Password-Protect a Local Apache Directory on RHEL 9 with htpasswd

Apache HTTP Basic authentication is a small, understandable access-control layer for a staging page, internal status page, or other low-traffic resource. This guide creates one dedicated user file, applies it to one directory, and checks both denied and authorized requests. It deliberately keeps the example on the local loopback interface. Basic authentication must be paired with HTTPS before credentials are sent over an untrusted network.

Scope

Platform: Linux server

Version: 9

Distribution: Red Hat Enterprise Linux 9

The procedure protects /var/www/html/private with Apache’s file-backed Basic authentication provider. Verification uses http://127.0.0.1, so no firewall change, DNS record, public hostname, or certificate is required. The configuration is suitable as a bounded local demonstration and as a starting point for a small HTTPS-protected administrative resource. It is not an identity-management system and is a poor fit for hundreds of accounts, centralized revocation, multifactor authentication, or highly sensitive applications.

Red Hat documents /etc/httpd/conf.d/ as an included configuration directory and apachectl configtest as the syntax check for RHEL 9. Apache’s authentication guide explains the relationship among the Basic authentication type, file provider, password file, and Require authorization rule.

Prerequisites

Use an RHEL 9 host with an active Red Hat subscription or another configured source for the RHEL packages. Run the commands from an account permitted to use sudo. The example installs httpd and httpd-tools, enables Apache at boot, creates a demonstration document, and restarts the service. Record whether those packages and the service existed beforehand so rollback does not remove something another site needs.

These read-only checks identify the release and current Apache state. A missing package or inactive service is acceptable before the installation step.

cat /etc/redhat-release
rpm -q httpd httpd-tools
systemctl is-enabled httpd
systemctl is-active httpd

The release output should identify Red Hat Enterprise Linux 9. Red Hat’s current lifecycle policy lists RHEL 9 among the major releases receiving a ten-year Full and Maintenance support lifecycle, while noting that support applies to active minor releases. Keep the host on a currently maintained RHEL 9 update stream rather than pinning an expired minor release.

Commands

Install the server and the package that supplies htpasswd, then enable and start Apache. This tutorial does not open a firewall port because its checks remain on loopback.

sudo dnf install -y httpd httpd-tools
sudo systemctl enable --now httpd

Create a password-file directory outside Apache’s served content. The account name is the concrete example technest-reader. htpasswd prompts twice for a password, so the secret does not appear in the command line or shell history. The -B option selects bcrypt, and -c creates this new, dedicated file.

sudo install -d -o root -g apache -m 0750 /etc/httpd/auth
sudo htpasswd -cB /etc/httpd/auth/private-users technest-reader
sudo chown root:apache /etc/httpd/auth/private-users
sudo chmod 0640 /etc/httpd/auth/private-users

Create a harmless page in the directory to be protected. The fixed path keeps the example copy-ready and avoids placing the password file beneath /var/www/html.

sudo install -d -o root -g root -m 0755 /var/www/html/private
printf '%s\n' 'Private Apache page' | sudo tee /var/www/html/private/index.html >/dev/null
sudo chmod 0644 /var/www/html/private/index.html

Add a dedicated configuration fragment. AuthBasicProvider file selects the file provider, AuthUserFile identifies the credential file, and Require valid-user permits any account present in that file with a matching password.

sudo tee /etc/httpd/conf.d/private-directory.conf >/dev/null <<'APACHECONF'
<Directory "/var/www/html/private">
    AuthType Basic
    AuthName "Private local files"
    AuthBasicProvider file
    AuthUserFile "/etc/httpd/auth/private-users"
    Require valid-user
</Directory>
APACHECONF

Restore the distribution-defined SELinux labels, check the complete configuration, and restart Apache only after the syntax check succeeds. Red Hat recommends backing up existing configuration before editing it; this procedure instead creates a separate file whose rollback is unambiguous.

sudo restorecon -Rv /etc/httpd/auth /etc/httpd/conf.d/private-directory.conf /var/www/html/private
sudo apachectl configtest
sudo systemctl restart httpd

Do not continue to the restart if the syntax check reports an error. Review the named file and line, correct the fragment, and repeat the check.

Verification and expected outcome

First request the page without credentials. Then request it as technest-reader; curl prompts for the password without placing it in the process arguments. Finally, confirm that Apache remains active.

curl -sS -o /dev/null -w '%{http_code}\n' http://127.0.0.1/private/
curl --user technest-reader -sS -o /dev/null -w '%{http_code}\n' http://127.0.0.1/private/
systemctl is-active httpd

Expected outcome: the first curl command prints 401; after the correct password is entered, the second prints 200; the service-state command prints active. A 401 on both requests usually means the username or password does not match the file. A 403 points instead to filesystem permissions, authorization configuration, or SELinux labeling. A 500 warrants checking journalctl -u httpd and /var/log/httpd/error_log without copying credentials or unrelated sensitive log data into a support request.

The password record can also be checked interactively with Apache’s own utility. A successful match returns exit status zero; the command does not print the stored hash.

sudo htpasswd -v /etc/httpd/auth/private-users technest-reader

Expected outcome: after the correct password is entered, htpasswd reports that the password for technest-reader is correct.

Cautions

HTTP Basic authentication does not encrypt the connection. Apache’s documentation specifically warns that the password travels unencrypted unless transport encryption such as TLS is used. Keep this exact loopback example local. Before adapting it to a LAN or public hostname, configure a valid HTTPS virtual host, redirect or block plaintext HTTP, and perform the checks through the HTTPS endpoint. Do not treat a password prompt by itself as secure transport.

Keep the password file outside the web document tree. Do not use htpasswd -b, because that option exposes the plaintext password in command arguments. Use -c only when creating a genuinely new file: Apache documents that it rewrites and truncates an existing file. To add another account later, omit -c and run sudo htpasswd -B /etc/httpd/auth/private-users another-reader.

Require valid-user admits every valid record in this particular password file. Use separate files or a narrower authorization rule when resources have different audiences. The flat-file provider is intentionally simple; Apache notes that repeated file scans become unsuitable as the user count grows. Use an organizational identity provider when centralized account lifecycle, audit requirements, or a large user population matters.

Restarting httpd can briefly interrupt existing traffic. On a host already serving sites, inspect the new fragment, schedule the change appropriately, and retain a second administrative session for recovery.

Rollback or removal

Remove only the files and directory created by this procedure, recheck the remaining Apache configuration, and restart the service. This also removes the stored credential hash and demonstration content.

sudo rm -f /etc/httpd/conf.d/private-directory.conf
sudo rm -f /etc/httpd/auth/private-users
sudo rmdir /etc/httpd/auth
sudo rm -f /var/www/html/private/index.html
sudo rmdir /var/www/html/private
sudo apachectl configtest
sudo systemctl restart httpd

Expected outcome: the syntax check prints Syntax OK, Apache returns without the directory-specific authentication rule, and /var/www/html/private no longer exists. If Apache and httpd-tools were installed solely for this exercise and no other site or service depends on them, they can also be disabled and removed. Do not run this optional removal on a shared web server.

sudo systemctl disable --now httpd
sudo dnf remove -y httpd httpd-tools

This optional package removal is deliberately separate from the configuration rollback so an existing Apache installation can remain intact.