Robert B. Denny
<rdenny@netcom.com>The "basic" access/authentication feature allows access restriction based on several criteria:
Per-directory access control means that users with write access to part of the filesystem that is being served can control access to their files as they wish. They need not have root access on the system or write access to the server's primary config files.
Access control for a given directory is controlled by a file (normally) named
#haccess.ctl that resides in that directory. The server
reads this file on each access to a document in that directory (or
documents in subdirectories).
fido with password
bones.
There is no correspondence between
usernames and passwords on specific server systems (e.g. in a
Windows sharing password file, or the NT security system)
and usernames and passwords in the
access control schemes we're discussing for use in the Web. As
illustrated in the examples, Web-based access control uses
wholly distinct password files; a user need
never have an actual account on a given server system in order to
be validated for access to files being served from that system
and protected with HTTP-based access control.
The #haccess.ctl file used in this case is as follows:
AuthUserFile c:/httpd/conf/authusr.pwd AuthGroupFile c:/httpd/conf/empty.pwd AuthName Example AuthType Basic <Limit GET> require user fido </Limit>
Windows Mosaic (2.0a4)
remembers the username
and password you last entered and uses it in subsequent requests. Since the
next example requires a different username and password, it will fail when
you first try it. You
will see the "Authorization Failed" alert. Answer "Yes" to try again, and then
you'll get a chance to enter a new username and password.
rover with
password bacon and user jumpy with
password kibbles.
The #haccess.ctl file used in this case is as follows:
AuthUserFile c:/httpd/conf/authusr.pwd AuthGroupFile c:/httpd/conf/empty.pwd AuthName Example AuthType Basic <Limit GET> require user rover require user jumpy </Limit>
ncsa.uiuc.edu.
The #haccess.ctl file used in this case is as follows:
AuthUserFile c:/httpd/conf/empty.pwd AuthGroupFile c:/httpd/conf/empty.pwd AuthName Example AuthType Basic <Limit GET> order deny,allow deny from all allow from .ncsa.uiuc.edu </Limit>
ncsa.uiuc.edu.
The #haccess.ctl file used in this case is as follows:
AuthUserFile c:/httpd/conf/empty.pwd AuthGroupFile c:/httpd/conf/empty.pwd AuthName Example AuthType Basic <Limit GET> order allow,deny allow from all deny from .ncsa.uiuc.edu </Limit>
turkey to username pumpkin and password
pie. Here's what to do:
#haccess.ctl in directory turkey that looks
like this:AuthUserFile c:/httpd/conf/authusr.pwd AuthGroupFile c:/httpd/conf/empty.pwd AuthName ByPassword AuthType Basic <Limit GET> require user pumpkin </Limit>
The user and group password files
may be located in any directory. The Windows version of httpd requires
a valid filespec for both the user and group password files. The distribution
kit contains a file called empty.pwd which can be used as a placeholder
when password files aren't needed.
AuthName can be anything you want.
AuthType
should always currently be Basic.
c:/httpd/conf/authusr.pwd.
Use the htpasswd program
distributed with NCSA httpd as follows:
htpasswd -c c:\httpd\conf\authusr.pwd pumpkinType the password --
pie -- twice as instructed.
Check the resulting file to get a warm feeling of self-satisfaction;
it should look like this:
pumpkin:y1ia3tjWkhCK2That's all. Now try to access a file in directory
turkey.
The browser should ask for a username and password, and not give you
access to the file if you don't enter pumpkin and
pie. If you are using a browser that doesn't handle
access control, you will not be able to access the document at all.
So basically this method of access control is roughly as safe as
FTP and
telnet-style username and password security -- if you
trust your machine to be on the Internet, open to attempts to
telnet in by anyone who wants to try, then you have no
reason not to trust this method also.
#haccess.ctl file.
Use the htpasswd command without the -c flag
to additional users; e.g.:
htpasswd c:\httpd\conf\authusr.pwd peanuts htpasswd c:\httpd\conf\authusr.pwd almonds htpasswd c:\httpd\conf\authusr.pwd walnuts
Call it c:\httpd\conf\authgrp.pwd and have it look something
like this:
my-users: pumpkin peanuts almonds walnutswhere
pumpkin, peanuts,
almonds, and walnuts are the usernames.
#haccess.ctl
file in the directory to look like this:
AuthUserFile c:/httpd/conf/authusr.pwd AuthGroupFile c:/httpd/conf/authgrp.pwd AuthName ByPassword AuthType Basic <Limit GET> require group my-users </Limit>Note that
AuthGroupFile now points to your group file and
that group my-users (rather than individual user
pumpkin) is now required for access.
my-users can use
his/her individual username and password to gain access to directory
turkey.