Miscellaneous Commands¶

The misc command group provides utility commands that don't fit in other categories.

Overview¶

Miscellaneous commands include: - Generate .htpasswd entries for HTTP basic authentication

Global Flags¶

--debug, -d, --verbose - Show debug information
--insecure, -k - Skip TLS certificate verification
--force, -f, -y, --yes - Force operations without prompting
--output, -o - Output format: json, yaml, or table

Commands¶

`sitesctl misc htpasswd`¶

Generate a .htpasswd entry for HTTP basic authentication.

Usage:

sitesctl misc htpasswd --username <username> [--password <password>]

Flags:

--username (required) - Username for authentication
--password (optional) - Password to encrypt
If omitted, a random password is generated

Examples:

# Generate entry with specific password
sitesctl misc htpasswd --username john --password mypassword

# Generate entry with random password
sitesctl misc htpasswd --username alice

# Output as JSON
sitesctl misc htpasswd --username bob --password secret --output json

# Use in script
entry=$(sitesctl misc htpasswd --username user1 --password pass123 --output json | jq -r '.entry')

What it does: - Takes a username and password - Generates a bcrypt hash of the password - Returns a .htpasswd format entry - Compatible with Apache htpasswd and nginx

Output Format:

Standard output:

username:$2y$10$randomsalt...hashedpassword...

JSON output:

{
  "status": "OK",
  "data": {
    "username": "john",
    "password": "mypassword",
    "entry": "john:$2y$10$randomsalt...hashedpassword..."
  }
}

HTTP Basic Authentication¶

What is .htpasswd?¶

A .htpasswd file stores username and password pairs for HTTP basic authentication: - Used by web servers (Apache, nginx) - Protects directories or entire sites - Standard format: username:hashedpassword - One entry per line

Use Cases¶

Protect Site Directories - Add authentication to specific paths on Public websites - Restrict access to admin areas on Public websites

Using Generated Entries¶

Create .htpasswd file:

sitesctl misc htpasswd --username admin --password secret123 > /etc/nginx/.htpasswd

Upload .htpasswd to your site:

# Generate .htpasswd file
sitesctl misc htpasswd --username admin --password admin123 > .htpasswd

# Upload to site
sitesctl site --space myspace --name mysite \
  content upload --source .htpasswd --destination /dir-to-protect/

Common Workflows¶

Protect Entire Site¶

#!/bin/bash
# Add authentication to entire site

space="myspace"
name="mysite"

# Generate credentials
sitesctl misc htpasswd --username admin --password secure123 > .htpasswd

# Upload file
sitesctl site --space "$space" --name "$name" \
  content upload --source .htpasswd --destination /dir-to-protect/

Multiple User Accounts¶

#!/bin/bash
# Create .htpasswd with multiple users

output_file=".htpasswd"

# Clear/create file
> "$output_file"

# Add users
users=(
  "admin:admin123"
  "user1:pass1"
  "user2:pass2"
  "viewer:viewonly"
)

for user_pass in "${users[@]}"; do
  IFS=':' read -r username password <<< "$user_pass"
  echo "Adding user: $username"

  entry=$(sitesctl misc htpasswd \
    --username "$username" \
    --password "$password" \
    --output json | jq -r '.data.entry')

  echo "$entry" >> "$output_file"
done

# Upload file
sitesctl site --space "$space" --name "$name" \
  content upload --source $output_file --destination /dir-to-protect/

Protect Specific Directory¶

#!/bin/bash
# Protect /admin directory only

space="myspace"
name="mysite"
protected_dir="/admin"

# Generate credentials
sitesctl misc htpasswd --username admin --password secure123 > admin.htpasswd

# Upload to admin directory
sitesctl site --space "$space" --name "$name" \
  content upload --source admin.htpasswd --destination "$protected_dir/.htpasswd"

Random Password Generator¶

#!/bin/bash
# Generate user with random password

username="tempuser"

# Generate with random password
output=$(sitesctl misc htpasswd --username "$username" --output json)

password=$(echo "$output" | jq -r '.data.password')
entry=$(echo "$output" | jq -r '.data.entry')

echo "Generated credentials:"
echo "Username: $username"
echo "Password: $password"
echo ""
echo "Entry for .htpasswd:"
echo "$entry"

# Save credentials securely
echo "Username: $username" > credentials.txt
echo "Password: $password" >> credentials.txt
chmod 600 credentials.txt

Security Best Practices¶

Password Management¶

Strong Passwords
Minimum 12 characters
Mix of letters, numbers, symbols
Use random passwords when possible
Generate with: sitesctl misc htpasswd --username user
Secure Storage
Store passwords in password manager
Don't commit .htpasswd to version control
Use environment variables in scripts
Encrypt credentials files
Regular Rotation
Rotate passwords every 90 days
Change immediately if compromised
Remove unused accounts

Limitations¶

htpasswd Command Limitations¶

Not for user management: Only generates entries, doesn't manage existing files
Single entry: Generates one entry at a time
No verification: Doesn't verify against existing entries
No file merging: Doesn't directly update .htpasswd files

HTTP Basic Authentication Limitations¶

Credentials in clear: Username/password sent with each request (over HTTPS is secure)
No user sessions: Authentication required on every request
Browser caching: Browsers cache credentials (can't easily "logout")
Limited UI: Browser shows basic dialog, no custom UI
No fine-grained control: All or nothing access

Troubleshooting¶

Authentication Not Working¶

Problem: Browser doesn't prompt for credentials

Solutions: - Verify .htpasswd file uploaded correctly

Wrong Password Hash Format¶

Problem: Generated hash doesn't work

Solutions: - Verify web server supports bcrypt hashes - Some older servers need different hash types - Check web server error logs - Test with simple password first

Cannot Generate Entry¶

Problem: htpasswd command fails

Solutions: - Check authentication: sitesctl auth whoami - Login if needed: sitesctl auth login - Verify network connectivity - Try with --debug flag

File Upload Issues¶

Problem: Cannot upload .htpasswd

Solutions: - Check authentication for content operations - Verify master token or HTTP access token - Check site is not archived - Ensure destination path exists