Home » Blog » Protecting Apache Web Directories with Password on Ubuntu 18.04

Information

Protecting Apache Web Directories with Password on Ubuntu 18.04

Benhcmark Administrator

10/11/2025

0 Views 0

SaveSavedRemoved 0

How to Password Protect Apache Directories on Ubuntu

Securing sensitive areas of your website is a critical task for any web administrator. Whether you’re protecting an admin panel, a development area, or private files, one of the most effective methods is using password protection at the server level. This prevents unauthorized users from even viewing the content of a specific directory.

This guide will walk you through the complete process of setting up HTTP Basic Authentication on an Apache web server running on Ubuntu. This straightforward method provides a robust layer of security, ensuring only authorized users can access specific directories on your site.

Prerequisites

Before we begin, ensure you have the following:

• A working Ubuntu server.
• The Apache2 web server installed and running.
• Access to the command line with sudo privileges.

Step 1: Create the User Password File with htpasswd

The first step is to create a file that will store the usernames and encrypted passwords for authentication. We will use the htpasswd utility, which is part of the apache2-utils package.

If it’s not already installed, you can add it with the following command:

sudo apt update
sudo apt install apache2-utils

Now, let’s create the password file and add our first user. It is a strong security practice to store this file outside of your public web directory so it cannot be accessed via a browser. A common location is within the /etc/apache2/ directory.

To create the file and add the first user, run this command, replacing your_username with your desired username:

sudo htpasswd -c /etc/apache2/.htpasswd your_username

Let’s break down this command:

• htpasswd: The utility we are using.
• -c: This flag creates a new password file. Only use this flag for the very first user you add.
• /etc/apache2/.htpasswd: The full path and name of the file. Using a dot (.) at the beginning makes it a hidden file.
• your_username: The user you are creating.

You will be prompted to enter and confirm a password for this user.

Adding Additional Users

If you need to add more users, run the same command without the -c flag. Using the -c flag again would overwrite the file and delete the previous users.

sudo htpasswd /etc/apache2/.htpasswd another_username

Step 2: Configure Apache for Password Authentication

With our password file in place, we now need to tell Apache which directory to protect and what authentication file to use. There are two primary ways to do this: using an .htaccess file or by editing the Apache virtual host configuration file directly.

Method A: Using an .htaccess File (More Flexible)

This method is ideal if you don’t have access to the main server configuration files or want to manage directory-level settings easily.

First, you must ensure Apache is configured to read .htaccess files. Edit your site’s virtual host file (usually located at /etc/apache2/sites-available/your_domain.conf). Inside the <VirtualHost> block, add or modify the <Directory> block for your webroot to include AllowOverride All.

<Directory /var/www/html>
    AllowOverride All
</Directory>

After making this change, enable the rewrite module and restart Apache:

sudo a2enmod rewrite
sudo systemctl restart apache2

Next, create an .htaccess file inside the directory you wish to protect. For example, if you want to protect /var/www/html/private, create the file at that location:

sudo nano /var/www/html/private/.htaccess

Add the following lines to the file:

AuthType Basic
AuthName "Restricted Content"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user

• AuthType Basic: Specifies the type of authentication to use.
• AuthName: This is the message that will appear in the login prompt.
• AuthUserFile: The absolute path to the .htpasswd file we created in Step 1.
• Require valid-user: This directive allows any user listed in the .htpasswd file to gain access after successful authentication.

Save and close the file. The protection is now active.

Method B: Editing the Virtual Host File (Better Performance)

For slightly better performance and security, you can place the authentication directives directly into your site’s virtual host configuration file. This prevents Apache from having to search for and read .htaccess files on every request.

Edit your site’s configuration file:

sudo nano /etc/apache2/sites-available/your_domain.conf

Inside the <VirtualHost> block, add a <Directory> block pointing to the folder you want to secure:

<Directory /var/www/html/private>
    AuthType Basic
    AuthName "Restricted Content"
    AuthUserFile /etc/apache2/.htpasswd
    Require valid-user
</Directory>

The directives are identical to the .htaccess method.

Step 3: Apply Changes and Test Your Configuration

After modifying any Apache configuration file, it’s always a good idea to check for syntax errors before restarting the service.

sudo apache2ctl configtest

If you see Syntax OK, you are safe to restart Apache to apply the changes:

sudo systemctl restart apache2

Now, open your web browser and navigate to the protected directory (e.g., http://your_domain/private). You should be greeted with a login prompt. Enter the username and password you created, and you will be granted access.

Important Security Tips

1. Enforce Strong Permissions: Ensure your .htpasswd file is secure. Only the root user and the Apache user (www-data) should be able to read it.

   sudo chown root:www-data /etc/apache2/.htpasswd
   sudo chmod 640 /etc/apache2/.htpasswd
   

2. Always Use Over HTTPS: HTTP Basic Authentication sends usernames and passwords in a non-encrypted format (Base64 encoded). This means they can be easily intercepted on an unsecured network. You should only use this protection method on a site that is fully secured with an SSL/TLS certificate (HTTPS).

3. Use Strong Passwords: The security of this system depends on the strength of the passwords you set for your users. Enforce strong, unique passwords to prevent brute-force attacks.

By following these steps, you have successfully implemented a robust layer of security on your Apache web server, safeguarding your private data from unauthorized access.

Source: https://kifarunix.com/how-to-protect-apache-web-directories-with-password-on-ubuntu-18-04/