Securing Your Web Server, Part 3
Last month
we continued our exploration of Web server security, laying out the
details of directory-level access control based upon the client name or
IP address. This month, we'll close out the series on security by
looking at the next higher layer of access control: password protection.
Explicit Access Control
Sooner or later, someone will approach you and ask about individual
access to the documents on a Web server. Usually, someone is excited
about using the Web for information dissemination, but has documents
that are not for general consumption. Financial reports come to mind,
or design documents that you don't want to fall into a competitor's
hands.
For these documents, address-based security is not sufficient. IP
addresses can be spoofed, and more importantly, address-based security
is only as good as the security of the device with the desired address.
If you restrict access to a specific machine based upon its IP address,
but that machine is located in hallway where anyone can walk up and use
it, you have no security at all. Even in more secure areas, someone
could duck into an unused office for ten minutes, download all sorts of
things to a floppy and walk away undetected.
To avoid these scenarios, you can take advantage of the password
protection features supported by most servers, more formally known as
server-based user authentication.
Password basics
The password protection model for servers like NCSA httpd or the Apache server
is fairly straightforward. Using our old friend, the
<limit> directive, in conjunction with a few new
directives for your .htaccess file, you can quickly build
access control lists for all of your documents.
Before forging ahead, let's review what we covered in June
and July.
Server-wide access control is defined in your server's
access.conf file, using the <limit>
directive to define who is allowed to visit your site. For more
fine-grained control, you can place these same directives in a file
named .htaccess in any directory on your server to manage
access for just that directory and any subdirectories within it. So
far, we've learned that the allow, deny, and
order directives let us control access based on the
client's domain name or IP address.
Got that? Good.
Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world
jfruh
Apple syncing patent can't come soon enough
pasmith
New Twitter features borrow from 3rd party clients
Esther Schindler
Open Source Changes the Software Acquisition Process
mikelgan
How to set up continuous podcast play on the new iTunes
David Strom
Five important Windows 7 mobility features
sjvn
Guard your Wi-Fi for your own sake
Sandra Henry-Stocker
Grepping on Whole Words
Sidekick: The Good News & the Bad News
Either way you look at it Microsoft Data Center management did not follow standards or best practices in this failure. In which case it makes me wonder more about the outsourcing of corporate data much less personal data.
- mburton325
Join the conversation here
Quick, practical advice for IT pros. Made fresh daily.
Want to cash in on your IT savvy? Send your tip to tips@itworld.com. If we post it, we'll send you a $25 Amazon e-gift card.












