Operating System Information --> Unix Information --> Unix Web Issues --> Password Protecting A Web Page Using A Personal Password Database -->

Password Protecting A Web Page Using A Personal Password Database

Note: The encryption algorithm used for the password is not as secure as 
some encryption algorithms. We are working on providing a more secure way 
for you to password-protect web pages.

To password protect a web page, it must be located in a password- 
protected directory. To create a password-protected directory, use the 
following steps:

   1. Change into your pub directory:

          cd ~/../pub

   2. Create a directory in which to store the password file:

          mkdir passwords

   3. Make the passwords directory so that nobody can read it:

          fs setacl passwords system:anyuser none system:httpd read

   4. Create the password file with the username and password you'd like 
people to use to access your password-protected web page. You can 
establish more than one username and password in this step; just repeat 
the command for each username.

          htpasswd -c /users/yourusername/pub/passwords/password_file username

          (Use the command without the '-c' to update an existing password. 
Replace username with the username you'd like people to type to access the page.)

   5. You'll be asked for a password. Type the password, press return, and 
then type the password again. This will be the password used to access the 
web page.

   6. Create a directory for your password protected web page.

          mkdir private

          (You can use whatever directory name you like; we have used the 
name private)

   7. Change the AFS permissions on the directory that you created with 
the commands:

          fs sa private/ system:anyuser none system:httpd read


      This will give the web server read permissions and remove the world 
read permissions that your pub directory has by default.

   8. Change into the directory you just created.

          cd private 

   9. Create a text file called .htaccess containing the following.

          pico .htaccess 

     ( to begin creating the file):

          AuthType Basic
          AuthName ByPassword
          AuthUserFile /users/yourusername/pub/passwords/password_file

          require user username

          (Replace yourusername with your own TerpConnect login ID. 
Replace username with the username you want people to type to access the 
page, the same username you chose in step 4. If you used pico to create 
the file, save it using control-O, press return, and then use control-X to 
exit. If you created more than one username in step 4, you can allow 
multiple users access by putting additional require user username lines in 
the .htaccess file, one for each username.)

That's it! Now, just put the web page you'd like to protect into the 
private directory. To access the page, point your web browser to:

http://www.terpconnect.umd.edu/~yourusername/private/filename.html

(Where filename.html is the name of your password-protected web page, and 
yourusername is your TerpConnect login ID.)

You should see a small window pop up, asking you for the username and 
password. Type in your username and password, and you will be able to 
access the web page. 

Note: The encryption algorithm used for the password is not as secure as some encryption algorithms. We are working on providing a more secure way for you to password-protect web pages.

To password protect a web page, it must be located in a password- protected directory. To create a password-protected directory, use the following steps:

1. Change into your pub directory:

   cd ~/../pub

2. Create a directory in which to store the password file:

   mkdir passwords

3. Make the passwords directory so that nobody can read it:

   fs setacl passwords system:anyuser none system:httpd read

4. Create the password file with the username and password you'd like people to use to access your password-protected web page. You can establish more than one username and password in this step; just repeat the command for each username.

   dbmanage ./passwords/password_file adduser username

   (Replace username with the username you'd like people to type to access the page.)

5. You'll be asked for a password. Type the password, press return, and then type the password again. This will be the password used to access the web page.
6. Create a directory for your password protected web page.

   mkdir private
   
   (You can use whatever directory name you like; we have used the name private)

7. Change the AFS permissions on the directory that you created with the commands:

   fs sa private/ system:anyuser none system:httpd read

   
   This will give the web server read permissions and remove the world read permissions that your pub directory has by default.
8. Change into the directory you just created.

   cd private

9. Create a text file called .htaccess containing the following.

   pico .htaccess

   to begin creating the file):

   AuthType Basic
AuthName ByPassword
AuthDBUserFile
/users/yourusername/pub/passwords/password_file

require user username


   (Replace yourusername with your own TerpConnect login ID. Replace username with the username you want people to type to access the page, the same username you chose in step 4. If you used pico to create the file, save it using control-O, press return, and then use control-X to exit. If you created more than one username in step 4, you can allow multiple users access by putting additional require user username lines in the .htaccess file, one for each username.)

That's it! Now, just put the web page you'd like to protect into the private directory. To access the page, point your web browser to:

http://www.terpconnect.umd.edu/~yourusername/private/filename.html

(Where filename.html is the name of your password-protected web page, and yourusername is your TerpConnect login ID.)

You should see a small window pop up, asking you for the username and password. Type in your username and password, and you will be able to access the web page.