Steps to protect a simple Apache Web Server using user-based authentication

1. Create a .htaccess file and save it on the web directory that we want to protect. (e.g in /var/www/html/ )

A sample .htacess file should contain 4 settings:

AuthName "Secure Place"
AuthType Basic
AuthUserFile /etc/httpd/conf/.htpasswd
require valid-user




2. Go to the /etc/httpd/conf/ and Create the password file .htpasswd.

htpasswd -c .htpasswd your-user-name
htpasswd .htpasswd next-user-name

ls -al

3. Protect your passwd file but but must make it readable.

chmod 644 .htpasswd

4. Configure the /etc/httpd/conf/httpd.conf

This is the tricky part. There are many places in this file where i can AllowOverride AuthConfig.
Have tried it here, but does not work:
# Under section 1: Global Environment

      #AllowOverride None
      AllowOverride AuthConfig


But I later guessed that it would be best to keep the global environment stricter. That means dont modify the above and keep to AllowOverride None.

And to make it work, i go down the list further and found a good place to place the AllowOverride AuthConfig.

      AllowOverrride AuthConfig


And Vola! It works when i try with my browser on http://localhost/index.html and a pop-up authentication box comes out to look for userid and password. When successful, it allows me to view the index.html file. (Of cos, you have to create a simple index.html file in advance. Good luck!