Configuring mod_access in Apache
mod_access in Apache
You can use Apache's mod_access module to restrict
access to information on the server based on client
hostname, IP address, or other client information that
can be captured using environment variables. To
configure mod_access, you must set Apache server
directives in the httpd.conf file.
There are two directives used for mod_access: allow
and deny. Deny is expressed using the following
syntax:
Deny from host
Where host can be any one of the following:
-
All
Does not allow any host to have access to the specified resource. May be used in combination with allow to create fine-grained security policies.<code>Deny from all</code>
-
Hostname
Restricts access from a particular host or Internet domain. Note that this requires Apache to do a DNS lookup every time it processes this directive, potentially slowing the system down considerably.Deny from mail.spam.com Deny from evil.com Deny from .gov
-
IP Address
Like the hostname directive, denies access to a particular computer or a particular network of computers. However, Apache can process access control using IP address information much more rapidly than with hostname information. IP addresses can also be restricted according to subnet mask.Deny from 63.206.192.87 Deny from 192.168. Deny from 10. Deny from 10.0.1.0/255.255.0.0
The opposite of deny is allow. Using the allow
directive lets you configure which hosts are to be
allowed access to the intranet. The arguments used are
identical to those of the deny directive.
The deny and allow directives are not mutually
exclusive. In fact, for most access control
applications, you'll probably want to use both. To
make this work, you must tell Apache whether to
process deny directives before allow, or vice versa.
That's where the Order directive comes in:
-
Order deny,allow
Process the deny directive first, then allow directive -
Order allow,deny
Process the allow directive first, then deny
For example, if I had a directory on the
paulsholtz.com Web server called "paul," and I wanted
to allow only users from the paulsholtz.com domain
access to this directory, I could add the following
directive to the httpd.conf file:
<Directory /paul>
Order deny,allow
Deny from all
Allow from paulsholtz.com
</Directory>
This lets me set a default deny access control policy, and allow only users from hosts attached to the paulsholtz.com domain.
--PS
