Another gotcha when migrating from apache 1.x to 2.x: The included htpasswd command will generate an .htpasswd with no group or world read bits: -rw-------. You will of course not notice this for a very long time, though it will seem obvious in retrospect. When your .htaccess auth doesn’t work, you will think the .htaccess syntax has changed, but not be able to figure out where. It hasn’t. But the Apache 2 docs don’t mention jack.
Music: The Fall :: Spectre Versus Rector
Are you sure that your umask wasn’t set to 077 on the machine? I noticed the same thing when I last used htpasswd, but I also remembered that I kept my umask set to 077 so I have to explicitly give group and world access to my files.
If I understand correctly, this tells me that umask is not the problem:
$ umask -S
u=rwx,g=rx,o=rx
Also:
$touch foo
gives me a “foo” with -rw-r–r–
Then you are a-ok. :)