Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am new to linux administration and I am trying to restrict the outside world from accessing files in my /var/www folder.

I have done my research and found that .htaccess and .htpasswd was a good solution. So I found this online tutorial here that told me to create the .htaccess file which looks like this

AuthType Basic
AuthName "Password Protected Area"
AuthUserFile /var/www/.htpasswd
Require valid-user

And then it had a password generate on the site so I put my password in and it told me to put this in my .htaccess file (the user is tom and I used X to hide my password)


I now put both files into my /var/www/ directory. However, when I try to access my files via a web browser Ex. XXX.XX.XXX/myfiles/test.... it still allows me access.

What am I doing wrong?


share|improve this question

migrated from Mar 15 '13 at 11:29

This question came from our site for professional and enthusiast programmers.

Did you restart your Apache? – Basile Starynkevitch Mar 15 '13 at 8:51
@BasileStarynkevitch Yes I did. Any other suggestions? Thanks! – Teddy13 Mar 15 '13 at 9:11
Show the owner & permission of your .htaccess file.... Look into log files from Apache... – Basile Starynkevitch Mar 15 '13 at 9:14
Have you checked your apache error log? Maybe it doesn't have access to the htacccess or password file. Also, in your virtual host spec, do you have the following: AllowOverride None? It needs to be set to AllowOverride All – Jodes Mar 15 '13 at 9:14
@BasileStarynkevitch -rw-r---- – Teddy13 Mar 15 '13 at 9:18

Check your apache error log. This could be:

  • /var/log/apache2/error.log (Ubuntu)
  • /var/log/httpd/error_log (RHEL / Red Hat / CentOS / Fedora)
  • /var/log/httpd-error.log (FreeBSD)

For the AllowOverride setting, you will probably need to look in the following folder:

  • /etc/apache2/sites-available/ (Ubuntu).

If you have the default setup, then you will want to look in the following file:

  • /etc/apache2/sites-available/default

But if you have set up custom files for your domain, it might be in another file in that directory.

In the sites-available files, you might see something like this:

<Directory /var/www/>
    AllowOverride None

Change 'None' to 'All'.

share|improve this answer

You must log in to answer this question.