How To Set Up Password Authentication with Apache on Ubuntu 18.04 [Quickstart]

Introduction

This tutorial will walk you through password-protecting assets on an Apache web server running on Ubuntu 18.04. Completing these steps will provide your server with additional security so that unauthorized users cannot access certain parts of your page.

For a more detailed version of this tutorial, with more detailed explanations of each step, please refer to How To Set Up Password Authentication with Apache on Ubuntu 18.04.

Prerequisites

In order to complete this tutorial, you will need access to the following on an Ubuntu 18.04 server:

• A sudo user on your server

• An Apache2 web server

• A site secured with SSL

Step 1 — Install the Apache Utilities Package

We’ll install a utility called htpasswd, part of the apache2-utils package to manage usernames and passwords with access to restricted content.

sudo apt-get update
sudo apt-get install apache2-utils

Step 2 — Create the Password File

We’ll create the first user as follows (replace `first_username with username of your choice):

sudo htpasswd -c /etc/apache2/.htpasswd first_username

You will be asked to supply and confirm a password for the user.

Leave out the -c argument for any additional users you wish to add so you don’t overwrite the file:

sudo htpasswd /etc/apache2/.htpasswd another_user

Step 3 — Configure Apache Password Authentication

In this step, we need to configure Apache to check this file before serving our protected content. We will do this by using the site’s virtual host file, but there is another option detailed in the longer tutorial if you don’t have access or prefer to use .htaccess files instead.

Open up the virtual host file that you wish to add a restriction to with a text editor such as nano:

sudo nano /etc/apache2/sites-enabled/default-ssl.conf

Authentication is done on a per-directory basis. In our example, we’ll restrict the entire document root, but you can modify this listing to only target a specific directory within the web space.

In this step, add the following highlighted lines in your file:

<VirtualHost *:80>
  ServerAdmin webmaster@localhost
  DocumentRoot /var/www/html
  ErrorLog ${APACHE_LOG_DIR}/error.log
  CustomLog ${APACHE_LOG_DIR}/access.log combined

  <Directory "/var/www/html">
      AuthType Basic
      AuthName "Restricted Content"
      AuthUserFile /etc/apache2/.htpasswd
      Require valid-user
  </Directory>
</VirtualHost>

Check the configuration with the following command:

You can restart the server to implement your password policy, and then check the status of your server.

sudo systemctl restart apache2
sudo systemctl status apache2

Step 4 — Confirm Password Authentication

To confirm that your content is protected, try to access your restricted content in a web browser. You should be presented with a username and password prompt:

Related Tutorials

Here are links to more detailed guides related to this tutorial:

• How To Set Up Password Authentication with Apache on Ubuntu 18.04

• Getting Familiar with Important Apache Files and Directories
  in our Apache installation guide.

• How To Set Up Apache Virtual Hosts on Ubuntu 16.04

• How To Use the .htaccess File .