Require credentials for listening

Source credentials decide who may supply media. Listener authentication decides who may receive it. A secret encoder password does not protect an otherwise public listening URL, and hiding a mount from the status page does not restrict access.

Start with one controlled mount

The classic htpasswd form below is documented in the supplied manual and is handled through compatibility parsing in 2.5.0. It is an excerpt inside <icecast>. Use the version’s role-based configuration when designing a new, more detailed policy; see authentication roles.

<mount type="normal">
  <mount-name>/members.ogg</mount-name>
  <authentication type="htpasswd">
    <option name="filename" value="/ABSOLUTE/PRIVATE/PATH/listeners"/>
    <option name="allow_duplicate_users" value="0"/>
  </authentication>
</mount>

The file path is a replacement and must be outside the served webroot. Use Icecast’s matching administration workflow to create and maintain users rather than assuming every external htpasswd hash format is accepted. The service needs the appropriate file permissions. Keep a recoverable, access-controlled copy when changing user data.

The classic allow_duplicate_users=0 blocks concurrent use of one account for that authenticator. It is not a configurable per-user allowance of five or ten sessions. The 2.5 role model has different controls; do not rename an old option and assume equivalent semantics.

Verify both permission and delivery

Activate the test source. Try the direct listening URL without credentials, with an incorrect password and with a valid test account. Then test the intended standalone player and browser workflow over TLS. HTTP Basic authentication does not encrypt passwords on its own.

Check intro and fallback behaviour as part of the same access policy. A private original stream and a directly reachable public backup are not automatically a private service. Avoid playlists or links containing embedded credentials: they can be copied, logged or retained by clients.

If the source connects but no one can listen, inspect listener authentication and the password file separately from source credentials. If everyone can listen, inspect whether the policy applies to the requested mount, including aliases and fallbacks. For a callback-backed policy, continue with URL authentication.