Does Apache in 10.6 support Web directory protection using .htpasswd?

Question

I am trying to protect a directory on my mac os 10.6 Web Sharing server using .htpasswd to no avail. I am creating an .htaccess and an .htpasswd file in the directory with what I think are proper configurations. Has anyone done this successfully? Am I missing something? Does the default setup in Snow Leopard allow for this? Is there a better way? Are these too many questions in a row?

Answer 1

It was my understanding that one creates the .htpasswd file inside the directory that one is protecting, no?
You can do that, but it's hardly recommended. Ideally the password file should be completely outside of the web directory since that makes it harder for someone to get access to it. If it's anywhere in the web directory tree then there's a chance that a remote user could get access to it (via some as-yet-unknown web server compromise) and there go all your passwords.
.htaccess has to be in the directory it relates to, but .htpasswd can (and should) be elsewhere.
and then created an .htaccess file alongside it with the entry shown in my original post.
Sure, but that .htaccess file includes the path to the .htpasswd file to use for authentication.
Just edit that line to the full path to your .htpasswd file.
I'm not sure but I don't even see sever logs where I expected at:
/private/var/log/httpd/access_log
Under Apache 2 the logs are in /var/log/apache2/
Also it appears that there are two apache2 folders:
/etc/apache2/
/private/etc/apache2/
It doesn't matter. /etc is really a symlink to /private/etc. It's there mostly for compatiblity with unix apps that expect /etc.