How to restrict access to a web page

  • First create two empty files: .htpasswd and .htgroup in your home directory. Make them world-readable, permissions 644.

  • To restrict access to a directory DIR lying in your webspace ~/public_html, you will need to create a short file .htaccess, one in each DIR you wish to restrict access to. The contents of .htaccess should be AuthUserFile /HomeDir/.htpasswd AuthGroupFile /HomeDir/.htgroup AuthName "...private web site..." AuthType Basic <Limit GET POST PUT> require user <userlist> require group <grouplist> </Limit>

  • where is a space-separated list of users and is a space-separated list of groups, at least one nonempty, /HomeDir is your full home directory e.g. /home/fac/user, and AuthName is any descriptive phrase.

  • Different DIRs may have different .htaccess files and thus different restrictions. Of course, restrictions are inherited by subdirectories. All .htaccess files must be world-readable.

  • All users must have passwords, listed in the .htpasswd file. Users are added, one at a time, to an .htpasswd file by typing, in a shell, htpasswd2 /HomeDir/.htpasswd user1

  • > If you have many users, you may separate them into (possibly overlapping) groups. Groups are listed in /HomeDir/.htgroup as follows group1:user1,user2,user4 group2:user2,user4,user5 group3:user7,user4

  • One may have more than one .htpasswd and/or .htgroup file, but it's simplest to have just one of each as discussed above.

  • All web pages may be accessed plainly (http://) or securely (https://). If you want your directory DIR accessible securely only, add the line SSLRequireSSL between the Limit statements in .htaccess.