The above example uses the <MatchNotAny> container directive to make sure that none of the - Match directives + Match directives match their parameters before granting access. Note that the Match all granted directive and the <MatchNotAny> are implicitly contained diff --git a/docs/manual/howto/auth.xml.ja b/docs/manual/howto/auth.xml.ja index e060a5cdaf3..21928bbad59 100644 --- a/docs/manual/howto/auth.xml.ja +++ b/docs/manual/howto/auth.xml.ja @@ -1,7 +1,7 @@ - + + +mod_buffer - Apache HTTP Server + + + + + +

Apache Module mod_buffer

Available Languages: en

+ + + + +

Description:	Support for request buffering
Status:	Extension
Module Identifier:	buffer_module
Source File:	mod_buffer.c
Compatibility:	Available in Apache 2.3 and later

Summary

+ +

This module provides the ability to buffer the input and output + filter stacks.

+ +

Under certain circumstances, content generators might create + content in small chunks. In order to promote memory reuse, in + memory chunks are always 8k in size, regardless of the size of the + chunk itself. When many small chunks are generated by a request, + this can create a large memory footprint while the request is + being processed, and an unnecessarily large amount of data on the + wire. The addition of a buffer collapses the response into the + fewest chunks possible.

+ +

When httpd is used in front of an expensive content generator, + buffering the response may allow the backend to complete + processing and release resources sooner, depending on how the + backend is designed.

+ +

The buffer filter may be added to either the input or the + output filter stacks, as appropriate, using the + SetInputFilter, + SetOutputFilter, + AddOutputFilter or + AddOutputFilterByType directives.

+ +

Using buffer with mod_include

+ AddOutputFilterByType INCLUDES;BUFFER text/html +

+ +

Directives

BufferSize

BufferSize Directive

+ + + + + + + +

Description:	Maximum size in bytes to buffer by the buffer filter
Syntax:	`BufferSize integer`
Default:	`BufferSize 131072`
Context:	server config, virtual host, directory, .htaccess
Status:	Extension
Module:	mod_buffer

The BufferSize + directive specifies the amount of data in bytes that will be + buffered before being read from or written to each request. + The default is 128 kilobytes.

+ +

Apache Module mod_privileges

Available Languages: en

+ + + +

Description:	Support for Solaris privileges and for running virtual hosts +under different user IDs.
Status:	Experimental
Module Identifier:	privileges_module
Compatibility:	Available in Apache 2.3 and up, on Solaris 10 and +OpenSolaris platforms

Summary

+ +

This module enables different Virtual Hosts to run with different +Unix™ User and Group IDs, and with different +Solaris Privileges. In particular, it offers a solution to the +problem of privilege separation between different Virtual Hosts, first +promised by the abandoned perchild MPM. +It also offers other security enhancements.

+ +

Unlike perchild, mod_privileges +is not itself an MPM. It works within a processing model to +set privileges and User/Group per request in a running process. +It is therefore not compatible with a threaded MPM, and will refuse +to run under one.

+ +

mod_privileges raises security issues similar to +those of suexec. But unlike suexec, +it applies not only to CGI programs but to the entire request processing +cycle, including in-process applications and subprocesses. +It is ideally suited to running PHP applications under mod_php, +which is also incompatible with threaded MPMs. It is also well-suited +to other in-process scripting applications such as mod_perl, +mod_python, and mod_ruby, and to +applications implemented in C as apache modules where privilege +separation is an issue.

+ +

+ +

DTracePrivileges Directive

+ + + + + + + + +

Description:	Determines whether the privileges required by dtrace are enabled.
Syntax:	`DTracePrivileges On\|Off`
Default:	`DTracePrivileges Off`
Context:	server config
Status:	Experimental
Module:	mod_privileges
Compatibility:	Available on Solaris 10 and OpenSolaris with +non-threaded MPMs (`prefork` or custom MPM).

This server-wide directive determines whether Apache will run with + the privileges required to run + dtrace. + Note that DTracePrivileges On will not in itself + activate DTrace, but DTracePrivileges Off will prevent + it working.

+ +

VHostCGIMode Directive

+ + + + + + + + +

Description:	Determines whether the virtualhost can run +subprocesses, and the privileges available to subprocesses.
Syntax:	`VHostCGIMode On\|Off\|Secure`
Default:	`VHostCGIMode On`
Context:	virtual host
Status:	Experimental
Module:	mod_privileges
Compatibility:	Available on Solaris 10 and OpenSolaris with +non-threaded MPMs (`prefork` or custom MPM).

Determines whether the virtual host is allowed to run fork and exec, + the privileges required to run subprocesses. If this is set to + Off the virtualhost is denied the privileges and will not + be able to run traditional CGI programs or scripts under the traditional + mod_cgi, nor similar external programs such as those + created by mod_ext_filter or + RewriteMap prog. + Note that it does not prevent CGI programs running under alternative + process and security models such as mod_fcgid, which is a recommended solution in Solaris.

If set to On or Secure, the virtual host + is permitted to run external programs and scripts as above. + Setting VHostCGIMode Secure has + the effect of denying privileges to the subprocesses, as described + for VHostSecure.

+ +

VHostCGIPrivs Directive

+ + + + + + + + +

Description:	Assign arbitrary privileges to subprocesses created +by a virtual host.
Syntax:	`VHostPrivs [+-]?privilege-name [[+-]?privilege-name] ...`
Default:	`None`
Context:	virtual host
Status:	Experimental
Module:	mod_privileges
Compatibility:	Available on Solaris 10 and OpenSolaris with +non-threaded MPMs (`prefork` or custom MPM) +and when `mod_privileges` is compiled with the +`BIG_SECURITY_HOLE` compile-time option.

VHostCGIPrivs can be used to assign arbitrary privileges to subprocesses created by a virtual host, as discussed + under VHostCGIMode. Each privilege-name + is the name of a Solaris privilege, such as file_setid + or sys_nfs.

+ +

A privilege-name may optionally be prefixed by + + or -, which will respectively allow or deny a privilege. + If used with neither + nor -, all privileges otherwise assigned + to the virtualhost will be denied. You can use this to override + any of the default sets and construct your own privilege set.

+ +

Security

This directive can open huge security holes in apache subprocesses, + up to and including running them with root-level powers. Do not + use it unless you fully understand what you are doing!

+ +

VHostGroup Directive

+ + + + + + + + +

Description:	Sets the Group ID under which a virtual host runs.
Syntax:	`VHostGroup unix-groupid`
Default:	`Inherits the group id specified in +Group`
Context:	virtual host
Status:	Experimental
Module:	mod_privileges
Compatibility:	Available on Solaris 10 and OpenSolaris with +non-threaded MPMs (`prefork` or custom MPM).

The VHostGroup directive sets the Unix group + under which the server will process requests to a virtualhost. + The group is set before the request is processed and reset afterwards + using Solaris Privileges. Since the setting applies to the + process, this is not compatible with threaded MPMs.

Unix-group is one of:

A group name: Refers to the given group by name.
# followed by a group number.: Refers to a group by its number.

+ +

Security

This directive cannot be used to run apache as root! + Nevertheless, it opens potential security issues similar to + those discussed in the suexec + documentation.

+ +

VHostPrivs Directive

+ + + + + + + + +

Description:	Assign arbitrary privileges to a virtual host.
Syntax:	`VHostPrivs [+-]?privilege-name [[+-]?privilege-name] ...`
Default:	`None`
Context:	virtual host
Status:	Experimental
Module:	mod_privileges
Compatibility:	Available on Solaris 10 and OpenSolaris with +non-threaded MPMs (`prefork` or custom MPM). +and when `mod_privileges` is compiled with the +`BIG_SECURITY_HOLE` compile-time option.

VHostPrivs can be used to assign arbitrary privileges to a virtual host. Each privilege-name + is the name of a Solaris privilege, such as file_setid + or sys_nfs.

+ +

Security

This directive can open huge security holes in apache, up to + and including running requests with root-level powers. Do not + use it unless you fully understand what you are doing!

+ +

VHostSecure Directive

+ + + + + + + + +

Description:	Determines whether the server runs with enhanced security +for the virtualhost.
Syntax:	`VHostSecure On\|Off`
Default:	`VHostSecure On`
Context:	virtual host
Status:	Experimental
Module:	mod_privileges
Compatibility:	Available on Solaris 10 and OpenSolaris with +non-threaded MPMs (`prefork` or custom MPM).

Determines whether the virtual host processes requests with + security enhanced by removal of Privileges that are rarely needed in a webserver, but which are + available by default to a normal Unix user and may therefore + be required by modules and applications. It is recommended that + you retain the default (On) unless it prevents an application running. + Since the setting applies to the process, this is not + compatible with threaded MPMs.

Note

If VHostSecure prevents an application + running, this may be a warning sign that the application should be + reviewed for security.

+ +

VHostUser Directive

+ + + + + + + + +

Description:	Sets the User ID under which a virtual host runs.
Syntax:	`VHostUser unix-userid`
Default:	`Inherits the userid specified in +User`
Context:	virtual host
Status:	Experimental
Module:	mod_privileges
Compatibility:	Available on Solaris 10 and OpenSolaris with +non-threaded MPMs (`prefork` or custom MPM).

The VHostUser directive sets the Unix userid + under which the server will process requests to a virtualhost. + The userid is set before the request is processed and reset afterwards + using Solaris Privileges. Since the setting applies to the + process, this is not compatible with threaded MPMs.

Unix-userid is one of:

A username: Refers to the given user by name.
# followed by a user number.: Refers to a user by its number.

+ +

Security

This directive cannot be used to run apache as root! + Nevertheless, it opens potential security issues similar to + those discussed in the suexec + documentation.

+ +

Apache Module mod_buffer

Summary

Using buffer with mod_include

Directives

See also

BufferSize Directive

Apache Module mod_privileges

Summary

Directives

DTracePrivileges Directive

VHostCGIMode Directive

VHostCGIPrivs Directive

Security

VHostGroup Directive

Security

See also

VHostPrivs Directive

Security

VHostSecure Directive

Note

VHostUser Directive

Security

See also