGE IT IN ONE PLACE:—
vim /etc/apache2/sites-available/default
ORIGINAL CONFIG DIDNT ALLOW .htaccess FILES
##########################################

# cat /etc/apache2/sites-available/default

 
CONFIG WHEN HAD /var/www/secure SET FROM SERVER, AND .htaccess FILES WERE DISABLED
###################################################################################

* this way there is no need for .htaccess file anywhere, for copies of the groups and passes file they are above and below

# cat /etc/apache2/sites-available/default

 

FINAL CONFIG ALLOWED .htaccess FILES
####################################

# cat /etc/apache2/sites-available/default

 

# cat /var/www/secure/.htaccess

 

* This one is made manually
# cat /etc/apache2/groups

 

* this one is made with htpasswd command as I mention above
# cat /etc/apache2/passes

 

Leave a Reply

Your email address will not be published. Required fields are marked *