[l008com]

Can someone help me add password protection to a directory in Apache? I looked it up in the Apache docs but its to confusing and I wasn't able to get it working.

[philzilla]

you need .htaccess

[Axel]

After you go over the steps from the link posted above, you'll need to do one extra step to ensure it works correctly : open the file httpd.conf located in /etc/httpd and, after the line "<Directory "/Library/WebServer/Documents>" change "AllowOverride None" to "AllowOverride All".
You'll need to restart the server after that (sudo apachectl graceful) to make the change happen.

[l008com]

Originally posted by Axel:
After you go over the steps from the link posted above, you'll need to do one extra step to ensure it works correctly : open the file httpd.conf located in /etc/httpd and, after the line "<Directory "/Library/WebServer/Documents>" change "AllowOverride None" to "AllowOverride All".
You'll need to restart the server after that (sudo apachectl graceful) to make the change happen.

My server documents are no longer in thier defualt locations, and I have virtual hosts... so
do I add AllowOverride All to my Directory container for this whole site, or do I create a seperate Directory Container for this specific protected directory, and add AllowOverride All to that container?

[l008com]

Nevermind. I don't even have .htaccess files turned on, so I made the new directory, put eveyrthing they said to put in the .htaccess file, in the directory in httpd.conf, and it works great!

[[APi]TheMan]

Ooooh, neat. This is a good trick to know.

Now, the option to "AllowOverride", what exactly are you overriding?

[l008com]

Originally posted by [APi]TheMan:
Ooooh, neat. This is a good trick to know.

Now, the option to "AllowOverride", what exactly are you overriding?

I actually didn't need to use any such line.

[Diggory Laycock]

For a more Mac-like solution I suggest:

Apache Protect:

http://www.versiontracker.com/dyn/moreinfo/macosx/14431

[Simon Mundy]

Originally posted by l008com:
I actually didn't need to use any such line.

It's better performance-wise if you set AllowOverride None in your default httpd.conf, then turn it on on a per-directory basis within each of your virtual hosts. Otherwise Apache will traverse through your folder structure for each request rather than through only the necessary folders.

So for a brief example:

<VirtualHost 10.0.1.1:80>
AllowOverride None
Order allow,deny
Allow from all
<Directory "/path/to/protected/folder">
AllowOverride AuthConfig
</Directory>
</VirtualHost>

This sets the default override to None for speed, then only allows your .htaccess file in your protected folder to change settings for Password protection

[l008com]

Originally posted by Simon Mundy:
It's better performance-wise if you set AllowOverride None in your default httpd.conf, then turn it on on a per-directory basis within each of your virtual hosts. Otherwise Apache will traverse through your folder structure for each request rather than through only the necessary folders.

So for a brief example:

<VirtualHost 10.0.1.1:80>
AllowOverride None
Order allow,deny
Allow from all
<Directory "/path/to/protected/folder">
AllowOverride AuthConfig
</Directory>
</VirtualHost>

This sets the default override to None for speed, then only allows your .htaccess file in your protected folder to change settings for Password protection

I have overrides off everywhere for speed, and what goes in teh htaccess file i put in a directory in the httpd.conf, that would be the fastest way to do it right?

[Simon Mundy]

Originally posted by l008com:
I have overrides off everywhere for speed, and what goes in teh htaccess file i put in a directory in the httpd.conf, that would be the fastest way to do it right?

Indeed, it would be faster to simply put all the info from the .htaccess file into a directory within your virtual host container in the httpd.conf file, and simply do away with the .htaccess file altogether!

.htaccess files are handier if you are an end-user who doesn't get control over the primary apache configuration (typically in an ISP situation) or you just don't want to tool around too much with the .conf files. But there is a performance tradeoff.

If you fine-tune your httpd.conf file you'll get much better performance and 'cleaner' folders within your website.

If you like, post an example of one of your Virtual Host containers (with the names and IP addresses changed to protect the innocent) and we can comment on it in more detail.

[Mithras]

Also, may I recommend Digest authentication if you don't want passwords transmitted in the clear.

I've compiled the up-to-date mod_auth_digest module for OS X; you can download it here.