Using.htaccess to Restrict OU Directory by Usernames and Passwords in an.htpasswd File

Transcription

1 Using.htaccess to Restrict OU Directory by Usernames and Passwords in an.htpasswd File (Last updated on 9/3/2015 by This method requires the management of three files,.htaccess,.htpasswd, and https.php..htaccess sets the permissions and configurations such as where to look for the error document (the php file) and where to look for the password file that contains the usernames and their corresponding encrypted passwords. This method is the recommended way to secure a directory for two reasons: 1) This method allows for a request over both http and https, but doesn t require authenticating twice. 2) This method asks for credentials over secure https protocol by redirecting a non-https request to an https request, and then prompting for credentials. Usernames and Passwords should NEVER be sent over non-https protocols. 1. This example uses a case that is already in production, e.g., 2. Create three new text files on the desktop. Name the files, https.php.txt (without the quotes),.htaccess.txt (without the quotes) and.htpasswd.txt (without the quotes). 3. Copy the below code and paste it into notepad file, https.php.txt file. Then, save the file. <?php // If this page isn't requested as https, redirect the request to use this protocol if (empty($_server['https'])) { header("location: $_SERVER["HTTP_HOST"]. $_SERVER["REQUEST_URI"]); exit; }?> 4. Copy the below code and paste it into notepad file,.htaccess.txt and save. The highlighted yellow lines will be discussed later.

2 SSLOptions +StrictRequire SSLRequireSSL SSLRequire %{HTTP_HOST} eq "ecep.uark.edu" ErrorDocument 403 /_resources/https.php AuthName "ECEP Protected Area. If you don't have a username and password set up for these resources, please ecepinfo@uark.edu to request access" AuthUserFile /www/vhosts/ecep.uark.edu/_resources/pdf_protected/.htpasswd AuthType Basic require valid-user <Files /_resources/https.php> AuthType none </Files> 5. Copy the below code and paste it into notepad file,.htpasswd.txt. This is the password file where it follows the convention: For each line, there one entry of: username:encryptedpassword These two lines below set up access for the users, testuser and anotheruser, and the passwords are testuser and anotheruser, respectively (without single quotes). Copy this into the.htpasswd.txt file and save. testuser:nwq46pnm0illm anotheruser:$apr1$tfpbce0d$3eo7cyytmyuxgiofskqf81 6. Now that the files have been created and have contents, we will upload those to the OU website. 7. Login to the OU website and navigate to the folder that needs to be restricted. 8. Click on the Upload button in the upper right hand corner, then click the green +Add button that is presented in the modal window (shown in the below screenshot). Navigate to the desktop and upload the files created in previous steps,.htaccess.txt and.htpasswd.txt, by clicking the Shift key and then selecting the files, which allows for multiple files to be selected for the upload.

3

4 Then click the Open button. At this point, both files should be appearing in the modal window. Under the Status/Options column, if the user moves the mouse there, a button called Rename will show. Click this and edit both filenames by removing the.txt from the end of the file name. The files should now be named, respectively,.htaccess and.htpasswd, as shown in the screenshot below. Finally, click the blue Start Upload button.

5 9. Now, that those two files are uploaded, edit the.htaccess file, and update the lines of code that are highlighted from #4 above. a) The third line highlighted in yellow should be the domain name of the site, e.g. coehp.uark.edu. Notice there is no no nor is there a trailing slash at the end of this entry. b) The fourth line highlighted in yellow should be the path of the https.php file as defined from the root (this means don t include the subdomain, but do put a slash in front of the first directory in the file path, e.g., /_resources/https.php). This file CANNOT reside in the secured directory, and instead, should be placed in a publicly accessible directory one directory above the secured directory. c) The fifth and sixth lines highlighted in yellow is the text that will display in the authentication prompt. d) The seventh line should be updated so it reflects the path of the location of the.htpasswd file. It is ok if this file is in the restricted directory. Please note that this line should start with /www/vhosts/, and then have the file path of the.htpasswd file, specified all the way from the domain to the file, itself, e.g., coehp.uark.edu/_resources/pdf_other/.htpasswd, so the entire line will look something like: /www/vhosts/ecep.uark.edu/_resources/pdf_protected/.htpasswd How to actually determine this path is discussed towards the end of this document. e) Finally, the tenth line will also get the same file path as defined for the fourth line (item b from above), which is defined from the root, e.g., /_resources/https.php f) Save the file and publish it to production.

6 10. Publish the.htpasswd file to production. This is also the file whereby new users/passwords are added (see below). 11. Navigate to the directory defined for the https.php file in the.htaccess file (this should be a directory above the restricted directory), and upload the https.php.txt file into that directory using the same steps used for the previous two uploaded files. There are no edits/updates to the code needed that is contained in this file. Rename the file and remove the.txt (so that the file will be named, https.php [without the quotes]) and then publish the file to production. How to Add Users and Passwords to the.htpasswd File. As mentioned earlier, the usernames are in plain text, then follows a colon (:) and then the encrypted password, with no spaces in between, and with one entry per line (an entry is: username:encryptedpassword, e.g. testuser:nwq46pnm0illm) 1. Login to OU website and navigate to the restricted directory. Find the.htpasswd file and click on Edit. 2. There are many.htaccess password encryption tools on the web. I recommend using as it displays the line of code to the user. Copy that line of code from the web form (shown in the screenshot below) and paste it onto the next new line of the.htpasswd file. Make sure you remember the password that you entered so that you test the access for that specific user! Also, since the password is encrypted, if the OU admin or the specific user forgets their corresponding password, a new password will need to be generated, and the file will need to be updated, resaved, and published to production.

7 3. After the new line has been entered on the.htpasswd file (shown in the below screenshot), save it, and then publish it to production.

8 4. Finally, determine the URL for some resource in the restricted directory and test both the http request of that for that user, e.g., in this case, Make sure you test this with a fresh browser. Once you test it, close the browser and then re-open it to conduct a new test. 5. Once a new user has been added, this.htpasswd file can be versioned (shown in the next two screenshots below) so that it can be recovered in case the file gets corrupted, user gets deleted, etc.

9

10 How can I verify my AuthUserFile path from line 7 in item #4? 1) Create an interior test page 2) Click the edit button on the page, and then the html button. 3) Enter the below code into the modal window (shown in the following screenshot). <?php echo "\n". getcwd(). "\n";?> 4) Save the page and then publish it. Once it is published, view the page, and the path should be displayed (shown in the screenshot below).

11 For any questions or problems, please contact