Apache .htaccess question

mustangfanatic01 · 03-16-2006, 06:42 AM

Hi everyone, I'm trying to use the .htaccess file to create custom 404 error page and login to password-protected directories. When I place this file and the corresponding .htpasswd in my server's root directory it works just fine. However I have allowed users public_html directories, and for some reason the .htaccess will not work for those users. For example if you type http://mysite.com it will prompt for user/pass. However if you type http://mysite.com/~eric it will ignore the fact that there is an .htaccess file there and just let you in. It also does not do the custom 404 error page specified there. So for reason the .htaccess file isn't even being read i guess. I have directory listing enabled for this user, but I don't see how this could affect it. Any ideas why this could be happening? Thanks!

gilead · 03-16-2006, 07:27 AM

Have you had a look at the Apache web site and the info they provide on .htaccess files at http://httpd.apache.org/docs/2.0/howto/htaccess.html? They recommend putting authentication directives in a <Directory> section, in your main server configuration file, as the preferred way to implement authentication.

However, they do also note that to do this in .htaccess files, you will need "AllowOverride AuthConfig" in effect for the directive to be honored. Do you have the following in your .htaccess file (modified for your setup of course)?

Code:

AuthType Basic
AuthName "Password Required"
AuthUserFile /www/passwords/password.file
AuthGroupFile /www/passwords/group.file
Require Group admins

zeitounator · 03-16-2006, 07:32 AM

Quote:

Originally Posted by mustangfanatic01

When I place this file and the corresponding .htpasswd in my server's root directory it works just fine. However I have allowed users public_html directories, and for some reason the .htaccess will not work for those users.

I'm not sure i'm getting you so just to remove any misunderstanding... Are you expecting this to work only with the .htaccess you placed in your apache root directory ? This will be the case only if the particular public_html is a filesystem descendant of your apache root directory (i.e. apache root dir is /bla/www and the other is /bla/www/somemorepaht/public_html with the .htaccess file being placed in /bla/www). Since I guess it is not the case, you need an other .htaccess file in each public_html dir you want to customize. If this was not the case, then try it and ignore the following.

Quote:

Originally Posted by mustangfanatic01

For example if you type http://mysite.com it will prompt for user/pass. However if you type http://mysite.com/~eric it will ignore the fact that there is an .htaccess file there and just let you in. It also does not do the custom 404 error page specified there. So for reason the .htaccess file isn't even being read i guess. I have directory listing enabled for this user, but I don't see how this could affect it. Any ideas why this could be happening? Thanks!

In your httpd.conf, you should have some directives for user dirs (<Directory /home/*/public_html> or such...). Double check the values for the "AllowOverride" directive. For authentification and error documents to work, you need at least "AllowOverride AuthConfig FileInfo" in there.

mustangfanatic01 · 03-16-2006, 05:03 PM

Thanks guys! at the end of my httpd.conf I need to add the following:

<Directory "/home/ermcgrat/public_html">
Options +Indexes
IndexOptions FancyIndexing IconsAreLinks
AllowOverride AuthConfig
</Directory>

This enabled directory listing and the ability for .htaccess to work!

zeitounator · 03-17-2006, 03:42 AM

As stated before, this will only work for authentification, not for error documents. Moreover, it will work only for one particular userdir. If you want to enable authentification and error documents overrides for all userdirs you need:

Code:

<Directory "/home/*/public_html">
    AllowOverride AuthConfig FileInfo
    .... some other directives .....
</Directory>