auth.html.en revision c465cdcd228f12b0283ad0745ea3e05b8c96a9cc
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html>
<head>
<title>Authentication</title>
<link rev="made" href="mailto:rbowen@rcbowen.com">
</head>
<!-- Background white, links blue (unvisited), navy (visited), red (active) -->
<body bgcolor="#FFFFFF" text="#000000" link="#0000FF" vlink=
"#000080" alink="#FF0000">
<!--#include virtual="header.html" -->
<h1 align="CENTER">Authentication</h1>
<a name="__index__"></a> <!-- INDEX BEGIN -->
<ul>
<li><a href="#introduction">Introduction</a></li>
<li><a href="#the prerequisites">The prerequisites</a></li>
<li><a href="#getting it working">Getting it
working</a></li>
<li><a href="#letting more than one person in">Letting more
than one person in</a></li>
<li><a href="#possible problems">Possible problems</a></li>
<li><a href="#what other neat stuff can i do">What other neat
stuff can I do?</a></li>
<li><a href="#more information">More information</a></li>
</ul>
<!-- INDEX END -->
<hr>
<table border="1">
<tr>
<td valign="top"><strong>Related Modules</strong><br>
<br>
</td>
<td valign="top"><strong>Related Directives</strong><br>
<br>
</td>
</tr>
</table>
<h1><a name="authentication">Authentication</a></h1>
<p>Authentication is any process by which you verify that
someone is who they claim they are. Authorization is any
process by which someone is allowed to be where they want to
go, or to have information that they want to have.</p>
<h2><a name="introduction">Introduction</a></h2>
<p>If you have information on your web site that is sensitive
or intended for only a small group of people, the techniques in
this article will help you make sure that the people that see
those pages are the people that you wanted to see them.</p>
<p>This article covers the "standard" way of protecting parts of your
web site that most of you are going to use.</p>
<h2><a name="the prerequisites">The prerequisites</a></h2>
<p>The directives discussed in this article will need to go either
in your main server configuration file, or in per-directory
configuration files (<code>.htaccess</code> files).</p>
<p>If you plan to use <code>.htaccess</code> files, you will need to
have a server configuration that permits putting authentication
directives in these files. This is done with the
directive, which specifies which directives, if any, may be put in
per-directory configuration files.</p>
<p>Since we're talking here about authentication, you will need an
<code>AllowOverride</code> directive like the following:</p>
<pre>
AllowOverride AuthConfig
</pre>
<p>Or, if you are just going to put the directives directly in your
main server configuration file, you will of course need to have
write permission to that file.</p>
<p>And you'll need to know a little bit about the directory
structure of your server, in order to know where some files are
kept. This should not be terribly difficult, and I'll try to
make this clear when we come to that point.</p>
<h2><a name="getting it working">Getting it working</a></h2>
<p>Here's the basics of password protecting a directory on your
server.</p>
<p>You'll need to create a password file. This file should be
placed somewhere outside of your document directory. This is so
that folks cannot download the password file. For example, if
your documents are served out of
<p>To create the file, use the <code>htpasswd</code> utility
that came with Apache. This be located in the <code>bin</code>
directory of wherever you installed Apache. To create the file,
type:</p>
<pre>
</pre>
<p><code>htpasswd</code> will ask you for the password, and
then ask you to type it again to confirm it:</p>
<pre>
New password: mypassword
Re-type new password: mypassword
Adding password for user rbowen
</pre>
<p>If <code>htpasswd</code> is not in your path, of course
you'll have to type the full path to the file to get it to run.
On my server, it's located at
<p>Next, you'll need to create a file in the directory you want
to protect. This file is usually called <code>.htaccess</code>,
although on Windows it's called <code>htaccess</code> (without
the leading period.) <code>.htaccess</code> needs to contain
the following lines:</p>
<pre>
AuthType Basic
AuthName "By Invitation Only"
require user rbowen
</pre>
<p>The next time that you load a file from that directory, you
you don't chances are pretty good that you are not permitted to
use <code>.htaccess</code> files in the directory in
question.</p>
<h2><a name="letting more than one person in">Letting more than
one person in</a></h2>
<p>The directives above only let one person (specifically
someone with a username of <code>rbowen</code>) into the
directory. In most cases, you'll want to let more than one
person in. This is where the <code>AuthGroupFile</code> comes
in. In the example above, we've pointed
Unix-speak for "nowhere", or "off into space." (The Windows
NT equivalent of this is <code>nul</code>.)</p>
<p>If you want to let more than one person in, you'll need to
create a group file that associates group names with a list of
users in that group. The format of this file is pretty simple,
and you can create it with your favorite editor. The contents
of the file will look like this:</p>
<pre>
GroupName: rbowen dpitts sungo rshersey
</pre>
<p>That's just a list of the members of the group in a long
line separated by spaces.</p>
<p>To add a user to your already existing password file,
type:</p>
<pre>
</pre>
<p>You'll get the same response as before, but it will be
appended to the existing file, rather than creating a new file.
(It's the <code>-c</code> that makes it create a new password
file.</p>
<p>Now, you need to modify your <code>.htaccess</code> file to
look like the following:</p>
<pre>
AuthType Basic
AuthName "By Invitation Only"
require group GroupName
</pre>
<p>Now, anyone that is listed in the group
<code>GroupName</code>, and has an entry in the
<code>password</code> file, will be let in, if they type the
correct password.</p>
<p>There's another way to let multiple users in that is less
specific. Rather than creating a group file, you can just use
the following directive:</p>
<pre>
require valid-user
</pre>
<p>Using that rather than the <code>require user rbowen</code>
line will allow anyone in that is listed in the password file,
and who correctly enters their password. You can even emulate
the group behavior here, by just keeping a separate password
file for each group. The advantage of this approach is that
Apache only has to check one file, rather than two. The
disadvantage is that you have to maintain a bunch of password
files, and remember to reference th right one in the
<code>AuthUserFile</code> directive.</p>
<h2><a name="possible problems">Possible problems</a></h2>
<p>Because of the way that Basic authentication is specified,
your username and password must be verified every time you
request a document from the server. This is even if you're
reloading the same page, and for every image on the page (if
they come from a protected directory). As you can imagine, this
slows things down a little. The amount that it slows things
down is proportional to the size of the password file, because
it has to open up that file, and go down the list of users
until it gets to your name. And it has to do this every time a
page is loaded.</p>
<p>A consequence of this is that there's a practical limit to how many
users you can put in one password file. This limit will vary
depending on the performance of your particular server machine, but
you can expect to see slowdowns once you get above a few hundred
entries, and may wish to consider a different authentication method
at that time.</p>
<h2><a name="what other neat stuff can i do">What other neat
stuff can I do?</a></h2>
<p>Authentication by username and password is only part of the
story. Frequently you want to let people in based on something
other than who they are. Something such as where they are
coming from.</p>
<p>The <code>allow</code> and <code>deny</code> directives let
you allow and deny access based on the host name, or host
address, of the machine requesting a document. The directive
goes hand-in-hand with these is the <code>order</code>
directive, which tells Apache in which order to apply the
filters.</p>
<p>The usage of these directives is:</p>
<pre>
allow from address
</pre>
<p>where <em>address</em> is an IP address (or a partial IP
address) or a fully qualified domain name (or a partial domain
name).</p>
<p>For example, if you have someone spamming your message
board, and you want to keep them out, you could do the
following:</p>
<pre>
deny from 205.252.46.165
</pre>
<p>Visitors coming from that address will not be able to see
the content behind this directive. If, instead, you have a
machine name, rather than an IP address, you can use that.</p>
<pre>
deny from host.example.com
</pre>
<p>And, if you'd like to block access from an entire domain,
you can specify just part of an address or domain name:</p>
<pre>
deny from 192.101.205
deny from cyberthugs.com
deny from ke
</pre>
<p>Using <code>order</code> will let you be sure that you are
actually restricting things to the group that you want to let
in, by combining a <code>deny</code> and an <code>allow</code>
directive:</p>
<pre>
order deny,allow
deny from all
allow from dev.example.com
</pre>
<p>Listing just the <code>allow</code> directive would not do
what you want, because it will let folks from that host in, in
addition to letting everyone in. What you want is to let
<em>only</em> those folks in.</p>
<h2><a name="more information">More information</a></h2>
<p>You should also read the documentation for
which contain some more information about how this all works.</p>
</body>
</html>