httpd-cvs mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
Subject cvs commit: httpd-2.0/docs/manual/howto auth.html
Date Wed, 05 Sep 2001 01:40:18 GMT
rbowen      01/09/04 18:40:17

  Added:       docs/manual/howto auth.html
  First cut at authentication tutorial. Need to add section about
  alternate authentication modules such as mod_auth_db, but this is a
  decent start.
  Revision  Changes    Path
  1.1                  httpd-2.0/docs/manual/howto/auth.html
  Index: auth.html
      <meta name="generator" content="HTML Tidy, see">
      <link rev="made" href="">
    <!-- Background white, links blue (unvisited), navy (visited), red (active) -->
    <body bgcolor="#FFFFFF" text="#000000" link="#0000FF" vlink=
    "#000080" alink="#FF0000">
      <!--#include virtual="header.html" -->
      <h1 align="CENTER">Authentication</h1>
      <a name="__index__"></a> <!-- INDEX BEGIN -->
        <li><a href="#introduction">Introduction</a></li>
        <li><a href="#the prerequisites">The prerequisites</a></li>
        <li><a href="#getting it working.">Getting it
        <li><a href="#letting more than one person in">Letting more
        than one person in</a></li>
        <li><a href="#possible problems">Possible problems</a></li>
        <li><a href="#what other neat stuff can i do">What other neat
        stuff can I do?</a></li>
        <li><a href="#more information">More information</a></li>
      <!-- INDEX END -->
  <table border="1">
  <td valign="top"><strong>Related Modules</strong><br>
   <a href="../mod/mod_auth.html">mod_auth</a><br>
  <td valign="top"><strong>Related Directives</strong><br>
   <a href="../mod/mod_access.html#allow">Allow</a><br>
   <a href="../mod/mod_auth.html#authgroupfile">AuthGroupFile</a><br>
   <a href="../mod/core.html#authname">AuthName</a><br>
   <a href="../mod/core.html#authtype">AuthType</a><br>
   <a href="../mod/mod_auth.html#authuserfile">AuthUserFile</a><br>
   <a href="../mod/mod_access.html#deny">Deny</a><br>
   <a href="../mod/core.html#options">Options</a><br>
   <a href="../mod/core.html#require">Require</a><br>
      <h1><a name="authentication">Authentication</a></h1>
      <p>Authentication is any process by which you verify that
      someone is who they claim they are. Authorization is any
      process by which someone is allowed to be where they want to
      go, or to have information that they want to have.</p>
      <h2><a name="introduction">Introduction</a></h2>
      <p>If you have information on your web site that is sensitive
      or intended for only a small group of people, the techniques in
      this article will help you make sure that the people that see
      those pages are the people that you wanted to see them.</p>
      <p>This article covers the "standard" way of protecting parts of your
      web site that most of you are going to use.</p>
      <h2><a name="the prerequisites">The prerequisites</a></h2>
      <p>The directives discussed in this article will need to go either
      in your main server configuration file, or in per-directory
      configuration files (<code>.htaccess</code> files).</p>
      <p>If you plan to use <code>.htaccess</code> files, you will need
      have a server configuration that permits putting authentication
      directives in these files. This is done with the 
      <code><a href="../mod/core.html#allowoverride">AllowOverride</a></code>
      directive, which specifies which directives, if any, may be put in
      per-directory configuration files.</p>
      <p>Since we're talking here about authentication, you will need an
      <code>AllowOverride</code> directive like the following:</p>
      AllowOverride AuthConfig
      <p>Or, if you are just going to put the directives directly in your
      main server configuration file, you will of course need to have
      write permission to that file.</p>
      <p>And you'll need to know a little bit about the directory
      structure of your server, in order to know where some files are
      kept. This should not be terribly difficult, and I'll try to
      make this clear when we come to that point.</p>
      <h2><a name="getting it working.">Getting it working.</a></h2>
      <p>Here's the basics of password protecting a directory on your
      <p>You'll need to create a password file. This file should be
      placed somewhere outside of your document directory. This is so
      that folks cannot download the password file. For example, if
      your documents are served out of
      <code>/usr/local/apache/htdocs</code> you might want to put the
      password file(s) in <code>/usr/local/apache/passwd</code>.</p>
      <p>To create the file, use the <code>htpasswd</code> utility
      that came with Apache. This be located in the <code>bin</code>
      directory of wherever you installed Apache. To create the file,
          htpasswd -c /usr/local/apache/passwd/password rbowen
      <p><code>htpasswd</code> will ask you for the password, and
      then ask you to type it again to confirm it:</p>
          # htpasswd -c /usr/local/apache/passwd/passwords rbowen
          New password: mypassword
          Re-type new password: mypassword
          Adding password for user rbowen
      <p>If <code>htpasswd</code> is not in your path, of course
      you'll have to type the full path to the file to get it to run.
      On my server, it's located at
      <p>Next, you'll need to create a file in the directory you want
      to protect. This file is usually called <code>.htaccess</code>,
      although on Windows it's called <code>htaccess</code> (without
      the leading period.) <code>.htaccess</code> needs to contain
      the following lines:</p>
          AuthType Basic
          AuthName "By Invitation Only"
          AuthUserFile /usr/local/apache/passwd/passwords
          AuthGroupFile /dev/null
          require user rbowen
      <p>The next time that you load a file from that directory, you
      should see the familiar username/password dialog box pop up. If
      you don't chances are pretty good that you are not permitted to
      use <code>.htaccess</code> files in the directory in
      <h2><a name="letting more than one person in">Letting more than
      one person in</a></h2>
      <p>The directives above only let one person (specifically
      someone with a username of <code>rbowen</code>) into the
      directory. In most cases, you'll want to let more than one
      person in. This is where the <code>AuthGroupFile</code> comes
      in. In the example above, we've pointed
      <code>AuthGroupFile</code> to <code>/dev/null</code>, which
      Unix-speak for "nowhere", or "off into space." (The Windows
      NT equivalent of this is <code>nul</code>.)</p>
      <p>If you want to let more than one person in, you'll need to
      create a group file that associates group names with a list of
      users in that group. The format of this file is pretty simple,
      and you can create it with your favorite editor. The contents
      of the file will look like this:</p>
          GroupName: rbowen dpitts sungo rshersey
      <p>That's just a list of the members of the group in a long
      line separated by spaces.</p>
      <p>To add a user to your already existing password file,
          htpasswd /usr/local/apache/passwd/password dpitts
      <p>You'll get the same response as before, but it will be
      appended to the existing file, rather than creating a new file.
      (It's the <code>-c</code> that makes it create a new password
      <p>Now, you need to modify your <code>.htaccess</code> file to
      look like the following:</p>
          AuthType Basic
          AuthName "By Invitation Only"
          AuthUserFile /usr/local/apache/passwd/passwords
          AuthGroupFile /usr/local/apache/passwd/groups
          require group GroupName
      <p>Now, anyone that is listed in the group
      <code>GroupName</code>, and has an entry in the
      <code>password</code> file, will be let in, if they type the
      correct password.</p>
      <p>There's another way to let multiple users in that is less
      specific. Rather than creating a group file, you can just use
      the following directive:</p>
          require valid-user
      <p>Using that rather than the <code>require user rbowen</code>
      line will allow anyone in that is listed in the password file,
      and who correctly enters their password. You can even emulate
      the group behavior here, by just keeping a separate password
      file for each group. The advantage of this approach is that
      Apache only has to check one file, rather than two. The
      disadvantage is that you have to maintain a bunch of password
      files, and remember to reference th right one in the
      <code>AuthUserFile</code> directive.</p>
      <h2><a name="possible problems">Possible problems</a></h2>
      <p>Because of the way that Basic authentication is specified,
      your username and password must be verified every time you
      request a document from the server. This is even if you're
      reloading the same page, and for every image on the page (if
      they come from a protected directory). As you can imagine, this
      slows things down a little. The amount that it slows things
      down is proportional to the size of the password file, because
      it has to open up that file, and go down the list of users
      until it gets to your name. And it has to do this every time a
      page is loaded.</p>
      <p>A consequence of this is that there's a practical limit to how many
      users you can put in one password file. This limit will vary
      depending on the performance of your particular server machine, but
      you can expect to see slowdowns once you get above a few hundred
      entries, and may wish to consider a different authentication method
      at that time.</p>
      <h2><a name="what other neat stuff can i do">What other neat
      stuff can I do?</a></h2>
      <p>Authentication by username and password is only part of the
      story. Frequently you want to let people in based on something
      other than who they are. Something such as where they are
      coming from.</p>
      <p>The <code>allow</code> and <code>deny</code> directives
      you allow and deny access based on the host name, or host
      address, of the machine requesting a document. The directive
      goes hand-in-hand with these is the <code>order</code>
      directive, which tells Apache in which order to apply the
      <p>The usage of these directives is:</p>
          allow from address
      <p>where <em>address</em> is an IP address (or a partial IP
      address) or a fully qualified domain name (or a partial domain
      <p>For example, if you have someone spamming your message
      board, and you want to keep them out, you could do the
          deny from
      <p>Visitors coming from that address will not be able to see
      the content behind this directive. If, instead, you have a
      machine name, rather than an IP address, you can use that.</p>
          deny from
      <p>And, if you'd like to block access from an entire domain,
      you can specify just part of an address or domain name:</p>
          deny from 192.101.205
          deny from
          deny from ke
      <p>Using <code>order</code> will let you be sure that you are
      actually restricting things to the group that you want to let
      in, by combining a <code>deny</code> and an <code>allow</code>
          order deny,allow
          deny from all
          allow from
      <p>Listing just the <code>allow</code> directive would not do
      what you want, because it will let folks from that host in, in
      addition to letting everyone in. What you want is to let
      <em>only</em> those folks in.</p>
      <h2><a name="more information">More information</a></h2>
      <p>You should also read the documentation for
      <code><a href="../mod/mod_auth.html">mod_auth</a></code>
      which contains
      some more information about how this all works.</p>

View raw message