October 17, 2001, 11:12 AM — Last month
we continued our exploration of Web server security, laying out the
details of directory-level access control based upon the client name or
IP address. This month, we'll close out the series on security by
looking at the next higher layer of access control: password protection.
Explicit Access Control
Sooner or later, someone will approach you and ask about individual
access to the documents on a Web server. Usually, someone is excited
about using the Web for information dissemination, but has documents
that are not for general consumption. Financial reports come to mind,
or design documents that you don't want to fall into a competitor's
hands.
For these documents, address-based security is not sufficient. IP
addresses can be spoofed, and more importantly, address-based security
is only as good as the security of the device with the desired address.
If you restrict access to a specific machine based upon its IP address,
but that machine is located in hallway where anyone can walk up and use
it, you have no security at all. Even in more secure areas, someone
could duck into an unused office for ten minutes, download all sorts of
things to a floppy and walk away undetected.
To avoid these scenarios, you can take advantage of the password
protection features supported by most servers, more formally known as
server-based user authentication.
Password basics
The password protection model for servers like NCSA httpd or the Apache server
is fairly straightforward. Using our old friend, the
<limit> directive, in conjunction with a few new
directives for your .htaccess file, you can quickly build
access control lists for all of your documents.
Before forging ahead, let's review what we covered in June
and July.
Server-wide access control is defined in your server's
access.conf file, using the <limit>
directive to define who is allowed to visit your site. For more
fine-grained control, you can place these same directives in a file
named .htaccess in any directory on your server to manage
access for just that directory and any subdirectories within it. So
far, we've learned that the allow, deny, and
order directives let us control access based on the
client's domain name or IP address.
Got that? Good.
The httpd password model closely parallels the Unix password
scheme. That is, you can define individual users who are given access
to a set of documents, and you can define groups of users to be granted
access. Two files, one containing the users and another containing the
groups, are needed for each directory you want to protect.
A simple example
The easiest way to see how password protection works is to look at a
simple example.
Suppose we have a directory whose contents are to be restricted to three
users: larry, curly, and moe. As a first step, within this directory,
create a .htaccess file that looks like this:
AuthUserFile /someplace/else/htpasswd
AuthGroupFile /dev/null
AuthName Stooges
AuthType Basic
<limit>
require user larry curly moe
</limit>
Yikes! What does all this mean? Don't panic; it all makes sense:
