Apache

Configure HTTP Basic Authentication for Apache Server

Share on Social Media

Learn how to configure HTTP Basic Authentication for your Apache Server with this comprehensive guide. Enhance your web server security by controlling access to your resources. #centlinux #linux #apache

Problem Statement

Sometimes we have sections of websites (especially admin panels), that we don’t want to be accessed by public. Most of the web applications have their own authentication methodology but we can also create another layer of security by means of Basic Authentication with Apache HTTP Server.

In this article, we will enable Basic Authentication for the setup directory of phpMyAdmin application with Apache HTTP Server.

Read Also: How to install phpMyAdmin on Linux

What is HTTP Basic Authentication?

HTTP Basic Authentication is a simple authentication scheme built into the HTTP protocol. It is used to protect web resources by requiring users to provide a username and password to access them. Here are the key features and aspects of HTTP Basic Authentication:

  1. Username and Password: Users must provide a valid username and password to access protected resources.
  2. Base64 Encoding: The username and password are concatenated with a colon and then encoded using Base64 before being transmitted over the network.
  3. Authorization Header: The encoded credentials are sent in the “Authorization” header of the HTTP request.
  4. Simple and Easy to Implement: Basic Authentication is straightforward to set up and use, making it a popular choice for simple use cases.
  5. No Encryption: The credentials are not encrypted by Basic Authentication itself. If transmitted over HTTP, they can be intercepted and decoded easily. Therefore, it is strongly recommended to use Basic Authentication over HTTPS to encrypt the entire communication.
  6. Access Control: By validating the credentials, the server can control access to specific resources, ensuring only authorized users can access them.

Despite its simplicity, HTTP Basic Authentication should be used with caution, preferably in combination with HTTPS, to ensure that the credentials and data are securely transmitted.

Linux Server Specification

We have a preconfigured LAMP Server, and we have deployed phpMyAdmin application on it.

Hostname: lampserver.example.com
IP Address: 192.168.79.130/24
Operating System: CentOS 7.0 Server
Web Server: Apache/2.4.6

Configure HTTP Basic Authentication

First of all, we must create a password file that Apache can read. For this purpose, we can use htpasswd command. htpasswd command is packaged with httpd-tools package. However, you may found it in apache2-utils package while installing on other Linux distros.

Check if required packages are already installed on the Server.

# rpm -qa | grep httpd
httpd-tools-2.4.6-40.el7.centos.x86_64
httpd-2.4.6-40.el7.centos.x86_64

Since, we have a preconfigured LAMP Server, therefore, the httpd-tools package is already installed on our machine.

Create password file and add two users. Omit the –c option while adding the second user to already created .htpasswd file, or it will overwrite the file.

# htpasswd -c /var/www/html/phpmyadmin/setup/.htpasswd ahmer
New password:
Re-type new password:
Adding password for user ahmer

# htpasswd /var/www/html/phpmyadmin/setup/.htpasswd malik
New password:
Re-type new password:
Adding password for user malik

Check contents of the password file.

# cat /var/www/html/phpmyadmin/setup/.htpasswd
ahmer:$apr1$OLXoiAD6$gtz1kEOcGXXSPVTHARTBt1
malik:$apr1$W1rsynDg$VLbBWc2neqIq3W3LHmfuo1

As you know, we can alternatively define Apache directives at various locations like

a) in httpd.conf file,
b) in a separate .conf file created within /etc/httpd/conf.d directory, or
c) override by using a .htaccess file.

If you have set Allow Override for your web site than you can implement Basic Authentication using .htaccess file. One advantage of .htaccess is that, it won’t require the httpd service to restart after configuration. So, for a busy web server, this technique is better.

# cat >> /var/www/html/phpmyadmin/setup/.htaccess << EOF 
> AuthType Basic
> AuthName "Restricted Content"
> AuthUserFile /var/www/html/phpmyadmin/setup/.htpasswd
> Require valid-user
> EOF

Now, try to access the URL http://192.168.79.130/phpmyadmin/setup/ using your browser. it will ask you for authentication.

HTTP Basic Authentication Login

Now, you have to login with a valid user and password to get access to this section of website.

PHPMyAdmin

HTTP Basic Authentication with Apache web server has been configured successfully.

Final Thoughts

Configuring HTTP Basic Authentication for your Apache Server is an essential step to enhance your web server security by controlling access to your resources. By following this guide, you can set up authentication effectively and protect your sensitive data.

If you need further assistance or prefer professional help with the configuration, I’m here to assist! Check out my Fiverr service for expert support in configuring HTTP Basic Authentication and other server-related tasks.

Alaric Bird

Alaric Bird is a seasoned Linux System Administrator with over a decade of experience in managing and optimizing Linux-based servers and infrastructure. Known for his expertise in server deployment, security hardening, and performance tuning, Alaric has a deep understanding of various Linux distributions, including Ubuntu, CentOS, and Red Hat Enterprise Linux. His skills extend to cloud platforms like AWS, where he effectively manages virtual private servers and services. Alaric is also proficient in scripting languages such as Bash and Python, which he uses to automate routine tasks, enhancing efficiency and reliability. With a strong commitment to continuous learning, he stays updated with the latest developments in open-source technologies and best practices. His problem-solving abilities, combined with excellent communication skills, make him a valuable asset to any IT team. In addition to his technical expertise, Alaric is passionate about mentoring junior administrators and fostering a collaborative environment.

Recent Posts

Change Apache Document Root in Linux

Learn how to change Apache document root in Linux by following this step-by-step guide. Adjust…

2 weeks ago

How to Change Apache Port in Linux

Discover how to change Apache port in Linux easily. Follow our simple guide to modify…

2 weeks ago

How to Create Virtual Host in Apache Server

Learn how to create a virtual host in Apache Server with this comprehensive guide. Set…

3 weeks ago

10 Practical Tasks for RHCSA Exam with Solutions

Discover 10 practical tasks for the RHCSA exam with step-by-step solutions. Boost your Linux skills…

3 weeks ago

Ultimate Fail2ban Configuration Guide

Discover the ultimate Fail2ban configuration guide. Learn how to set up, customize, and optimize Fail2ban…

3 weeks ago

VPS Server: The Ultimate Guide to Virtual Private Servers

Explore the ultimate guide to VPS servers and learn everything about Virtual Private Servers, including…

4 weeks ago

This website uses cookies.