How to restrict access to a subdirectory of your Website

1: Introduction

Although most Web pages are designed for global accessibility, there may be times when you want to make your Web pages accessible only to a certain group of users  to whom you have previously given a password. This chapter describes some of the ways in which this can be achieved.

2: Creating a .htaccess file

The most straightforward way of limiting access to your Web pages is by creating a file called .htaccess . This is a plain text (or "ASCII") file, containing security information which is used by the Web server to determine whether or not it should deliver your Web pages in response to a particular request. A .htaccess file needs to be stored in the same directory as the Web pages that it protects. It will then regulate WWW access to all of the files in that directory (plus any sub-directories of that directory).

  To control access to your pages by password:

Login to your account on hills or fog, change into the Web directory which you want to protect (we will assume that it is a sub-directory ofpublic_html, called private), and then use a text editor to create a .htaccess file: (you type the parts shown in bold)

cd public_html/private
pico .htaccess

In the .htaccess file, type the following:
on hills:
AuthUserFile /students/login01/passfile
AuthName ByPasswd
AuthType Basic

<Limit GET POST>
require valid-user
</Limit>

Wherelogin01 is your own user-id.

on fog:
AuthUserFile /home_[xx]/login/passfile
  where [xx] is the 2 letters in your directory path to your home
  directory.  Type pwd to see your complete home directory path.
AuthName ByPasswd
AuthType Basic

<Limit GET POST>
require valid-user
</Limit>

Whereloginis your own user-id.

The file .htaccess will need to have read and execute permission for all.

$ chmod a+rx .htaccess   or $ chmod 755 .htaccess

You will need a second file - one which contains the list of users and passwords which you are going to allow to view your pages.
In this example, we have assumed that the file will be called passfile and will be stored in your home directory. You can actually call it by any name you like, and store it anywhere within your filespace, provided that the name and path are correctly given in the AuthUserFile line above. But for the sake of security, it is best not to store this password file inside your public_html directory, or any of its freely accessible sub-directories.

To create your password file, use the UNIX htpasswd command with the -c option, to add the first user and password to the list:

$ cd (changing back to your home directory, because this is where we have specified that the password file will be located)
$ htpasswd -c passfile [user]
Adding password for [user]
New password: (type in password here)
Re-type new password: (and again)

To add subsequent users to the list, omit the -c option:

$ htpasswd passfile jim
Adding user jim
New password: (type in password here)
Re-type new password: (and again)
$ htpasswd passfile gill
Adding user gill
New password: (type in password here)
Re-type new password: (and again)

At the end of this process, you will have a file called passfile in your home filespace, which contains the valid users and their passwords (in encrypted format):

$ cat passfile

[user]:2nUECVnB1fPUA
jim:piQlGJo8rdwFk
gill:9B8RYwHDLdkGA

This file also needs to be "published" for WWW access before it will function properly. We can adjust the file permissions on it as follows:

$ chmod go+r passfile    or $ chmod 644 passfile

Now whenever a user attempts to view your protected Web pages, they will be prompted for a username and password.

  How secure is .htaccess?

There is one major limitation to the use of .htaccess which you should be aware of: it only limits access to your documents when accessed via the Web. There is nothing to stop anyone who has an account on the hills system from logging in, changing directory into your own Web directory, and reading your protected documents straight off the server, using standard UNIX operating system commands (provided they know where to look).
If this is a problem to you, then you may need to consider a more elaborate security system.

 Modified from a tutorial of the University of Aberdeen