1<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" 2 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> 3<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" 4 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> 5 6<html xmlns="http://www.w3.org/1999/xhtml"> 7 <head> 8 <meta name="generator" content="HTML Tidy, see www.w3.org" /> 9 10 <title>Manual Page: htpasswd - Apache HTTP Server</title> 11 </head> 12 <!-- Background white, links blue (unvisited), navy (visited), red (active) --> 13 14 <body bgcolor="#ffffff" text="#000000" link="#0000ff" 15 vlink="#000080" alink="#ff0000"> 16 <div align="CENTER"> 17 <img src="../images/sub.gif" alt="[APACHE DOCUMENTATION]" /> 18 19 <h3>Apache HTTP Server Version 1.3</h3> 20 </div> 21 22 23 <h1 align="center">Manual Page: htpasswd</h1> 24 <!-- This document was autogenerated from the man page --> 25<pre> 26<strong>NAME</strong> 27 htpasswd - Create and update user authentication files 28 29<strong>SYNOPSIS</strong> 30 <strong>htpasswd</strong> [ -<strong>c</strong> ] [ -<strong>m</strong> | -<strong>d</strong> | -<strong>s</strong> | -<strong>p</strong> ] <em>passwdfile username</em> 31 <strong>htpasswd</strong> -<strong>b</strong> [ -<strong>c</strong> ] [ -<strong>m</strong> | -<strong>d</strong> | -<strong>s</strong> | -<strong>p</strong> ] <em>passwdfile username</em> 32 <em>password</em> 33 <strong>htpasswd</strong> -<strong>n</strong> [ -<strong>m</strong> | -<strong>d</strong> | -<strong>s</strong> | -<strong>p</strong> ] <em>username</em> 34 <strong>htpasswd</strong> -<strong>nb</strong> [ -<strong>m</strong> | -<strong>d</strong> | -<strong>s</strong> | -<strong>p</strong> ] <em>username password</em> 35 36<strong>DESCRIPTION</strong> 37 <strong>htpasswd</strong> is used to create and update the flat-files used to 38 store usernames and password for basic authentication of 39 HTTP users. If <strong>htpasswd</strong> cannot access a file, such as not 40 being able to write to the output file or not being able to 41 read the file in order to update it, it returns an error 42 status and makes no changes. 43 44 Resources available from the <strong>httpd</strong> Apache web server can be 45 restricted to just the users listed in the files created by 46 <strong>htpasswd.</strong> This program can only manage usernames and pass- 47 words stored in a flat-file. It can encrypt and display 48 password information for use in other types of data stores, 49 though. To use a DBM database see <strong>dbmmanage</strong>. 50 51 <strong>htpasswd</strong> encrypts passwords using either a version of MD5 52 modified for Apache, or the system's <em>crypt</em>() routine. Files 53 managed by <strong>htpasswd</strong> may contain both types of passwords; 54 some user records may have MD5-encrypted passwords while 55 others in the same file may have passwords encrypted with 56 <em>crypt</em>(). 57 58 This manual page only lists the command line arguments. For 59 details of the directives necessary to configure user 60 authentication in <strong>httpd</strong> see the Apache manual, which is part 61 of the Apache distribution or can be found at 62 <URL:http://www.apache.org/>. 63 64<strong>OPTIONS</strong> 65 -b Use batch mode; <em>i</em>.<em>e</em>., get the password from the command 66 line rather than prompting for it. <strong>This option should</strong> 67 <strong>be used with extreme care, since the password is</strong> 68 <strong>clearly visible on the command line.</strong> 69 70 -c Create the <em>passwdfile</em>. If <em>passwdfile</em> already exists, it 71 is rewritten and truncated. This option cannot be com- 72 bined with the <strong>-n</strong> option. 73 74 -n Display the results on standard output rather than 75 updating a file. This is useful for generating pass- 76 word records acceptable to Apache for inclusion in 77 non-text data stores. This option changes the syntax 78 of the command line, since the <em>passwdfile</em> argument 79 (usually the first one) is omitted. It cannot be com- 80 bined with the <strong>-c</strong> option. 81 82 -m Use Apache's modified MD5 algorithm for passwords. 83 Passwords encrypted with this algorithm are transport- 84 able to any platform (Windows, Unix, BeOS, et cetera) 85 running Apache 1.3.9 or later. On Windows and TPF, 86 this flag is the default. 87 88 -d Use crypt() encryption for passwords. The default on 89 all platforms but Windows and TPF. Though possibly sup- 90 ported by <strong>htpasswd</strong> on all platforms, it is not sup- 91 ported by the <strong>httpd</strong> server on Windows and TPF. 92 93 -s Use SHA encryption for passwords. Faciliates migration 94 from/to Netscape servers using the LDAP Directory 95 Interchange Format (ldif). 96 97 -p Use plaintext passwords. Though <strong>htpasswd</strong> will support 98 creation on all platforms, the <strong>httpd</strong> deamon will only 99 accept plain text passwords on Windows and TPF. 100 101 <em>passwdfile</em> 102 Name of the file to contain the user name and password. 103 If -c is given, this file is created if it does not 104 already exist, or rewritten and truncated if it does 105 exist. 106 107 <em>username</em> 108 The username to create or update in <strong>passwdfile</strong>. If 109 <em>username</em> does not exist in this file, an entry is 110 added. If it does exist, the password is changed. 111 112 <em>password</em> 113 The plaintext password to be encrypted and stored in 114 the file. Only used with the -<em>b</em> flag. 115 116<strong>EXIT STATUS</strong> 117 <strong>htpasswd</strong> returns a zero status ("true") if the username and 118 password have been successfully added or updated in the 119 <em>passwdfile</em>. <strong>htpasswd</strong> returns 1 if it encounters some prob- 120 lem accessing files, 2 if there was a syntax problem with 121 the command line, 3 if the password was entered interac- 122 tively and the verification entry didn't match, 4 if its 123 operation was interrupted, 5 if a value is too long (user- 124 name, filename, password, or final computed record), and 6 125 if the username contains illegal characters (see the <strong>RES-</strong> 126 <strong>TRICTIONS</strong> section). 127 128<strong>EXAMPLES</strong> 129 <strong>htpasswd /usr/local/etc/apache/.htpasswd-users jsmith</strong> 130 131 Adds or modifies the password for user <em>jsmith</em>. The user 132 is prompted for the password. If executed on a Windows 133 system, the password will be encrypted using the modi- 134 fied Apache MD5 algorithm; otherwise, the system's 135 <em>crypt</em>() routine will be used. If the file does not 136 exist, <strong>htpasswd</strong> will do nothing except return an error. 137 138 <strong>htpasswd -c /home/doe/public_html/.htpasswd jane</strong> 139 140 Creates a new file and stores a record in it for user 141 <em>jane</em>. The user is prompted for the password. If the 142 file exists and cannot be read, or cannot be written, 143 it is not altered and <strong>htpasswd</strong> will display a message 144 and return an error status. 145 146 <strong>htpasswd -mb /usr/web/.htpasswd-all jones Pwd4Steve</strong> 147 148 Encrypts the password from the command line (<em>Pwd4Steve</em>) 149 using the MD5 algorithm, and stores it in the specified 150 file. 151 152<strong>SECURITY CONSIDERATIONS</strong> 153 Web password files such as those managed by <strong>htpasswd</strong> should 154 <strong>not</strong> be within the Web server's URI space -- that is, they 155 should not be fetchable with a browser. 156 157 The use of the -<em>b</em> option is discouraged, since when it is 158 used the unencrypted password appears on the command line. 159 160<strong>RESTRICTIONS</strong> 161 On the Windows and MPE platforms, passwords encrypted with 162 <strong>htpasswd</strong> are limited to no more than 255 characters in 163 length. Longer passwords will be truncated to 255 charac- 164 ters. 165 166 The MD5 algorithm used by <strong>htpasswd</strong> is specific to the Apache 167 software; passwords encrypted using it will not be usable 168 with other Web servers. 169 170 Usernames are limited to 255 bytes and may not include the 171 character ':'. 172 173<strong>SEE ALSO</strong> 174 <strong>httpd(8)</strong> and the scripts in support/SHA1 which come with the 175 distribution. 176 177</pre> 178 <hr /> 179 180 <h3 align="CENTER">Apache HTTP Server Version 1.3</h3> 181 <a href="./"><img src="../images/index.gif" alt="Index" /></a> 182 <a href="../"><img src="../images/home.gif" alt="Home" /></a> 183 184 185 </body> 186</html> 187 188 189 190
