Securing Your Web Server, Part 3

Last month
we continued our exploration of Web server security, laying out the
details of directory-level access control based upon the client name or
IP address. This month, we'll close out the series on security by
looking at the next higher layer of access control: password protection.

Explicit Access Control

Sooner or later, someone will approach you and ask about individual
access to the documents on a Web server. Usually, someone is excited
about using the Web for information dissemination, but has documents
that are not for general consumption. Financial reports come to mind,
or design documents that you don't want to fall into a competitor's
hands.

For these documents, address-based security is not sufficient. IP
addresses can be spoofed, and more importantly, address-based security
is only as good as the security of the device with the desired address.
If you restrict access to a specific machine based upon its IP address,
but that machine is located in hallway where anyone can walk up and use
it, you have no security at all. Even in more secure areas, someone
could duck into an unused office for ten minutes, download all sorts of
things to a floppy and walk away undetected.

To avoid these scenarios, you can take advantage of the password
protection features supported by most servers, more formally known as
server-based user authentication.

Password basics

The password protection model for servers like NCSA httpd or the Apache server
is fairly straightforward. Using our old friend, the
<limit> directive, in conjunction with a few new
directives for your .htaccess file, you can quickly build
access control lists for all of your documents.

Before forging ahead, let's review what we covered in June
and July.
Server-wide access control is defined in your server's
access.conf file, using the <limit>
directive to define who is allowed to visit your site. For more
fine-grained control, you can place these same directives in a file
named .htaccess in any directory on your server to manage
access for just that directory and any subdirectories within it. So
far, we've learned that the allow, deny, and
order directives let us control access based on the
client's domain name or IP address.

Got that? Good.

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine