Member Avatar for jbennet

Ok i know how to use .htaccess and .htpassword on linux but now i must add users to apache under a windows environment.

On linux i would go

[B]$ htpasswd -c (path to .htpassword file) (username)[/B]
 
[I]Adding password for (username)[/I]
[I]New Password:[/I]
[I]Re-Type old password:[/I]

How do i make .htpassword files under windows?

  • 5 Contributors
  • 7 Replies
  • 195 Views
  • 3 Months Discussion Span
  • Latest Post Latest Post by gurdji

Dani AI

Generated

Short summary and quick correction of earlier advice: htpasswd is normally available as a Windows executable inside the Apache binary packages (for example XAMPP, WampServer or Apache Lounge), so compiling from source is usually not necessary — grab a matching Windows build and use the bundled htpasswd.exe. Generating the file on a Linux box can work, but compatibility of the hash format must be checked first (see below). This clarifies points raised by , and corrects ’s implication that building from source is the only route. (httpd.apache.org)

Why a Linux-created file "doesn't work": older or default Linux htpasswd invocations can produce crypt() hashes that the Windows httpd does not support. Apache recognizes several formats (bcrypt, Apache-APR MD5 $apr1$, {SHA}, etc.); a portable choice is APR1 (MD5) or bcrypt. An easy way to produce an APR1 entry (so a username:hash line can be pasted into .htpasswd) is OpenSSL:

openssl passwd -apr1 myPassword
# output => $apr1$...   (paste as username:$apr1$...)

Verify generated lines start with $apr1$, {SHA} or $2y$ (bcrypt) — lines using old crypt() will fail on Windows. (httpd.apache.org)

Practical checklist and gotchas:

  • Look in the Apache bin folder of the Windows package (for example C:\xampp\apache\bin\htpasswd.exe) or install a binary package that provides it. (imalabya.wordpress.com)
  • If htpasswd.exe is unavailable, generate portable hashes with OpenSSL, PHP ({SHA} or password_hash/bcrypt) or a small script/library (Passlib, htpasswd.py) and add username:hash lines to .htpasswd. (httpd.apache.org)
  • Ensure AuthUserFile in the .htaccess points to the correct Windows path and that the Apache service account can read the file. A minimal .htaccess looks like:
AuthType Basic
AuthName "Restricted Area"
AuthUserFile "C:/path/to/.htpasswd"
Require valid-user

Store .htpasswd outside the document root, avoid plaintext hashes, and prefer bcrypt or APR1 for portability. (httpd.apache.org)

Recommended Answers

All 7 Replies

Member Avatar for ithelp

generate in linux. Download it to windows

Member Avatar for jbennet

It doesnt work ive tried that

Member Avatar for John A

htpasswd exists on the Windows platform alright, are you sure it isn't somewhere on your hard disk?
http://httpd.apache.org/docs/2.0/programs/htpasswd.html

Restrictions

On the Windows and MPE platforms, passwords encrypted with htpasswd are limited to no more than 255 characters in length. Longer passwords will be truncated to 255 characters.

Member Avatar for jbennet

I cant find the command. Its not under /bin :(

Member Avatar for jbennet

I found a .htpassword generator on the web but it doesnt work :(

I may have to resort to rewriting my site to use MySQL and cookies for authentication

Member Avatar for gurdji

how can i test if mod_rewrite is loaded or no?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.