From: Rich Bowen
If you wish to restrict access to portions of your site based on the
- host address of your visitors, this is most easily done using
+ host address of your visitors, use
The usage of these directives is: In the first form, address is a fully qualified
domain name (or a partial domain name); you may provide multiple
@@ -85,12 +85,26 @@ Require ip ip.address
partial IP address, a network/netmask pair, or a network/nnn CIDR
specification. Either IPv4 or IPv6 addresses may be used. See the
mod_authz_host documentation for further examples of this
syntax. You can insert Visitors coming from that address ( And, if you'd like to block access from an entire domain,
- you can specify just part of an address or domain name:Access control by host ¶
mod_authz_host.
Require host address
+
Require host address
Require ip ip.address
-
-
+
+Examples of IP address formats
# Full IP address
+Require ip 10.2.3.4
+# Partial IP address (matches any host in the 172.20.0.0/16 range)
+Require ip 172.20
+# Network/netmask pair
+Require ip 192.168.1.0/255.255.255.0
+# Network/CIDR specification
+Require ip 192.168.1.0/24
+# IPv6 address
+Require ip 2001:db8::a00:20ff:fea7:ccea
+# IPv6 with CIDR
+Require ip 2001:db8:1::/48
+not to negate a particular requirement.
- Note, that since a not is a negation of a value, it cannot
+ Since a not is a negation of a value, it cannot
be used by itself to allow or deny a request, as not true
does not constitute false. Thus, to deny a visit using a negation,
the block must have one element that evaluates as true or false.
@@ -98,28 +112,28 @@ Require ip ip.address
board, and you want to keep them out, you could do the
following:<RequireAll>
- Require all granted
- Require not ip 10.252.46.165
+
<RequireAll>
+Require all granted
+Require not ip 10.252.46.165
</RequireAll>
-
+10.252.46.165)
will not be able to see the content covered by this directive. If,
instead, you have a machine name, rather than an IP address, you
can use that.Require not host host.example.com
-
-
+Require not host host.example.com
+
+
Require not ip 192.168.205 -Require not host phishers.example.com moreidiots.example +based on user-agent (the browser type) you might do the following: -Require not ip 192.168.205 +Require not host phishers.example.com badguys.example Require not host gov- +Use of the
@@ -134,17 +148,17 @@ Require not host govRequireAll,RequireAny, andRequireNonedirectives may be used to enforce more complex sets of requirements.
<If "%{HTTP_USER_AGENT} == 'BadBot'">
- Require all denied
+<If "%{HTTP_USER_AGENT} == 'BadBot'">
+Require all denied
</If>
-
+
Using the Require
expr syntax, this could also be written as:
- Require expr %{HTTP_USER_AGENT} != 'BadBot'
-
+Require expr %{HTTP_USER_AGENT} != 'BadBot'
+
Warning:
Access control by User-Agent is an unreliable technique,
@@ -167,11 +181,11 @@ Require not host gov
For example, if you wish to block access to a resource between 8pm
and 7am, you can do this using mod_rewrite.
- RewriteEngine On
+RewriteEngine On
RewriteCond "%{TIME_HOUR}" ">=20" [OR]
RewriteCond "%{TIME_HOUR}" "<07"
RewriteRule "^/fridge" "-" [F]
-
+
This will return a 403 Forbidden response for any request after 8pm
or before 7am. This technique can be used for any criteria that you wish
diff --git a/docs/manual/howto/access.html.fr.utf8 b/docs/manual/howto/access.html.fr.utf8
index eb729ded62..ff02ef8b38 100644
--- a/docs/manual/howto/access.html.fr.utf8
+++ b/docs/manual/howto/access.html.fr.utf8
@@ -27,6 +27,8 @@
es |
fr
+Cette traduction peut être périmée. Vérifiez la version
+ anglaise pour les changements récents.
Le contrôle d'accès fait référence à tout concept de contrôle
d'accès à une ressource quelconque. Il est distinct du processus d'authentification et d'autorisation.
diff --git a/docs/manual/howto/access.xml.es b/docs/manual/howto/access.xml.es
index 91ffca752d..43d4184117 100644
--- a/docs/manual/howto/access.xml.es
+++ b/docs/manual/howto/access.xml.es
@@ -1,7 +1,7 @@
-
+
+
diff --git a/docs/manual/howto/access.xml.meta b/docs/manual/howto/access.xml.meta
index 39cc277557..ee45dee0b6 100644
--- a/docs/manual/howto/access.xml.meta
+++ b/docs/manual/howto/access.xml.meta
@@ -9,6 +9,6 @@
en
es
- fr
+ fr
diff --git a/docs/manual/howto/auth.html.en.utf8 b/docs/manual/howto/auth.html.en.utf8
index 1c81405596..d6521d99dc 100644
--- a/docs/manual/howto/auth.html.en.utf8
+++ b/docs/manual/howto/auth.html.en.utf8
@@ -145,8 +145,8 @@ module from each group.
an AllowOverride directive like the
following:
- AllowOverride AuthConfig
-
+AllowOverride AuthConfig
+
Or, if you are just going to put the directives directly in
your main server configuration file, you will of course need to
@@ -218,13 +218,13 @@ module from each group.
placed in httpd.conf inside a <Directory
"/usr/local/apache/htdocs/secret"> section.
- AuthType Basic
+AuthType Basic
AuthName "Restricted Files"
# (Following line optional)
AuthBasicProvider file
AuthUserFile "/usr/local/apache/passwd/passwords"
Require user rbowen
-
+
Let's examine each of those directives individually. The AuthType directive selects
the method that is used to authenticate the user. The most
@@ -313,14 +313,14 @@ person in AuthType Basic
+AuthType Basic
AuthName "By Invitation Only"
# Optional line:
AuthBasicProvider file
AuthUserFile "/usr/local/apache/passwd/passwords"
AuthGroupFile "/usr/local/apache/passwd/groups"
Require group GroupName
-
+
Now, anyone that is listed in the group GroupName,
and has an entry in the password file, will be let in, if
@@ -330,8 +330,8 @@ Require group GroupName
specific. Rather than creating a group file, you can just use
the following directive:
- Require valid-user
-
+Require valid-user
+
Using that rather than the Require user rbowen
line will allow anyone in that is listed in the password file,
@@ -377,14 +377,14 @@ Require group GroupName
To select a dbm file rather than a text file, for example:
-<Directory "/www/docs/private"> - AuthName "Private" - AuthType Basic - AuthBasicProvider dbm - AuthDBMUserFile "/www/passwords/passwd.dbm" - Require valid-user +scheme that meets your needs. In the following example, both the file and LDAP based authentication providers are being used. -<Directory "/www/docs/private"> +AuthName "Private" +AuthType Basic +AuthBasicProvider dbm +AuthDBMUserFile "/www/passwords/passwd.dbm" +Require valid-user </Directory>- +Other options are available. Consult the
@@ -399,15 +399,15 @@ Require group GroupNamemod_authn_dbmdocumentation for more details.
<Directory "/www/docs/private"> - AuthName "Private" - AuthType Basic - AuthBasicProvider file ldap - AuthUserFile "/usr/local/apache/passwd/passwords" - AuthLDAPURL ldap://ldaphost/o=yourorg - Require valid-user +authorization methods can also be used. In this example both file group authorization as well as LDAP group authorization is being used. -<Directory "/www/docs/private"> +AuthName "Private" +AuthType Basic +AuthBasicProvider file ldap +AuthUserFile "/usr/local/apache/passwd/passwords" +AuthLDAPURL ldap://ldaphost/o=yourorg +Require valid-user </Directory>- +In this example the file provider will attempt to authenticate the user first. If it is unable to authenticate the user, the LDAP @@ -422,17 +422,17 @@ Require group GroupName
<Directory "/www/docs/private"> - AuthName "Private" - AuthType Basic - AuthBasicProvider file - AuthUserFile "/usr/local/apache/passwd/passwords" - AuthLDAPURL ldap://ldaphost/o=yourorg - AuthGroupFile "/usr/local/apache/passwd/groups" - Require group GroupName - Require ldap-group cn=mygroup,o=yourorg +<Directory "/www/docs/private"> +AuthName "Private" +AuthType Basic +AuthBasicProvider file +AuthUserFile "/usr/local/apache/passwd/passwords" +AuthLDAPURL ldap://ldaphost/o=yourorg +AuthGroupFile "/usr/local/apache/passwd/groups" +Require group GroupName +Require ldap-group cn=mygroup,o=yourorg </Directory>- +To take authorization a little further, authorization container directives such as @@ -495,73 +495,15 @@ Require group GroupName
Authentication by username and password is only part of the - story. Frequently you want to let people in based on something - other than who they are. Something such as where they are - coming from.
- -The authorization providers all,
- env, host and ip let you
- allow or deny access based on other host based criteria such as
- host name or ip address of the machine requesting a
- document.
The usage of these providers is specified through the
- Require directive.
- This directive registers the authorization providers
- that will be called during the authorization stage of the request
- processing. For example:
Require ip address -- - -
where address is an IP address (or a partial IP - address) or:
- -Require host domain_name -- - -
where domain_name is a fully qualified domain name - (or a partial domain name); you may provide multiple addresses or - domain names, if desired.
- -For example, if you have someone spamming your message - board, and you want to keep them out, you could do the - following:
- -<RequireAll> - Require all granted - Require not ip 10.252.46.165 -</RequireAll>- - -
Visitors coming from that address will not be able to see - the content covered by this directive. If, instead, you have a - machine name, rather than an IP address, you can use that.
- -<RequireAll> - Require all granted - Require not host host.example.com -</RequireAll>- - -
And, if you'd like to block access from an entire domain, - you can specify just part of an address or domain name:
- -<RequireAll> - Require all granted - Require not ip 192.168.205 - Require not host phishers.example.com moreidiots.example - Require not host ke -</RequireAll>- - -
Using <RequireAll>
- with multiple <Require> directives, each negated with not,
- will only allow access, if all of negated conditions are true. In other words,
- access will be blocked, if any of the negated conditions fails.
all, env,
+ host, and ip with the
+ Require
+ directive.
+ For full details and examples, see the + Access Control howto.
There may be times when authentication puts an unacceptable load
on a provider or on your network. This is most likely to affect users
- of mod_authn_dbd (or third-party/custom providers).
- To deal with this, HTTPD 2.3/2.4 introduces a new caching provider
- mod_authn_socache to cache credentials and reduce
+ of mod_authn_dbd (or third-party/custom providers). The
+ mod_authn_socache module caches credentials and reduces
the load on the origin provider(s).
This may offer a substantial performance boost to some users.
diff --git a/docs/manual/howto/auth.html.fr.utf8 b/docs/manual/howto/auth.html.fr.utf8 index ff5a08b7e4..cf137f9414 100644 --- a/docs/manual/howto/auth.html.fr.utf8 +++ b/docs/manual/howto/auth.html.fr.utf8 @@ -30,6 +30,8 @@ ko | tr +L'authentification est un processus qui vous permet de vérifier
qu'une personne est bien celle qu'elle prétend être. L'autorisation
diff --git a/docs/manual/howto/auth.xml.es b/docs/manual/howto/auth.xml.es
index 458612d6b7..126e3fb07b 100644
--- a/docs/manual/howto/auth.xml.es
+++ b/docs/manual/howto/auth.xml.es
@@ -1,7 +1,7 @@
-
+
+
diff --git a/docs/manual/howto/auth.xml.ja b/docs/manual/howto/auth.xml.ja
index be59176f6b..cf9b03da24 100644
--- a/docs/manual/howto/auth.xml.ja
+++ b/docs/manual/howto/auth.xml.ja
@@ -1,7 +1,7 @@
-
+
+
+
+
diff --git a/docs/manual/howto/cgi.xml.fr b/docs/manual/howto/cgi.xml.fr
index da80a744a8..15a81e4b7a 100644
--- a/docs/manual/howto/cgi.xml.fr
+++ b/docs/manual/howto/cgi.xml.fr
@@ -1,7 +1,7 @@
-
+
diff --git a/docs/manual/howto/cgi.xml.ja b/docs/manual/howto/cgi.xml.ja
index bfa687f378..aac22f2f3b 100644
--- a/docs/manual/howto/cgi.xml.ja
+++ b/docs/manual/howto/cgi.xml.ja
@@ -1,7 +1,7 @@
-
+
+
+
+
diff --git a/docs/manual/howto/htaccess.xml.ja b/docs/manual/howto/htaccess.xml.ja
index 8672a8c445..016f3922a0 100644
--- a/docs/manual/howto/htaccess.xml.ja
+++ b/docs/manual/howto/htaccess.xml.ja
@@ -1,7 +1,7 @@
-
+
+
+
+
+
diff --git a/docs/manual/howto/http2.xml.meta b/docs/manual/howto/http2.xml.meta
index cd0a8de064..9b93a6fba0 100644
--- a/docs/manual/howto/http2.xml.meta
+++ b/docs/manual/howto/http2.xml.meta
@@ -9,6 +9,6 @@
http://example.com/~username/ will get content
out of the home directory of the user "username", out of
the subdirectory specified by the UserDir directive.
Note that, by default, access to these directories is not +
By default, access to these directories is not
enabled. You can enable access when using UserDir by uncommenting the line:
#Include conf/extra/httpd-userdir.conf- +
#Include conf/extra/httpd-userdir.conf+
in the default config file conf/httpd.conf, and adapting the httpd-userdir.conf
file as necessary, or by including the appropriate directives in a
<Directory> block
within the main config file.
mod_userdir
+ configuration in a separate file, and may enable it by default.
+ Check your distribution's documentation for specifics. The examples
+ in this document assume a default source build of httpd.
Per-user web directories
Setting the file path with UserDirUserDir public_html- +
UserDir public_html+
the URL http://example.com/~rbowen/file.html will be
translated to the file path
@@ -82,8 +88,8 @@
constructed using that path, plus the username specified. Given this
configuration:
UserDir /var/html- +
UserDir /var/html+
the URL http://example.com/~rbowen/file.html will be
translated to the file path /var/html/rbowen/file.html
UserDir /var/www/*/docs- +
UserDir /var/www/*/docs+
the URL http://example.com/~rbowen/file.html will be
translated to the file path
@@ -101,14 +107,14 @@
Multiple directories or directory paths can also be set.
-UserDir public_html /var/html- +
UserDir public_html /var/html+
For the URL http://example.com/~rbowen/file.html,
- Apache will search for ~rbowen. If it isn't found,
- Apache will search for rbowen in /var/html. If
- found, the above URL will then be translated to the file path
- /var/html/rbowen/file.html
The arguments are considered in the order they appear.
+ For the URL http://example.com/~rbowen/file.html,
+ httpd will search for ~rbowen. If it isn't found,
+ httpd will then search for rbowen in /var/html.
+ The file will be served from whichever location is found first.
The UserDir directive can be
used to redirect user directory requests to external URLs.
UserDir http://example.org/users/*/- +
UserDir http://example.org/users/*/+
The above example will redirect a request for
http://example.com/~bob/abc.html to
@@ -132,17 +138,17 @@
Using the syntax shown in the UserDir documentation, you can restrict what users are permitted to use this functionality:
-UserDir disabled root jro fish- +
UserDir disabled root jro fish+
The configuration above will enable the feature for all users
except for those listed in the disabled statement.
You can, likewise, disable the feature for all but a few users by
using a configuration like the following:
UserDir disabled +UserDir disabled UserDir enabled rbowen krietz- +See
@@ -152,16 +158,16 @@ UserDir enabled rbowen krietzUserDirdocumentation for additional examples.
In order to give each user their own cgi-bin directory, you can use +
To give each user their own cgi-bin directory, you can use
a <Directory>
directive to make a particular subdirectory of a user's home directory
cgi-enabled.
<Directory "/home/*/public_html/cgi-bin/"> - Options ExecCGI - SetHandler cgi-script +<Directory "/home/*/public_html/cgi-bin/"> +Options ExecCGI +SetHandler cgi-script </Directory>- +Then, presuming that
UserDiris set topublic_html, a cgi programexample.cgi@@ -176,7 +182,7 @@ UserDir enabled rbowen krietz
If you want to allows users to modify the server configuration in +
If you want to allow users to modify the server configuration in
their web space, they will need to use .htaccess files to
make these changes. Ensure that you have set AllowOverride to a
value sufficient for the directives that you want to permit the users
diff --git a/docs/manual/howto/public_html.html.es.utf8 b/docs/manual/howto/public_html.html.es.utf8
index da0883672b..d47e6f0a02 100644
--- a/docs/manual/howto/public_html.html.es.utf8
+++ b/docs/manual/howto/public_html.html.es.utf8
@@ -30,6 +30,10 @@
ko |
tr
En sistemas con múltiples usuarios, cada usuario puede tener un website
en su directorio home usando la directiva UserDir. Los visitantes de una URL
diff --git a/docs/manual/howto/public_html.html.fr.utf8 b/docs/manual/howto/public_html.html.fr.utf8
index c1171a977a..e61a7206c5 100644
--- a/docs/manual/howto/public_html.html.fr.utf8
+++ b/docs/manual/howto/public_html.html.fr.utf8
@@ -30,6 +30,8 @@
ko |
tr
Sur les systèmes multi-utilisateurs, on peut permettre à chaque utilisateur d'avoir un site web dans son répertoire home à l'aide de la diff --git a/docs/manual/howto/public_html.xml.es b/docs/manual/howto/public_html.xml.es index e0a374cab2..1088f3f58f 100644 --- a/docs/manual/howto/public_html.xml.es +++ b/docs/manual/howto/public_html.xml.es @@ -1,7 +1,7 @@ - + diff --git a/docs/manual/howto/public_html.xml.fr b/docs/manual/howto/public_html.xml.fr index c871f64533..40bdcccc41 100644 --- a/docs/manual/howto/public_html.xml.fr +++ b/docs/manual/howto/public_html.xml.fr @@ -1,7 +1,7 @@ - + diff --git a/docs/manual/howto/public_html.xml.ja b/docs/manual/howto/public_html.xml.ja index 2dc2f64a41..2e4cacb357 100644 --- a/docs/manual/howto/public_html.xml.ja +++ b/docs/manual/howto/public_html.xml.ja @@ -1,7 +1,7 @@ - + + + + diff --git a/docs/manual/howto/reverse_proxy.xml.fr b/docs/manual/howto/reverse_proxy.xml.fr index 4a68e858cd..0447142cb3 100644 --- a/docs/manual/howto/reverse_proxy.xml.fr +++ b/docs/manual/howto/reverse_proxy.xml.fr @@ -1,7 +1,7 @@ - + + + diff --git a/docs/manual/howto/ssi.xml.ja b/docs/manual/howto/ssi.xml.ja index 5cfe9bd574..a7f22c805d 100644 --- a/docs/manual/howto/ssi.xml.ja +++ b/docs/manual/howto/ssi.xml.ja @@ -1,7 +1,7 @@ - + +