How To Upload .htpasswd File

htpasswd - Manage user files for basic hallmark

Available Languages: en | fr | ko | tr

htpasswd is used to create and update the flat-files used to store usernames and countersign for basic hallmark of HTTP users. If htpasswd cannot access a file, such as non beingness able to write to the output file or not being able to read the file in order to update information technology, information technology returns an mistake status and makes no changes.

Resource available from the Apache HTTP server can be restricted to just the users listed in the files created by htpasswd. This program tin only manage usernames and passwords stored in a flat-file. Information technology can encrypt and brandish password data for apply in other types of data stores, though. To use a DBM database meet dbmmanage or htdbm.

htpasswd encrypts passwords using either bcrypt, a version of MD5 modified for Apache, SHA1, or the arrangement's catacomb() routine. Files managed by htpasswd may contain a mixture of unlike encoding types of passwords; some user records may take bcrypt or MD5-encrypted passwords while others in the same file may take passwords encrypted with crypt().

This manual page only lists the control line arguments. For details of the directives necessary to configure user authentication in httpd see the Apache manual, which is part of the Apache distribution or can be establish at http://httpd.apache.org/.

Support Apache!

See too

httpd
htdbm
The scripts in back up/SHA1 which come up with the distribution.
Comments

top

Synopsis

htpasswd [ -c ] [ -i ] [ -m | -B | -d | -south | -p ] [ -C cost ] [ -D ] [ -5 ] passwdfile username

htpasswd -b [ -c ] [ -thou | -B | -d | -south | -p ] [ -C toll ] [ -D ] [ -five ] passwdfile username countersign

htpasswd -due north [ -i ] [ -m | -B | -d | -s | -p ] [ -C cost ] username

htpasswd -nb [ -m | -B | -d | -southward | -p ] [ -C cost ] username countersign

top

Options

-b: Apply batch mode; i.e., go the password from the command line rather than prompting for it. This option should be used with farthermost care, since the password is clearly visible on the command line. For script use run into the -i option. Available in ii.4.4 and later.
-i: Read the countersign from stdin without verification (for script usage).
-c: Create the passwdfile. If passwdfile already exists, it is rewritten and truncated. This option cannot be combined with the -northward pick.
-north: Display the results on standard output rather than updating a file. This is useful for generating password records acceptable to Apache for inclusion in not-text data stores. This selection changes the syntax of the command line, since the passwdfile argument (usually the start one) is omitted. Information technology cannot exist combined with the -c selection.
-chiliad: Use MD5 encryption for passwords. This is the default (since version 2.ii.18).
-B: Utilize bcrypt encryption for passwords. This is currently considered to be very secure.
-C: This flag is only allowed in combination with -B (bcrypt encryption). It sets the computing time used for the bcrypt algorithm (higher is more secure but slower, default: 5, valid: 4 to 17).
-d: Use catacomb() encryption for passwords. This is not supported by the httpd server on Windows and Netware. This algorithm limits the password length to 8 characters. This algorithm is insecure by today's standards. It used to exist the default algorithm until version 2.2.17.
-s: Use SHA encryption for passwords. Facilitates migration from/to Netscape servers using the LDAP Directory Interchange Format (ldif). This algorithm is insecure past today's standards.
-p: Use plaintext passwords. Though htpasswd will back up creation on all platforms, the httpd daemon will only accept plain text passwords on Windows and Netware.
-D: Delete user. If the username exists in the specified htpasswd file, information technology will exist deleted.
-5: Verify countersign. Verify that the given countersign matches the password of the user stored in the specified htpasswd file. Available in ii.4.5 and subsequently.
passwdfile: Name of the file to contain the user name and password. If -c is given, this file is created if it does non already exist, or rewritten and truncated if it does be.
username: The username to create or update in passwdfile. If username does not exist in this file, an entry is added. If information technology does be, the password is changed.
password: The plaintext countersign to be encrypted and stored in the file. Simply used with the -b flag.

top

Exit Status

htpasswd returns a naught condition ("true") if the username and countersign have been successfully added or updated in the passwdfile. htpasswd returns i if it encounters some problem accessing files, 2 if at that place was a syntax problem with the command line, 3 if the password was entered interactively and the verification entry didn't match, 4 if its performance was interrupted, 5 if a value is too long (username, filename, countersign, or terminal computed record), vi if the username contains illegal characters (come across the Restrictions section), and vii if the file is not a valid password file.

top

Examples

htpasswd /usr/local/etc/apache/.htpasswd-users jsmith

Adds or modifies the password for user jsmith. The user is prompted for the password. The password volition be encrypted using the modified Apache MD5 algorithm. If the file does non exist, htpasswd will exercise goose egg except return an error.

htpasswd -c /home/doe/public_html/.htpasswd jane

Creates a new file and stores a record in information technology for user jane. The user is prompted for the password. If the file exists and cannot be read, or cannot be written, it is non altered and htpasswd will display a message and return an error status.

htpasswd -db /usr/web/.htpasswd-all jones Pwd4Steve

Encrypts the countersign from the command line (Pwd4Steve) using the crypt() algorithm, and stores it in the specified file.

top

Security Considerations

Web password files such as those managed past htpasswd should non be within the Web server's URI space -- that is, they should non be fetchable with a browser.

This plan is not safe as a setuid executable. Do not make it setuid.

The use of the -b option is discouraged, since when it is used the unencrypted password appears on the command line.

When using the crypt() algorithm, note that merely the first 8 characters of the password are used to form the countersign. If the supplied password is longer, the extra characters will be silently discarded.

The SHA encryption format does not employ salting: for a given password, there is only 1 encrypted representation. The catacomb() and MD5 formats permute the representation past prepending a random table salt string, to make lexicon attacks against the passwords more difficult.

The SHA and crypt() formats are insecure by today's standards.

top

Restrictions

On the Windows platform, passwords encrypted with htpasswd are limited to no more than 255 characters in length. Longer passwords will be truncated to 255 characters.

The MD5 algorithm used by htpasswd is specific to the Apache software; passwords encrypted using it volition non be usable with other Web servers.

Usernames are limited to 255 bytes and may not include the grapheme :.

The price of computing a bcrypt password hash value increases with the number of rounds specified by the -C selection. The apr-util library enforces a maximum number of rounds of 17 in version 1.half dozen.0 and afterward.