Look at the auth.c file for the password format.
The password needs to be created with the command htpasswd (not passwd) which is the password generator used for apache. I think you need apache package installed on your developement host for the command htpasswd.
In the boa sources EMBED is the default directive. This is fine for embedded systems but the password that is accepted is somewhat strange (only 1 user),
therefore I changed this in the auth.c file so that also EMBED is compatible to the password generation with htpasswd.
Read the whole story on my homepage (
http://www.8ung.at/nacide_manfred/linuxtutorial.html#boawebserver)