# yb-master fails to start with --webserver\_password\_file on v2025.2.3.0-b149: Invalid option global\_passwords\_file

**URL:** https://forum.yugabyte.com/t/yb-master-fails-to-start-with-webserver-password-file-on-v2025-2-3-0-b149-invalid-option-global-passwords-file/5012
**Category:** General
**Created:** [June 6, 2026, 7:33am UTC](https://forum.yugabyte.com/t/yb-master-fails-to-start-with-webserver-password-file-on-v2025-2-3-0-b149-invalid-option-global-passwords-file/5012 "2026-06-06T07:33:10Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![ivanchevskaya](https://avatars.discourse-cdn.com/v4/letter/i/858c86/32.png) [@ivanchevskaya](https://forum.yugabyte.com/u/ivanchevskaya)
#### Post date: [June 6, 2026, 7:33am UTC](https://forum.yugabyte.com/t/yb-master-fails-to-start-with-webserver-password-file-on-v2025-2-3-0-b149-invalid-option-global-passwords-file/5012/1 "2026-06-06T07:33:10Z")

</div>

Hi Yugabyte team,

We are trying to enable basic authentication for the YugabyteDB Web UI using the documented flags:

```auto
--webserver_password_file=/etc/yugabyte/.htpasswd
--webserver_authentication_domain=YugabyteDB

```

Environment:

```auto
YugabyteDB version: 2025.2.3.0-b149
Component: yb-master
Web UI port: 7000
OS/container: Oracle Linux based container

```

The `.htpasswd` file exists on the instance and contains a bcrypt hash for the `yugabyte` user. The file is readable by the process. (`yugabyte:hash`)

When these two flags are added to `master.conf`, `yb-master` fails to start. The logs show:

```auto
Starting webserver on 0.0.0.0:7000
Document root: /opt/yugabyte-2025.2.3.0/www
Webserver: Password file is /etc/yugabyte/.htpasswd
Webserver listen spec is 0.0.0.0:7000
Webserver: Invalid option: global_passwords_file
Webserver: Could not start on address 0.0.0.0:7000

```

If we remove the authentication flags from `master.conf`, `yb-master` starts successfully, ports `7000` and `7100` are listening, and the Web UI returns `HTTP 200`.

Could you please confirm whether this is a known bug in `2025.2.3.0-b149` and whether there is a fixed version available or planned?

Also, is there any currently supported way to enable authentication for `yb-master` and `yb-tserver` Web UI ports `7000` and `9000`, or is the recommended approach to protect these ports using an external reverse proxy/auth layer?

Thanks.

---

<div class="post-metadata">

### Author: ![dorian\_yugabyte](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.yugabyte.com/dorian_yugabyte/32/206_2.png) [@dorian\_yugabyte](https://forum.yugabyte.com/u/dorian_yugabyte)
#### Post date: [June 6, 2026, 8:17am UTC](https://forum.yugabyte.com/t/yb-master-fails-to-start-with-webserver-password-file-on-v2025-2-3-0-b149-invalid-option-global-passwords-file/5012/2 "2026-06-06T08:17:03Z")

</div>

Hi @ivanchevskaya

Thank you for the report, I filed this bug report [[DocDB] yb-master/yb-tserver fail to start when --webserver\_password\_file is set (Web UI auth) · Issue #32074 · yugabyte/yugabyte-db · GitHub](https://github.com/yugabyte/yugabyte-db/issues/32074).

> [@ivanchevskaya](#):
>
> Also, is there any currently supported way to enable authentication for `yb-master` and `yb-tserver` Web UI ports `7000` and `9000`, or is the recommended approach to protect these ports using an external reverse proxy/auth layer?

A reverse proxy is the recommended approach for now.