2

I want to password protect a directory. I'm running Apache 2 with cPanel on Centos.

For the sake of this post, the directory is /home/user/my-secret-dir

I used cPanel's "Password Protect Directories" to create the login details, which it stored in a new /home/user/.htpasswds/my-secret-dir/passwd file.

What it didn't do is create the AuthType configuration anywhere - I could simply access the directory without prompts (it's just got a generic index.html whilst I get this working).

So I created /home/user/my-secret-dir/.htaccess myself, with the following contents:

AuthType Basic
AuthName "My Secret Directory"
AuthUserFile "/home/user/.htpasswds/my-secret-dir/passwd"
require valid-user

This now causes the browser to prompt for login details, but upon entering the correct username and password it behaves as if they were wrong and re-prompts for the details.

The details I'm entering are definitely correct.

I've previously setup a password protected directory on this same server (though for different account/domain) and that worked fine (and still works), and I've compared the two and can't see any significant differences.

Any ideas what might be causing the continual prompts, and how I can fix it?

mailq
  • 16,882
  • 2
  • 36
  • 66
Peter Boughton
  • 584
  • 1
  • 6
  • 18

1 Answers1

4

This was a permissions issue - Apache was unable to access the auth file, so was treating everything as invalid.

Checking the logs revealed:

(13)Permission denied: Could not open password file: /home/user/.htpasswds/my-secret-dir/passwd

Turns out the /home/user/.htpasswds directory had existed before now, and had incorrect permissions on it.

I updated the permissions so Apache was able to access it, and then logging in worked as expected.

Peter Boughton
  • 584
  • 1
  • 6
  • 18
  • Not always permission issue, That "permission denied" message was meant for user (response that's been shown to user), the other half is about the server, and in my case it was a not found message (this was my error: `[DATE] [authn_file:error] [pid 27850] (13)Permission denied: [client ip:port] AH01620: Could not open password file: /path/to/.htpasswd`) It may also be a typo or a invisible character in the `AuthUserFile` line (which I've just encountered and took my 1.5 hours). – Arda Jan 28 '16 at 00:02