httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Boyle Owen" <>
Subject RE: [users@httpd] Apache help needed
Date Mon, 01 Nov 2004 10:23:09 GMT
> -----Original Message-----
> From: Jaikumar Ganesh []
> Sent: Samstag, 30. Oktober 2004 04:42
> To:
> Subject: [users@httpd] Apache help needed
> Hi 
>   Would be grateful if anyone can help me with these
> questions...
> a) When i start the apache server, using apachectl I
> need the script to prompt for a password. 
>    How do i do this? Is there any option already
> provided by apache so that I need not have to change
> the script?

To get apache to serve port 80, you need to be logged in as root. If you
require root to provide a further password, this implies you don't trust
root - which is a funny situation... To put it another way, even if you
implemented this, root can access any file so the root user could edit
your script to avoid requiring a password or he could edit the password
entry in the password file so this would not prevent root from starting

To answer your question, however, there is no off-the-shelf solution.
You'd need to edit apachectl.

However.... If you happen to have mod_ssl installed, and you have put a
passphrase on your certificate, then mod-ssl will prompt for it at
startup. So installing mod_ssl, even if you don't need it, will achieve
what you want as a side-effect!

> I need to also store the password as it will be used
> for encryption purposes.
> b) Does apache maintain numerical user ids for all the
> users present in the password file created using the
> "htpasswd" utility?

No - it just does a simple lookup of the file on each login attempt. NB
- htpasswd is intended to make password files for Basic Authentication
realms - you sound like you're talking about unix users... Don't mix
them up.

> c) I am using "htpasswd" utility to create new users
> and i store all the password + user names in a single
> file (Not using .htaccess).
>   I have also modified my httpd.conf to validate the
> user and have the statement "require valid-user".
> Now when a client creates a new account, what is the
> user name, password it has to send so that the new
> account details are added, since access is available
> only for those users present in the password file. I
> don't want to put user:anonymous, passwd: annonymous
> in the password file.

I don't understand your question. You add the username/password to the
file defined in the AuthUserFile directive, then the user types in these
when he visits the protected realm. can you try to rephrase your
question? What do you want to happen? What actually is happening? What
is "wrong"?

>   is there any good solution to this? Can i specify
> multiple authentication realms?

You can have several realms side-by-side (eg, /dir2 and /dir2) but you
can never "nest" realms (eg, if /dir1 is a realm, /dir1/dir2 cannot be
an additional realm)

Owen Boyle
Disclaimer: Any disclaimer attached to this message may be ignored. 

> -Thanks
> Jaikumar
> __________________________________
> Do you Yahoo!?
> Yahoo! Mail - Helps protect you from nasty viruses.
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP 
> Server Project.
> See <URL:> for more info.
> To unsubscribe, e-mail:
>    "   from the digest:
> For additional commands, e-mail:
Diese E-mail ist eine private und persönliche Kommunikation. Sie hat
keinen Bezug zur Börsen- bzw. Geschäftstätigkeit der SWX Gruppe. This
e-mail is of a private and personal nature. It is not related to the
exchange or business activities of the SWX Group. Le présent e-mail est
un message privé et personnel, sans rapport avec l'activité boursière du
Groupe SWX.

This message is for the named person's use only. It may contain
confidential, proprietary or legally privileged information. No
confidentiality or privilege is waived or lost by any mistransmission.
If you receive this message in error, please notify the sender urgently
and then immediately delete the message and any copies of it from your
system. Please also immediately destroy any hardcopies of the message.
You must not, directly or indirectly, use, disclose, distribute, print,
or copy any part of this message if you are not the intended recipient.
The sender's company reserves the right to monitor all e-mail
communications through their networks. Any views expressed in this
message are those of the individual sender, except where the message
states otherwise and the sender is authorised to state them to be the
views of the sender's company. 

The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:> for more info.
To unsubscribe, e-mail:
   "   from the digest:
For additional commands, e-mail:

View raw message