fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder<?xml version='1.0' encoding='UTF-8' ?>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder<!DOCTYPE manualpage SYSTEM "/style/manualpage.dtd">

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder<?xml-stylesheet type="text/xsl" href="/style/manual.en.xsl"?>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder<manualpage metafile="access.xml.meta">

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder<parentdocument href="./">How-To / Tutorials</parentdocument>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder<title>Access Control</title>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder<summary>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder <p>Access control refers to any means of controlling access to any

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder resource. This is separate from <a

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder href="auth.html">authentication and authorization</a>.</p>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder</summary>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder<section id="related"><title>Related Modules and Directives</title>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder <p>Access control can be done by several different modules. The most

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder important of these are <module>mod_authz_core</module> and

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder <module>mod_authz_host</module>. Also discussed in this document

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder is access control using <module>mod_rewrite</module>.</p>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder</section>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder<section id="host"><title>Access control by host</title>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder <p>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder If you wish to restrict access to portions of your site based on the

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder host address of your visitors, this is most easily done using

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder <module>mod_authz_host</module>.

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder </p>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder <p>The <directive module="mod_authz_core">Require</directive>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder provides a variety of different ways to allow or deny access to

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder resources. In conjunction with the <directive

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder module="mod_authz_core">RequireAll</directive>, <directive

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder module="mod_authz_core">RequireAny</directive>, and <directive

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder module="mod_authz_core">RequireNone</directive> directives, these

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder requirements may be combined in arbitrarily complex ways, to enforce

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder whatever your access policy happens to be.</p>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder <note type="warning"><p>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder The <directive module="mod_access_compat">Allow</directive>,

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder <directive module="mod_access_compat">Deny</directive>, and

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder <directive module="mod_access_compat">Order</directive> directives,

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder provided by <module>mod_access_compat</module>, are deprecated and

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder will go away in a future version. You should avoid using them, and

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder avoid outdated tutorials recommending their use.

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder </p></note>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder <p>The usage of these directives is:</p>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder <highlight language="config">

fa43fb19389da6eb222a2a1377943a96d55869e3Christian MaederRequire host address

fa43fb19389da6eb222a2a1377943a96d55869e3Christian MaederRequire ip ip.address

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder </highlight>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder <p>In the first form, <var>address</var> is a fully qualified

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder domain name (or a partial domain name); you may provide multiple

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder addresses or domain names, if desired.</p>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder <p>In the second form, <var>ip.address</var> is an IP address, a

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder partial IP address, a network/netmask pair, or a network/nnn CIDR

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder specification. Either IPv4 or IPv6 addresses may be used.</p>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder <p>See <a href="/mod/mod_authz_host.html#requiredirectives">the

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder mod_authz_host documentation</a> for further examples of this

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder syntax.</p>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder <p>You can insert <code>not</code> to negate a particular requirement.

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder Note, that since a <code>not</code> is a negation of a value, it cannot

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder be used by itself to allow or deny a request, as <em>not true</em>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder does not constitute <em>false</em>. Thus, to deny a visit using a negation,

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder the block must have one element that evaluates as true or false.

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder For example, if you have someone spamming your message

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder board, and you want to keep them out, you could do the

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder following:</p>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder <highlight language="config">

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder&lt;RequireAll&gt;

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder Require all granted

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder Require not ip 10.252.46.165

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder&lt;/RequireAll&gt;

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder</highlight>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder <p>Visitors coming from that address (<code>10.252.46.165</code>)

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder will not be able to see the content covered by this directive. If,

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder instead, you have a machine name, rather than an IP address, you

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder can use that.</p>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder <highlight language="config">

fa43fb19389da6eb222a2a1377943a96d55869e3Christian MaederRequire not host <var>host.example.com</var>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder </highlight>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder <p>And, if you'd like to block access from an entire domain,

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder you can specify just part of an address or domain name:</p>

a29dfb37d1610631b2d655774863b02eaf49cb28Christian Maeder

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder <highlight language="config">

fa43fb19389da6eb222a2a1377943a96d55869e3Christian MaederRequire not ip 192.168.205

fa43fb19389da6eb222a2a1377943a96d55869e3Christian MaederRequire not host phishers.example.com moreidiots.example

fa43fb19389da6eb222a2a1377943a96d55869e3Christian MaederRequire not host gov

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder </highlight>

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder <p>Use of the <directive

fa43fb19389da6eb222a2a1377943a96d55869e3Christian Maeder module="mod_authz_core">RequireAll</directive>, <directive

module="mod_authz_core">RequireAny</directive>, and <directive

module="mod_authz_core">RequireNone</directive> directives may be

used to enforce more complex sets of requirements.</p>

</section>

<section id="env"><title>Access control by arbitrary variables</title>

<p>Using the <directive type="section" module="core">If</directive>,

you can allow or deny access based on arbitrary environment

variables or request header values. For example, to deny access

based on user-agent (the browser type) you might do the

following:</p>

<highlight language="config">

&lt;If "%{HTTP_USER_AGENT} == 'BadBot'"&gt;

Require all denied

&lt;/If&gt;

</highlight>

<p>Using the <directive module="mod_authz_core">Require</directive>

<code>expr</code> syntax, this could also be written as:</p>

<highlight language="config">

Require expr %{HTTP_USER_AGENT} != 'BadBot'

</highlight>

<note><title>Warning:</title>

<p>Access control by <code>User-Agent</code> is an unreliable technique,

since the <code>User-Agent</code> header can be set to anything at all,

at the whim of the end user.</p>

</note>

<p>See <a href="/expr.html">the expressions document</a> for a

further discussion of what expression syntaxes and variables are

available to you.</p>

</section>

<section id="rewrite"><title>Access control with mod_rewrite</title>

<p>The <code>[F]</code> <directive

module="mod_rewrite">RewriteRule</directive> flag causes a 403 Forbidden

response to be sent. Using this, you can deny access to a resource based

on arbitrary criteria.</p>

<p>For example, if you wish to block access to a resource between 8pm

and 6am, you can do this using <module>mod_rewrite</module>.</p>

<highlight language="config">

RewriteEngine On

RewriteCond "%{TIME_HOUR}" "&gt;=20" [OR]

RewriteCond "%{TIME_HOUR}" "&lt;07"

RewriteRule "^/fridge" "-" [F]

</highlight>

<p>This will return a 403 Forbidden response for any request after 8pm

or before 7am. This technique can be used for any criteria that you wish

to check. You can also redirect, or otherwise rewrite these requests, if

that approach is preferred.</p>

<p>The <directive type="section" module="core">If</directive> directive,

added in 2.4, replaces many things that <module>mod_rewrite</module> has

traditionally been used to do, and you should probably look there first

before resorting to mod_rewrite.</p>

</section>

<section id="moreinformation"><title>More information</title>

<p>The <a href="/expr.html">expression engine</a> gives you a

great deal of power to do a variety of things based on arbitrary

server variables, and you should consult that document for more

detail.</p>

<p>Also, you should read the <module>mod_authz_core</module>

documentation for examples of combining multiple access requirements

and specifying how they interact.</p>

<p>See also the <a href="auth.html">Authentication and Authorization</a>

howto.</p>

</section>

</manualpage>