Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I need to restrict access by password to my web root apache test server (ie http://localhost) but allow access to subfolders (ie: http://localhost/testsite)

I did create the .htpasswd and .htaccess, and put the .htaccess to web root (http://localhost) so when trying to access web root, it asks for user and pass, but so does in subfolders (ie: trying to access http://localhost/testite)

I want to be asked for password on web root, but not on subfolders.

Is that possible?

share|improve this question

1 Answer 1

up vote 5 down vote accepted

seems like you told Apache to require a password for your web-root, but did you dell Apache to not require it for all other directories?

Inside your .htaccess (or in httpd.conf, they do the same job) you likely have something like what is below (add a pastebin link to your .htaccess file and I can make this exact):

<Directory "/www/private">
   Order allow,deny
   Allow from all

   Options Indexes
   AuthType Basic
   AuthName "Private Access"
   AuthUserFile "/www/private/.htpasswd"
   Require valid-user
</Directory>

But that will apply to all directories under that path as well. You'll need to explicitly tell Apache otherwise.

<Directory "/var/private/subdir">
    Satisfy any
</Directory>

You can use regular expressions with <DirectoryMatch "regex"> to generalize this, just don't forget to guard against asdf.com/subdir/../ expressions.

UPDATE: Also worth mentioning that although much of the documentation already has <Directory[Match]> directives there are also <Location[Match]> directives that are helpful in the case of symlinks on the underlying filesystem.

share|improve this answer
    
Hi, it worked!, now i'm adding a <Directory /var/private/subdir> Satisfy any </Directory> to every subdir i want to be accesssed by anyone. Best regards –  razor7 Mar 30 '12 at 20:44
    
I'm trying this and it kind of works but I still get the credential dialog for the subdir even though the page is displayed. How can that happen? –  markus-tharkun May 30 at 12:34
    
@markus-tharkun Satisfy dictates the way Apache handles Allow statements and Require statements. "Any" means one of the two must match. If you don't have an "Allow from all" or similar, or you don't satisfy the constraint, then you'll have to perform the Require half (i.e., authenticate). –  Huckle May 30 at 22:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.