.htpasswd is a flat-file used to store usernames and password for basic authentication on an Apache HTTP Server. The name of the file is given in the .htaccess configuration, and can be anything, although ".htpasswd" is the canonical name. The file name starts with a dot, because most Unix-like operating systems consider any file that begins with a dot to be hidden.[1] The htpasswd command is used to manage .htpasswd file entries.[2]
History
edithtpasswd was first added in the NCSA HTTPd server,[3] which is the predecessor to Apache.[4] The hash historically used "UNIX crypt" style with MD5 or SHA1 as common alternatives.[5] In Apache 2.4, the bcrypt algorithm was added.[6]
Usage
editThe file consists of lines, with each line containing a username, followed by a colon, followed by a string containing the hashed password optionally prepended by an algorithm specifier ("$2y$", "$apr1$" or "{SHA}") and/or salt.[6][7]
Athelstan:RLjXiyxx56D9s Mama:RLMzFazUFPVRE Papa:RL8wKTlBoVLKk
Resources available from the Apache HTTP Server can be restricted to just the users listed in the files created by htpasswd. The .htpasswd file can be used to protect the entire directory it is placed in, as well as particular files.[8]
Security issues
editThe only algorithm accepted by htpasswd that is still considered secure by today's standards is bcrypt,[9] and many formats do not use salting making it vulnerable to dictionary attacks. The crypt() algorithm only uses the first 8 characters of any given password, discarding any past that.[5]
See also
editReferences
edit- ^ "Understanding Hidden Files and Folders in Your Home Directory – TecAdmin". 2023-05-15. Retrieved 2024-02-08.
- ^ David, Jackson (July 30, 2023). "Mastering Htpasswd Command in Linux". Linux TLDR.
- ^ "NCSA httpd AuthUserFile". www6.uniovi.es. Retrieved 2024-02-08.
- ^ "About the Apache HTTP Server Project - The Apache HTTP Server Project". httpd.apache.org. Retrieved 2024-02-08.
- ^ a b "htpasswd - Manage user files for basic authentication". Retrieved 2013-11-30.
- ^ a b "Password Formats - Apache HTTP Server Version 2.4". Apache. Retrieved 2024-02-08.
- ^ "HTTP authentication - HTTP | MDN". developer.mozilla.org. 2023-12-20. Retrieved 2024-02-08.
- ^ Services, Chameleon Web (2014-03-24). "Password Protect File or Folder using .htaccess | Chameleon Web Services". Retrieved 2024-02-08.
- ^ "htpasswd file generator". aspirine.org. Retrieved 2024-02-08.
External links
edit
 | This World Wide Web–related article is a stub. You can help Wikipedia by expanding it. |