|
As you may expect, restricting access to your Apache server is more complicated when compared to the desktop servers. The simplest and most direct way to restrict access requires you to create .htaccess files within the restricted directories. These .htaccess files are exactly like the instructions in your access.conf file except they do not require the <Directory></Directory> nor <Location></Location> directive tags.
IP and domain name restrictions
Below is a simple sample .htaccess file restricting access based on addresses. The first line specifies that all GET and POST queries will be restricted. Next, the restrictions will be processed in the deny-allow order since later configurations override earlier ones. Then the hosts and/or IP address that are denied and allowed are specified. Finally, the file is closed.
# this is an .htaccess file for IP addresses
# limit the types of access
<Limit GET POST>
# define how restriction will be processed
order deny,allow
# define who to deny and allow
deny from all
allow from .ncsu.edu
# close the directive
</Limit>
Usernames and passwords
Restricting access based on usernames and passwords first requires you to define users and sets of users called groups. Then you create .htaccess files specifying these users and/or groups.
If it hasn't been done before, you will have to compile the htpasswd program. It is located in the support directory of your original distribution. To compile the program change directories to the support directory and enter make. This should result in the creation of a number of utilities one of which is htpasswd.
For the .htaccess technique to work, you must edit your access.conf file and specify parent directories of your restricted directories with the AllowOverride Limit option.
Next, using htpasswd you will create new users. The command takes the following form:
htpasswd [-c] filename username
where:
-c
- This is used only the first time
htpasswd is used. Its purpose is to create the password file
- filename
- This is the full path name to your password file. It can be any path or name, but make sure it is not in your server's document directory structure. Example:
/usr/local/apache/conf/passwd
- username
- This is the name of the user you are creating. Example:
eric
After this, you have to create groups. Groups are ASCII text files with the following form:
group: member member member
where:
- group
- This is the name of a group. Example:
users
- member
- This is the name of somebody previously defined by the
htpasswd program. Example: eric
Now you are finally ready to create your .htaccess file. Specify the realm using AuthName. The value of AuthName will appear in the message asking for username and password. Specify the authorization type with AuthType. (The majority of the time this will be Basic.) Echo the location of your password and group files next. Define the restricted methods of access. Specify what groups and users have access to this directory. Last, close the directive.
Here is a example .htaccess file limiting users to passwords.
# this is an .htaccess file for passwords
# define the realm
AuthName The Super Secret Space
# define the authentication type
AuthType Basic
# where are the password and group file
AuthUserFile /usr/local/users/Eric/apache/conf/passwd
AuthGroupFile /usr/local/users/Eric/apache/conf/group
# limit the types of access
<Limit GET POST>
# say exactly who can access
require group users
# close the directive
</Limit>
Once this sort of .htaccess file is saved in a directory, the first time a user tries to access the directory they will be asked to enter their username and password.
|
