.htaccess problems, not working!

[Vini]

got a WAMP setup, dropped a .htaccess:

AuthType Basic
AuthUserFile .htpasswd
AuthName "Vini"
require valid-user
satisfy all

into my /dir/ with a .htpasswd file in there too

but when i browse to http://site.site.site/dir/ it just lists the contents in a listing.

what am i doing wrong?

[loafer]

Does you host allow .htaccess?

I use:

<Limit GET POST PUT>
deny from all
AuthUserFile /FULL/PATH/.htpasswd
AuthGroupFile /dev/null
AuthName "VALIDATED ACCESS REQUIRED - LOGIN!"
AuthType Basic
require valid-user
</Limit>

[Vini]

still having problems.

getting

[Mon Sep 26 11:47:14 2005] [error] [client 10.1.10.217] user vini: authentication failure for "/admin": Password Mismatch, referer: http://site.site.co.uk/ 

in my apache log.

[Richard Loxley]

You might need to put the full path to the password file, e.g. this is one of my .htaccess files, which does work:

AuthName "Website log files"
AuthType Basic
AuthUserFile /pub/home/richardl/.htpasswd
Require valid-user

[Richard Loxley]

Oh, and it just occurred to me that in the above example, the password file is not in the same directory as the .htaccess file (in fact it is not in the website directory tree at all).

I seem to remember that it's recommended to keep the password file separate for security - if not, make sure that the permissions on the password file don't allow it to be read (except by Apache, obviously).

[nick_1]

Also for security you should make the file only readable by the web user (i think) just in case someone gets into your box and starts digging around.

How have you put the names into your password file. You need to use the tool htpasswd which converts the password into a MD5 hash. If you don't have a command line on the server you can also run this tool at a number of websites if you can find one you trust.

If that isn't your problem check the permissions on the file. The bit below is quoted from the apache site.

The password is stored in the password file in encrypted form, so that users on the system will not be able to read the file and immediately determine the passwords of all the users. Nevertheless, you should store the file in as secure a location as possible, with whatever minimum permissions on the file so that the web server itself can read the file. For example, if your server is configured to run as user nobody and group nogroup, then you should set permissions on the file so that only the webserver can read the file and only root can write to it:

chown root.nogroup /usr/local/apache/passwd/passwords
chmod 640 /usr/local/apache/passwd/passwords

I hope this helps.
Nick