Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am new to linux administration and I am trying to restrict the outside world from accessing files in my /var/www folder.

I have done my research and found that .htaccess and .htpasswd was a good solution. So I found this online tutorial here that told me to create the .htaccess file which looks like this

AuthType Basic
AuthName "Password Protected Area"
AuthUserFile /var/www/.htpasswd
Require valid-user

And then it had a password generate on the site so I put my password in and it told me to put this in my .htaccess file (the user is tom and I used X to hide my password)

tom:$XXXXXXXXXXXXXXXXXXXXXXXXXXXX/

I now put both files into my /var/www/ directory. However, when I try to access my files via a web browser Ex. XXX.XX.XXX/myfiles/test.... it still allows me access.

What am I doing wrong?

Thanks!

share|improve this question

migrated from stackoverflow.com Mar 15 '13 at 11:29

This question came from our site for professional and enthusiast programmers.

    
Did you restart your Apache? –  Basile Starynkevitch Mar 15 '13 at 8:51
    
@BasileStarynkevitch Yes I did. Any other suggestions? Thanks! –  Teddy13 Mar 15 '13 at 9:11
    
Show the owner & permission of your .htaccess file.... Look into log files from Apache... –  Basile Starynkevitch Mar 15 '13 at 9:14
    
Have you checked your apache error log? Maybe it doesn't have access to the htacccess or password file. Also, in your virtual host spec, do you have the following: AllowOverride None? It needs to be set to AllowOverride All –  Jodes Mar 15 '13 at 9:14
    
@BasileStarynkevitch -rw-r---- –  Teddy13 Mar 15 '13 at 9:18

1 Answer 1

Check your apache error log. This could be:

  • /var/log/apache2/error.log (Ubuntu)
  • /var/log/httpd/error_log (RHEL / Red Hat / CentOS / Fedora)
  • /var/log/httpd-error.log (FreeBSD)

For the AllowOverride setting, you will probably need to look in the following folder:

  • /etc/apache2/sites-available/ (Ubuntu).

If you have the default setup, then you will want to look in the following file:

  • /etc/apache2/sites-available/default

But if you have set up custom files for your domain, it might be in another file in that directory.

In the sites-available files, you might see something like this:

<Directory /var/www/>
    AllowOverride None
</Directory>

Change 'None' to 'All'.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.