.htpasswd is a flat-file used to store usernames and password for basic authentication on an Apache HTTP Server. The name of the file is given in the .htaccess configuration, and can be anything, although ".htpasswd" is the canonical name. The file name starts with a dot, because most Unix-like operating systems consider any file that begins with a dot to be hidden.[1] The htpasswd command is used to manage .htpasswd file entries.[2]

History

edit

htpasswd was first added in the NCSA HTTPd server,[3] which is the predecessor to Apache.[4] The hash historically used "UNIX crypt" style with MD5 or SHA1 as common alternatives.[5] In Apache 2.4, the bcrypt algorithm was added.[6]

Usage

edit

The file consists of lines, with each line containing a username, followed by a colon, followed by a string containing the hashed password optionally prepended by an algorithm specifier ("$2y$", "$apr1$" or "{SHA}") and/or salt.[6][7]

Athelstan:RLjXiyxx56D9s
Mama:RLMzFazUFPVRE
Papa:RL8wKTlBoVLKk

Resources available from the Apache HTTP Server can be restricted to just the users listed in the files created by htpasswd. The .htpasswd file can be used to protect the entire directory it is placed in, as well as particular files.[8]

Security issues

edit

The only algorithm accepted by htpasswd that is still considered secure by today's standards is bcrypt,[9] and many formats do not use salting making it vulnerable to dictionary attacks. The crypt() algorithm only uses the first 8 characters of any given password, discarding any past that.[5]

See also

edit

References

edit
  1. ^ "Understanding Hidden Files and Folders in Your Home Directory – TecAdmin". 2023-05-15. Retrieved 2024-02-08.
  2. ^ David, Jackson (July 30, 2023). "Mastering Htpasswd Command in Linux". Linux TLDR.
  3. ^ "NCSA httpd AuthUserFile". www6.uniovi.es. Retrieved 2024-02-08.
  4. ^ "About the Apache HTTP Server Project - The Apache HTTP Server Project". httpd.apache.org. Retrieved 2024-02-08.
  5. ^ a b "htpasswd - Manage user files for basic authentication". Retrieved 2013-11-30.
  6. ^ a b "Password Formats - Apache HTTP Server Version 2.4". Apache. Retrieved 2024-02-08.
  7. ^ "HTTP authentication - HTTP | MDN". developer.mozilla.org. 2023-12-20. Retrieved 2024-02-08.
  8. ^ Services, Chameleon Web (2014-03-24). "Password Protect File or Folder using .htaccess | Chameleon Web Services". Retrieved 2024-02-08.
  9. ^ "htpasswd file generator". aspirine.org. Retrieved 2024-02-08.
edit