mod_access.html revision 4e2a90b502f88fff1bf55d0a01c41a1703b058ef
2271N/A<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
2271N/A<HTML>
2271N/A<HEAD>
2271N/A<TITLE>Apache module mod_access</TITLE>
2271N/A</HEAD>
2271N/A
2271N/A<!-- Background white, links blue (unvisited), navy (visited), red (active) -->
2271N/A<BODY
2271N/A BGCOLOR="#FFFFFF"
2271N/A TEXT="#000000"
2271N/A LINK="#0000FF"
2271N/A VLINK="#000080"
2271N/A ALINK="#FF0000"
2271N/A>
2271N/A<!--#include virtual="header.html" -->
2271N/A
2271N/A<H1 ALIGN="CENTER">Module mod_access</H1>
2271N/A<P>
2271N/AThis module is contained in the <CODE>mod_access.c</CODE> file, and
2271N/Ais compiled in by default. It provides access control based on client
2271N/Ahostname or IP address.
2271N/A</P>
2271N/A
2271N/A<UL>
2271N/A<LI><A HREF="#allow">allow</A>
2271N/A<LI><A HREF="#allowfromenv">allow from env=</A>
2271N/A<LI><A HREF="#deny">deny</A>
2271N/A<LI><A HREF="#denyfromenv">deny from env=</A>
2271N/A<LI><A HREF="#order">order</A>
2271N/A</UL>
2271N/A<DL>
2271N/A<DD>See also <A HREF="core.html#satisfy">Satisfy</A>.
2271N/A</DL>
2271N/A<HR>
2271N/A
2271N/A
2271N/A<H2><A NAME="allow">allow directive</A></H2>
2271N/A<P>
2271N/A<!--%plaintext &lt;?INDEX {\tt allow} directive&gt; -->
2271N/A<A
2271N/A HREF="directive-dict.html#Syntax"
2271N/A REL="Help"
2271N/A><STRONG>Syntax:</STRONG></A> allow from <EM>host host ...</EM><BR>
2271N/A<A
2271N/A HREF="directive-dict.html#Context"
2271N/A REL="Help"
2271N/A><STRONG>Context:</STRONG></A> directory, .htaccess<BR>
2271N/A<A
2271N/A HREF="directive-dict.html#Override"
2271N/A REL="Help"
2271N/A><STRONG>Override:</STRONG></A> Limit<BR>
2271N/A<A
2271N/A HREF="directive-dict.html#Status"
2271N/A REL="Help"
2271N/A><STRONG>Status:</STRONG></A> Base<BR>
2271N/A<A
2271N/A HREF="directive-dict.html#Module"
2271N/A REL="Help"
2271N/A><STRONG>Module:</STRONG></A> mod_access
2271N/A</P>
2271N/A<P>
2271N/AThe allow directive affects which hosts can access a given directory.
2271N/A<EM>Host</EM> is one of the following:
2271N/A</P>
2271N/A<DL>
2271N/A<DT><CODE>all</CODE>
2271N/A<DD>All hosts are allowed access
2271N/A<DT>A (partial) domain-name
2271N/A<DD>Hosts whose names match, or end in, this string are allowed access.
2271N/A<DT>A full IP address
2271N/A<DD>An IP address of a host allowed access
2271N/A<DT>A partial IP address
2271N/A<DD>The first 1 to 3 bytes of an IP address, for subnet restriction.
2271N/A<DT>A network/netmask pair (<STRONG>Apache 1.3 and later</STRONG>)
2271N/A<DD>A network a.b.c.d, and a netmask w.x.y.z. For more fine-grained subnet
2271N/A restriction. (<EM>i.e.</EM>, 10.1.0.0/255.255.0.0)
2271N/A<DT>A network/nnn CIDR specification (<STRONG>Apache 1.3 and later</STRONG>)
2271N/A<DD>Similar to the previous case, except the netmask consists of nnn
2271N/A high-order 1 bits. (<EM>i.e.</EM>, 10.1.0.0/16 is the same as 10.1.0.0/255.255.0.0)
2271N/A</DL>
2271N/A<P>
2271N/AExample:
2271N/A</P>
2271N/A<BLOCKQUOTE><CODE>allow from .ncsa.uiuc.edu</CODE></BLOCKQUOTE>
2271N/A<P>
2271N/AAll hosts in the specified domain are allowed access.
2271N/A</P>
2271N/A<P>
2271N/ANote that this compares whole components; <CODE>bar.edu</CODE>
2271N/Awould not match <CODE>foobar.edu</CODE>.
2271N/A</P>
2271N/A<P>
2271N/ASee also <A HREF="#deny">deny</A>, <A HREF="#order">order</A>, and
2271N/A<A HREF="mod_browser.html#browsermatch">BrowserMatch</A>.
2271N/A</P>
2271N/A
2271N/A<P>
2271N/A<A NAME="allowfromenv"><STRONG>Syntax:</STRONG> allow from
2271N/A env=<EM>variablename</EM></A><BR>
2271N/A<A
2271N/A HREF="directive-dict.html#Context"
2271N/A REL="Help"
2271N/A><STRONG>Context:</STRONG></A> directory, .htaccess<BR>
2271N/A<A
2271N/A HREF="directive-dict.html#Override"
2271N/A REL="Help"
2271N/A><STRONG>Override:</STRONG></A> Limit<BR>
2271N/A<A
2271N/A HREF="directive-dict.html#Status"
2271N/A REL="Help"
2271N/A><STRONG>Status:</STRONG></A> Base<BR>
2271N/A<A
2271N/A HREF="directive-dict.html#Module"
2271N/A REL="Help"
2271N/A><STRONG>Module:</STRONG></A> mod_access<BR>
2271N/A<A
2271N/A HREF="directive-dict.html#Compatibility"
2271N/A REL="Help"
2271N/A><STRONG>Compatibility:</STRONG></A> Apache 1.2 and above
2271N/A</P>
2271N/A<P>
2271N/AThe allow from env directive controls access to a directory by the
2271N/Aexistence (or non-existence) of an environment variable.
2271N/A</P>
2271N/A<P>
2271N/AExample:
2271N/A</P>
2271N/A<BLOCKQUOTE><PRE>
2271N/ABrowserMatch ^KnockKnock/2.0 let_me_in
2271N/A&lt;Directory /docroot&gt;
2271N/A order deny,allow
2271N/A deny from all
2271N/A allow from env=let_me_in
2271N/A&lt;/Directory&gt;
2271N/A</PRE></BLOCKQUOTE>
2271N/AIn this case browsers with the user-agent string <TT>KnockKnock/2.0</TT> will
2271N/Abe allowed access, and all others will be denied.
2271N/A<P>
2271N/ASee also <A HREF="#denyfromenv">deny from env</A>
2271N/Aand <A HREF="#order">order</A>.
2271N/A</P>
2271N/A<HR>
2271N/A
2271N/A<H2><A NAME="deny">deny directive</A></H2>
2271N/A<P>
2271N/A<!--%plaintext &lt;?INDEX {\tt deny} directive&gt; -->
2271N/A<A
2271N/A HREF="directive-dict.html#Syntax"
2271N/A REL="Help"
2271N/A><STRONG>Syntax:</STRONG></A> deny from <EM>host host ...</EM><BR>
2271N/A<A
2271N/A HREF="directive-dict.html#Context"
2271N/A REL="Help"
2271N/A><STRONG>Context:</STRONG></A> directory, .htaccess<BR>
2271N/A<A
2271N/A HREF="directive-dict.html#Override"
2271N/A REL="Help"
2271N/A><STRONG>Override:</STRONG></A> Limit<BR>
2271N/A<A
2271N/A HREF="directive-dict.html#Status"
2271N/A REL="Help"
2271N/A><STRONG>Status:</STRONG></A> Base<BR>
2271N/A<A
2271N/A HREF="directive-dict.html#Module"
2271N/A REL="Help"
2271N/A><STRONG>Module:</STRONG></A> mod_access
2271N/A</P>
2271N/A<P>
2271N/AThe deny directive affects which hosts can access a given directory.
2271N/A<EM>Host</EM> is one of the following:
2271N/A</P>
2271N/A<DL>
2271N/A<DT><CODE>all</CODE>
2271N/A<DD>all hosts are denied access
2271N/A<DT>A (partial) domain-name
2271N/A<DD>host whose name is, or ends in, this string are denied access.
2271N/A<DT>A full IP address
2271N/A<DD>An IP address of a host denied access
2271N/A<DT>A partial IP address
2271N/A<DD>The first 1 to 3 bytes of an IP address, for subnet restriction.
2271N/A<DT>A network/netmask pair (<STRONG>Apache 1.3 and later</STRONG>)
2271N/A<DD>A network a.b.c.d, and a netmask w.x.y.z. For more fine-grained subnet
2271N/A restriction. (<EM>i.e.</EM>, 10.1.0.0/255.255.0.0)
2271N/A<DT>A network/nnn CIDR specification (<STRONG>Apache 1.3 and later</STRONG>)
2271N/A<DD>Similar to the previous case, except the netmask consists of nnn
2271N/A high-order 1 bits. (<EM>i.e.</EM>, 10.1.0.0/16 is the same as 10.1.0.0/255.255.0.0)
2271N/A</DL>
2271N/A<P>
2271N/AExample:
2271N/A</P>
2271N/A<BLOCKQUOTE><CODE>deny from 16</CODE></BLOCKQUOTE>
2271N/A<P>
2271N/AAll hosts in the specified network are denied access.
2271N/A</P>
2271N/A<P>
2271N/ANote that this compares whole components; <CODE>bar.edu</CODE>
2271N/Awould not match <CODE>foobar.edu</CODE>.
2271N/A</P>
2271N/A<P>
2271N/ASee also <A HREF="#allow">allow</A> and <A HREF="#order">order</A>.
2271N/A</P>
2271N/A
2271N/A<P>
2271N/A<A NAME="denyfromenv"><STRONG>Syntax:</STRONG> deny from
2271N/A env=<EM>variablename</EM></A><BR>
2271N/A<A
2271N/A HREF="directive-dict.html#Context"
2271N/A REL="Help"
2271N/A><STRONG>Context:</STRONG></A> directory, .htaccess<BR>
2271N/A<A
2271N/A HREF="directive-dict.html#Override"
2271N/A REL="Help"
2271N/A><STRONG>Override:</STRONG></A> Limit<BR>
2271N/A<A
2271N/A HREF="directive-dict.html#Status"
2271N/A REL="Help"
2271N/A><STRONG>Status:</STRONG></A> Base<BR>
2271N/A<A
2271N/A HREF="directive-dict.html#Module"
2271N/A REL="Help"
2271N/A><STRONG>Module:</STRONG></A> mod_access<BR>
2271N/A<A
2271N/A HREF="directive-dict.html#Compatibility"
2271N/A REL="Help"
2271N/A><STRONG>Compatibility:</STRONG></A> Apache 1.2 and above
2271N/A</P>
2271N/A<P>
2271N/AThe deny from env directive controls access to a directory by the
2271N/Aexistence (or non-existence) of an environment variable.
2271N/A</P>
2271N/A<P>
2271N/AExample:
2271N/A</P>
2271N/A<BLOCKQUOTE><PRE>
2271N/ABrowserMatch ^BadRobot/0.9 go_away
2271N/A&lt;Directory /docroot&gt;
2271N/A order allow,deny
2271N/A allow from all
2271N/A deny from env=go_away
2271N/A&lt;/Directory&gt;
2271N/A</PRE></BLOCKQUOTE>
2271N/AIn this case browsers with the user-agent string <TT>BadRobot/0.9</TT> will
2271N/Abe denied access, and all others will be allowed.
2271N/A
2271N/A<P>
2271N/ASee also <A HREF="#allowfromenv">allow from env</A>
2271N/Aand <A HREF="#order">order</A>.
2271N/A</P>
2271N/A<HR>
2271N/A
2271N/A<H2><A NAME="order">order directive</A></H2>
2271N/A<P>
2271N/A<!--%plaintext &lt;?INDEX {\tt order} directive&gt; -->
2271N/A<A
2271N/A HREF="directive-dict.html#Syntax"
2271N/A REL="Help"
2271N/A><STRONG>Syntax:</STRONG></A> order <EM>ordering</EM><BR>
2271N/A<A
2271N/A HREF="directive-dict.html#Default"
2271N/A REL="Help"
2271N/A><STRONG>Default:</STRONG></A> <CODE>order deny,allow</CODE><BR>
2271N/A<A
2271N/A HREF="directive-dict.html#Context"
2271N/A REL="Help"
2271N/A><STRONG>Context:</STRONG></A> directory, .htaccess<BR>
2271N/A<A
2271N/A HREF="directive-dict.html#Override"
2271N/A REL="Help"
2271N/A><STRONG>Override:</STRONG></A> Limit<BR>
2271N/A<A
2271N/A HREF="directive-dict.html#Status"
2271N/A REL="Help"
2271N/A><STRONG>Status:</STRONG></A> Base<BR>
2271N/A<A
2271N/A HREF="directive-dict.html#Module"
2271N/A REL="Help"
2271N/A><STRONG>Module:</STRONG></A> mod_access
2271N/A</P>
2271N/A<P>
2271N/AThe order directive controls the order in which <A HREF="#allow">allow</A> and
2271N/A<A HREF="#deny">deny</A> directives are evaluated. <EM>Ordering</EM> is one
2271N/Aof
2271N/A</P>
2271N/A<DL>
2271N/A<DT>deny,allow
2271N/A<DD>the deny directives are evaluated before the allow directives. (The
2271N/Ainitial state is OK.)
2271N/A<DT>allow,deny
2271N/A<DD>the allow directives are evaluated before the deny directives. (The
2271N/Ainitial state is FORBIDDEN.)
2271N/A<DT>mutual-failure
2271N/A<DD>Only those hosts which appear on the allow list and do not appear
2271N/Aon the deny list are granted access. (The initial state is irrelevant.)
2271N/A</DL>
2271N/A<P>
2271N/AKeywords may only be separated by a comma; no whitespace is allowed between
2271N/Athem.
2271N/A<STRONG>Note that in all cases every <CODE>allow</CODE> and <CODE>deny</CODE>
2271N/Astatement is evaluated, there is no &quot;short-circuiting&quot;.</STRONG>
2271N/A</P>
2271N/A<P>
2271N/AExample:
2271N/A</P>
2271N/A<BLOCKQUOTE><CODE>
2271N/A order deny,allow<BR>
2271N/A deny from all<BR>
2271N/A allow from .ncsa.uiuc.edu<BR>
2271N/A</CODE></BLOCKQUOTE>
2271N/A<P>
2271N/AHosts in the ncsa.uiuc.edu domain are allowed access; all other hosts are
2271N/Adenied access.
2271N/A</P>
2271N/A<!--#include virtual="footer.html" -->
2271N/A</BODY>
2271N/A</HTML>
2271N/A