If you wish to authenticate users by system usernames and passwords or groups (ie. the usernames and passwords that people use to login to the system, or the groups that they are a member of), then you must follow these steps:

In the web directory that you wish to protect, create a .htaccess file with the following contents:

SSLRequireSSL
AuthType Basic
AuthName "Name of Web Area You Are Protecting"
AuthBasicProvider pam

If you wish to restrict access to ALL valid system accounts, add:

Require valid-user

If instead, you wish to restrict access to specific system accounts, add for each user:

Require user <user>

For simplicity, you can also add all users on one line:

Require user <user1> <user2> ... <userN>

If you wish to restrict access to specific groups, add:

Require unix-group <group>

Again, for simplicity, you can list all the groups on one line:

Require unix-group <group1> <group2> ... <groupN>

If you only care about group alone, then you only need to add a “Require unix-group” directive. In this case, you don't need “Require user”.

By default, only one of the conditions needs to be met to provide access, so if you were to add:

Require valid-user
Require unix-group faculty

… then ANY valid system user would be allowed in, or, any user who is in group faculty. If you want to just allow in users who are in group faculty, then include only the “Require unix-group faculty” line. Alternatively you can use a “SatisfyAll” block like this:

<SatisfyAll>
  Require valid-user
  Require unix-group faculty
</SatisfyAll>

Check file permissions on your .htaccess file and directory permissions on all directories leading up to .htaccess. At a minimum, your .htaccess file must be readable by the web server, which runs as user “www”:

% chmod o+r .htaccess

CAUTION: This will also enable other users on the system to read your .htaccess file.

You will also need to ensure that all directories up to your .htaccess file are accessible by the web server. For example, if your .htaccess file is /eecs/home/example/www/.htaccess:

% chmod o+x /eecs/home/example
% chmod o+x /eecs/home/example/www

In order to better protect system usernames and passwords, the SSLRequireSSL directive in your .htaccess file only permits access to PAM authentication over https. Please DO NOT remove this directive. Access a secure web site, /eecs/home/example/www/secure like this:

https://www.eecs.yorku.ca/~example/secure

… and not like this:

http://www.eecs.yorku.ca/~example/secure

Note: Access to your secure page over http will yield a “Forbidden” error message.

(optional) If you would like to automatically redirect http accesses to your page to the secure https version, add the following code to the .htaccess file that is in the directory above the one you are protecting:

ErrorDocument 403 /cgi-bin/pamredirect.cgi

That is, if you are protecting /eecs/home/example/www/secure, you would place the line above into /eecs/home/example/www/.htaccess and not /eecs/home/example/www/secure/.htaccess.

This code takes advantage of the fact that an error 403 (Forbidden) is produced when a user accesses your secure page via http. It redefines the error handler for “Forbidden” to a CGI script that will redirect the user to the https version of your page. Since the line must appear in the .htaccess file above the directory you are protecting, you cannot use this redirection trick to protect your main web page (eg. /eecs/home/example/www), but you can use it to protect any directories beneath.

Notes:

• A utility, mkhtaccess is available for helping you build your .htaccess file (steps 1 and 2 above). See the mkhtaccess page for details.

• Full details on Apache authentication can be found in the Apache authentication documentation.

• Always be careful when using your system username and password for accessing web pages. Only use it on sites that you trust.