Add
the following to the .htaccess file:
<Limit GET>
order allow,deny
deny from 128.23.45.
deny from 207.158.255.213
allow from all
</Limit>
This is an example of a .htaccess file that
will block access to your site to anyone who
is coming from any IP address beginning with
128.23.45 and from the specific IP address
207.158.255.213 . By specifying only part of
an IP address, and ending the partial IP
address with a period, all sub-addresses
coming from the specified IP address block
will be blocked. You must use the IP addresses
to block access, use of domain names is not
supported.
This
should help you set up protection on a
directory via the Basic HTTP Authentication
method. This method also uses the standard
plaintext password file.
So let's suppose you want to restrict files in
a directory called turkey to username pumpkin
and password pie. Here's what to do:
Create a file called .htaccess in directory
turkey that looks like this:
AuthUserFile /home/someuser/www/.htpasswd
AuthGroupFile /dev/null
AuthName ByPassword
AuthType Basic
<Limit
GET>
require user pumpkin
</Limit>
Note
that the password file will be in another
directory (/home/someuser/www).
AuthUserFile must be the full Unix pathname of
the password file.
Also note that in this case there is no group
file, so we specify
/dev/null (the standard Unix way to say
"this file doesn't exist").
AuthName can be anything you want. The
AuthName field gives the Realm name for which
the protection is provided. This name is
usually given when a browser prompts for a
password, and is also usually used by a
browser in correlation with the URL to save
the password information you enter so that it
can authenticate automatically on the next
challenge.
AuthType should be set to Basic, since we are
using Basic HTTP Authentication. Other
possibilities for are PEM, PGP, KerberosV4,
KerberosV5, or Digest. These would specific to
a custom install
In this example, only the method GET is
restricted using the LIMIT directive. To limit
other methods (particularly in CGI
directories), you can specify them separated
by spaces in the LIMIT directive. For example:
<LIMIT
GET POST PUT>
require user pumpkin
</LIMIT>
If
you only use GET protection for a CGI script,
you may be finding that the REMOTE_USER
environment variable is not getting set when
using METHOD="POST", obviously
because the directory isn't protected against
POST.
Create the password file /home/someuser/www/.htpasswd
The
easiest way to do this is to use the htpasswd
program distributed with HTTPd. Do this:
htpasswd -c /home/someuser/www/.htpasswd
pumpkin
Type
the password -- pie -- twice as instructed.
Check the resulting file to get a warm feeling
of self-satisfaction; it should look like
this:
pumpkin:y1ia3tjWkhCK2
That's
all. Now try to access a file in directory
turkey -- your browser should demand a
username and password, and not give you access
to the file if you don't enter pumpkin and
pie. If you are using a browser that doesn't
handle authentication, you will not be able to
access the document at all.
Advanced
Accecss Control
Multiple Usernames/Passwords
If
you want to give access to a directory to more
than one username/password pair, follow the
same steps as for a single username/password
with the following additions:
Add additional users to the directory's .htpasswd
file.
Use the htpasswd command without the -c flag
to add additional users; e.g.:
htpasswd /home/someuser/www/.htpasswd peanuts
htpasswd /home/someuser/www/.htpasswd almonds
htpasswd /home/someuser/www/.htpasswd walnuts
Create
a group file.
Call it /home/someuser/www/.htgroup and have
it look something like this:
my-users: pumpkin peanuts almonds walnuts
...
where pumpkin, peanuts, almonds, and walnuts
are the usernames.
Then modify the .htaccess file in the
directory to look like this:
AuthUserFile /home/someuser/www/.htpasswd
AuthGroupFile /home/someuser/www/.htgroup
AuthName ByPassword
AuthType Basic
<Limit
GET>
require group my-users
</Limit>
Note
that AuthGroupFile now points to your group
file and that group my-users (rather than
individual user pumpkin) is now required for
access.
That's it. Now any user in group my-users can
use his/her individual username and password
to gain access to directory turkey.
Following are several examples of the range of
access authorization capabilities available.
Protection by network domain.
This document is only accessible to clients
running on machines inside domain
netbasiks.com.
AuthUserFile /dev/null
AuthGroupFile /dev/null
AuthName ExampleAllowFromnetbasiks
AuthType Basic
<Limit
GET>
order deny,allow
deny from all
allow from .netbasiks.com
</Limit>
Protection
by network domain -- exclusion.
This document is accessible to clients running
on machines anywhere but inside domain
verio.net
AuthUserFile /dev/null
AuthGroupFile /dev/null
AuthName ExampleDenyFromVerio
AuthType Basic
<Limit
GET>
order allow,deny
allow from all
deny from .verio.net
</Limit>
