.htaccess files being ignored?

I have a subdir immediately below my web server root which I want to protect using .htaccess. My .htaccess file looks something like this:

AuthUserFile /usr/local/apache/.htpasswd
AuthGroupFile /dev/null/
AuthName admin
AuthType Basic

<Limit GET>
require user admin
</Limit>


This, surprisingly, didn't work. I hopped over to the Apache FAQ and found what appeared to be an answer. It said: "This is almost always due to your AllowOverride directive being set incorrectly for the directory in question. If it is set to None then .htaccess files will not even be looked for. If you do have one that is set, then be certain it covers the directory you are trying to use the .htaccess file in. This is normally accomplished by ensuring it is inside the proper Directory container. "

I reset my AllowOverride directive in httpd.conf as follows:

<Directory />
Options FollowSymLinks
AllowOverride All
</Directory>


Still nothing. I thought then maybe mod_auth wasn't compiled in... but running 'httpd -l' showed that, indeed, it is.

I'm all out of ideas. Can anyone help?

cheers,

Chris

>> I reset my AllowOverride directive in httpd.conf as follows:
>> <Directory />
>> Options FollowSymLinks
>> AllowOverride All
>> </Directory>

Extremely bad and very insecure.

The fix for your problem is:

<Directory "/path/to/your/docroot">
Options FollowSymLinks
AllowOverride All
</Directory>

Though, if you have access to httpd.conf, do it there like so for optimization:

<Directory "/path/to/your/docroot/protect">
AuthUserFile /usr/local/apache/.htpasswd
AuthGroupFile /dev/null
AuthName admin
AuthType Basic
<Limit GET>
require user admin
</Limit>
</Directory>

The reason you added that to <Directory /> but still being ignored because lowest directory container wins. That is, subdir under / will override it. The lowest directory in this case is the protect directory.

Say you have this:

<Directory "/path/to/docroot">
Options All
AllowOverride All
</Directory>

But then your:

<Directory "/path/to/docroot/protect">
Options None
AllowOverride None
</Directory>

protect dir is a subdir under docroot, and when you are trying to access /protect directory, then the values you specified within <Directory "/path/to/docroot/protect"> will override the docroot's one.