manual/mod/mod_access.html

	mod_access.html revision 618d2847990e59c6fa82b74b160453e1048a2957
6ae232055d4d8a97267517c5e50074c2c819941and<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
6ae232055d4d8a97267517c5e50074c2c819941and<HTML>
6ae232055d4d8a97267517c5e50074c2c819941and<HEAD>
6ae232055d4d8a97267517c5e50074c2c819941and<TITLE>Apache module mod_access</TITLE>
6ae232055d4d8a97267517c5e50074c2c819941and</HEAD>
6ae232055d4d8a97267517c5e50074c2c819941and
6ae232055d4d8a97267517c5e50074c2c819941and<!-- Background white, links blue (unvisited), navy (visited), red (active) -->
6ae232055d4d8a97267517c5e50074c2c819941and<BODY
6ae232055d4d8a97267517c5e50074c2c819941and BGCOLOR="#FFFFFF"
6ae232055d4d8a97267517c5e50074c2c819941and TEXT="#000000"
d29d9ab4614ff992b0e8de6e2b88d52b6f1f153erbowen LINK="#0000FF"
d29d9ab4614ff992b0e8de6e2b88d52b6f1f153erbowen VLINK="#000080"
d29d9ab4614ff992b0e8de6e2b88d52b6f1f153erbowen ALINK="#FF0000"
d29d9ab4614ff992b0e8de6e2b88d52b6f1f153erbowen>
6ae232055d4d8a97267517c5e50074c2c819941and<!--#include virtual="header.html" -->
6ae232055d4d8a97267517c5e50074c2c819941and
6ae232055d4d8a97267517c5e50074c2c819941and<H1 ALIGN="CENTER">Module mod_access</H1>
6ae232055d4d8a97267517c5e50074c2c819941and<P>
3f08db06526d6901aa08c110b5bc7dde6bc39905ndThis module is contained in the <CODE>mod_access.c</CODE> file, and
6ae232055d4d8a97267517c5e50074c2c819941andis compiled in by default. It provides access control based on client
6ae232055d4d8a97267517c5e50074c2c819941andhostname or IP address.
6ae232055d4d8a97267517c5e50074c2c819941and</P>
b43f840409794ed298e8634f6284741f193b6c4ftakashi
6ae232055d4d8a97267517c5e50074c2c819941and<UL>
6ae232055d4d8a97267517c5e50074c2c819941and<LI><A HREF="#allow">allow</A>
6ae232055d4d8a97267517c5e50074c2c819941and<LI><A HREF="#allowfromenv">allow from env=</A>
b43f840409794ed298e8634f6284741f193b6c4ftakashi<LI><A HREF="#deny">deny</A>
6ae232055d4d8a97267517c5e50074c2c819941and<LI><A HREF="#denyfromenv">deny from env=</A>
f086b4b402fa9a2fefc7dda85de2a3cc1cd0a654rjung<LI><A HREF="#order">order</A>
6ae232055d4d8a97267517c5e50074c2c819941and</UL>
b43f840409794ed298e8634f6284741f193b6c4ftakashi<HR>
b43f840409794ed298e8634f6284741f193b6c4ftakashi
b43f840409794ed298e8634f6284741f193b6c4ftakashi
b43f840409794ed298e8634f6284741f193b6c4ftakashi<h2><A name="allow">allow directive</A></h2>
6ae232055d4d8a97267517c5e50074c2c819941and<P>
6ae232055d4d8a97267517c5e50074c2c819941and<!--%plaintext &lt;?INDEX {\tt allow} directive&gt; -->
6ae232055d4d8a97267517c5e50074c2c819941and<A
6ae232055d4d8a97267517c5e50074c2c819941and HREF="directive-dict.html#Syntax"
6ae232055d4d8a97267517c5e50074c2c819941and REL="Help"
6ae232055d4d8a97267517c5e50074c2c819941and><STRONG>Syntax:</STRONG></A> allow from <EM>host host ...</EM><BR>
6ae232055d4d8a97267517c5e50074c2c819941and<A
6ae232055d4d8a97267517c5e50074c2c819941and HREF="directive-dict.html#Context"
6ae232055d4d8a97267517c5e50074c2c819941and REL="Help"
6ae232055d4d8a97267517c5e50074c2c819941and><STRONG>Context:</STRONG></A> directory, .htaccess<BR>
6ae232055d4d8a97267517c5e50074c2c819941and<A
6ae232055d4d8a97267517c5e50074c2c819941and HREF="directive-dict.html#Override"
6ae232055d4d8a97267517c5e50074c2c819941and REL="Help"
6ae232055d4d8a97267517c5e50074c2c819941and><STRONG>Override:</STRONG></A> Limit<BR>
6ae232055d4d8a97267517c5e50074c2c819941and<A
6ae232055d4d8a97267517c5e50074c2c819941and HREF="directive-dict.html#Status"
6ae232055d4d8a97267517c5e50074c2c819941and REL="Help"
6ae232055d4d8a97267517c5e50074c2c819941and><STRONG>Status:</STRONG></A> Base<BR>
1d980e5489836e977ba59b419e27b0ec875c4bd3takashi<A
6ae232055d4d8a97267517c5e50074c2c819941and HREF="directive-dict.html#Module"
6ae232055d4d8a97267517c5e50074c2c819941and REL="Help"
6ae232055d4d8a97267517c5e50074c2c819941and><STRONG>Module:</STRONG></A> mod_access
6ae232055d4d8a97267517c5e50074c2c819941and</P>
6ae232055d4d8a97267517c5e50074c2c819941and<P>
6ae232055d4d8a97267517c5e50074c2c819941andThe allow directive affects which hosts can access a given directory.
6ae232055d4d8a97267517c5e50074c2c819941and<EM>Host</EM> is one of the following:
6ae232055d4d8a97267517c5e50074c2c819941and</P>
6ae232055d4d8a97267517c5e50074c2c819941and<DL>
6ae232055d4d8a97267517c5e50074c2c819941and<DT><CODE>all</CODE>
6ae232055d4d8a97267517c5e50074c2c819941and<DD>All hosts are allowed access
6ae232055d4d8a97267517c5e50074c2c819941and<DT>A (partial) domain-name
6ae232055d4d8a97267517c5e50074c2c819941and<DD>Hosts whose names match, or end in, this string are allowed access.
6ae232055d4d8a97267517c5e50074c2c819941and<DT>A full IP address
6ae232055d4d8a97267517c5e50074c2c819941and<DD>An IP address of a host allowed access
6ae232055d4d8a97267517c5e50074c2c819941and<DT>A partial IP address
6ae232055d4d8a97267517c5e50074c2c819941and<DD>The first 1 to 3 bytes of an IP address, for subnet restriction.
6ae232055d4d8a97267517c5e50074c2c819941and<DT>A network/netmask pair (<STRONG>Apache 1.3 and later</STRONG>)
6ae232055d4d8a97267517c5e50074c2c819941and<DD>A network a.b.c.d, and a netmask w.x.y.z.  For more fine-grained subnet
6ae232055d4d8a97267517c5e50074c2c819941and    restriction.  (i.e. 10.1.0.0/255.255.0.0)
6ae232055d4d8a97267517c5e50074c2c819941and<DT>A network/nnn CIDR specification (<STRONG>Apache 1.3 and later</STRONG>)
6ae232055d4d8a97267517c5e50074c2c819941and<DD>Similar to the previous case, except the netmask consists of nnn
6ae232055d4d8a97267517c5e50074c2c819941and    high-order 1 bits.  (i.e. 10.1.0.0/16 is the same as 10.1.0.0/255.255.0.0)
6ae232055d4d8a97267517c5e50074c2c819941and</DL>
6ae232055d4d8a97267517c5e50074c2c819941and<P>
6ae232055d4d8a97267517c5e50074c2c819941andExample:
6ae232055d4d8a97267517c5e50074c2c819941and</P>
6ae232055d4d8a97267517c5e50074c2c819941and<BLOCKQUOTE><CODE>allow from .ncsa.uiuc.edu</CODE></BLOCKQUOTE>
6ae232055d4d8a97267517c5e50074c2c819941and<P>
6ae232055d4d8a97267517c5e50074c2c819941andAll hosts in the specified domain are allowed access.
6ae232055d4d8a97267517c5e50074c2c819941and</P>
6ae232055d4d8a97267517c5e50074c2c819941and<P>
6ae232055d4d8a97267517c5e50074c2c819941andNote that this compares whole components; <CODE>bar.edu</CODE>
6ae232055d4d8a97267517c5e50074c2c819941andwould not match <CODE>foobar.edu</CODE>.
6ae232055d4d8a97267517c5e50074c2c819941and</P>
6ae232055d4d8a97267517c5e50074c2c819941and<P>
6ae232055d4d8a97267517c5e50074c2c819941andSee also <A HREF="#deny">deny</A>, <A HREF="#order">order</A>, and
6ae232055d4d8a97267517c5e50074c2c819941and<A HREF="mod_browser.html#browsermatch">BrowserMatch</A>.
6ae232055d4d8a97267517c5e50074c2c819941and</P>
6ae232055d4d8a97267517c5e50074c2c819941and
6ae232055d4d8a97267517c5e50074c2c819941and<P>
6ae232055d4d8a97267517c5e50074c2c819941and<A name="allowfromenv"><STRONG>Syntax:</STRONG> allow from env=<EM>variablename</EM></A><BR>
6ae232055d4d8a97267517c5e50074c2c819941and<A
6ae232055d4d8a97267517c5e50074c2c819941and HREF="directive-dict.html#Context"
6ae232055d4d8a97267517c5e50074c2c819941and REL="Help"
b43f840409794ed298e8634f6284741f193b6c4ftakashi><STRONG>Context:</STRONG></A> directory, .htaccess<BR>
6ae232055d4d8a97267517c5e50074c2c819941and<A
f086b4b402fa9a2fefc7dda85de2a3cc1cd0a654rjung HREF="directive-dict.html#Override"
6ae232055d4d8a97267517c5e50074c2c819941and REL="Help"
b43f840409794ed298e8634f6284741f193b6c4ftakashi><STRONG>Override:</STRONG></A> Limit<BR>
d29d9ab4614ff992b0e8de6e2b88d52b6f1f153erbowen<A
d29d9ab4614ff992b0e8de6e2b88d52b6f1f153erbowen HREF="directive-dict.html#Status"
d29d9ab4614ff992b0e8de6e2b88d52b6f1f153erbowen REL="Help"
d29d9ab4614ff992b0e8de6e2b88d52b6f1f153erbowen><STRONG>Status:</STRONG></A> Base<BR>
d29d9ab4614ff992b0e8de6e2b88d52b6f1f153erbowen<A
6ae232055d4d8a97267517c5e50074c2c819941and HREF="directive-dict.html#Module"
 REL="Help"
><STRONG>Module:</STRONG></A> mod_access<BR>
<A
 HREF="directive-dict.html#Compatibility"
 REL="Help"
><STRONG>Compatibility:</STRONG></A> Apache 1.2 and above
</P>
<P>
The allow from env directive controls access to a directory by the
existence (or non-existence) of an environment variable.
</P>
<P>
Example:
</P>
<BLOCKQUOTE><PRE>
BrowserMatch ^KnockKnock/2.0 let_me_in
&lt;Directory /docroot&gt;
    order deny,allow
    deny from all
    allow from env=let_me_in
&lt;/Directory&gt;
</PRE></BLOCKQUOTE>
In this case browsers with the user-agent string <TT>KnockKnock/2.0</TT> will
be allowed access, and all others will be denied.
<P>
See also <A HREF="#denyfromenv">deny from env</A>
and <A HREF="#order">order</A>.
</P>
<HR>

<h2><A name="deny">deny directive</A></h2>
<P>
<!--%plaintext &lt;?INDEX {\tt deny} directive&gt; -->
<A
 HREF="directive-dict.html#Syntax"
 REL="Help"
><STRONG>Syntax:</STRONG></A> deny from <EM>host host ...</EM><BR>
<A
 HREF="directive-dict.html#Context"
 REL="Help"
><STRONG>Context:</STRONG></A> directory, .htaccess<BR>
<A
 HREF="directive-dict.html#Override"
 REL="Help"
><STRONG>Override:</STRONG></A> Limit<BR>
<A
 HREF="directive-dict.html#Status"
 REL="Help"
><STRONG>Status:</STRONG></A> Base<BR>
<A
 HREF="directive-dict.html#Module"
 REL="Help"
><STRONG>Module:</STRONG></A> mod_access
</P>
<P>
The deny directive affects which hosts can access a given directory.
<EM>Host</EM> is one of the following:
</P>
<DL>
<DT><CODE>all</CODE>
<DD>all hosts are denied access
<DT>A (partial) domain-name
<DD>host whose name is, or ends in, this string are denied access.
<DT>A full IP address
<DD>An IP address of a host denied access
<DT>A partial IP address
<DD>The first 1 to 3 bytes of an IP address, for subnet restriction.
<DT>A network/netmask pair (<STRONG>Apache 1.3 and later</STRONG>)
<DD>A network a.b.c.d, and a netmask w.x.y.z.  For more fine-grained subnet
    restriction.  (i.e. 10.1.0.0/255.255.0.0)
<DT>A network/nnn CIDR specification (<STRONG>Apache 1.3 and later</STRONG>)
<DD>Similar to the previous case, except the netmask consists of nnn
    high-order 1 bits.  (i.e. 10.1.0.0/16 is the same as 10.1.0.0/255.255.0.0)
</DL>
<P>
Example:
</P>
<BLOCKQUOTE><CODE>deny from 16</CODE></BLOCKQUOTE>
<P>
All hosts in the specified network are denied access.
</P>
<P>
Note that this compares whole components; <CODE>bar.edu</CODE>
would not match <CODE>foobar.edu</CODE>.
</P>
<P>
See also <A HREF="#allow">allow</A> and <A HREF="#order">order</A>.
</P>

<P>
<A name="denyfromenv"><STRONG>Syntax:</STRONG> deny from env=<EM>variablename</EM></A><BR>
<A
 HREF="directive-dict.html#Context"
 REL="Help"
><STRONG>Context:</STRONG></A> directory, .htaccess<BR>
<A
 HREF="directive-dict.html#Override"
 REL="Help"
><STRONG>Override:</STRONG></A> Limit<BR>
<A
 HREF="directive-dict.html#Status"
 REL="Help"
><STRONG>Status:</STRONG></A> Base<BR>
<A
 HREF="directive-dict.html#Module"
 REL="Help"
><STRONG>Module:</STRONG></A> mod_access<BR>
<A
 HREF="directive-dict.html#Compatibility"
 REL="Help"
><STRONG>Compatibility:</STRONG></A> Apache 1.2 and above
</P>
<P>
The deny from env directive controls access to a directory by the
existence (or non-existence) of an environment variable.
</P>
<P>
Example:
</P>
<BLOCKQUOTE><PRE>
BrowserMatch ^BadRobot/0.9 go_away
&lt;Directory /docroot&gt;
    order allow,deny
    allow from all
    deny from env=go_away
&lt;/Directory&gt;
</PRE></BLOCKQUOTE>
In this case browsers with the user-agent string <TT>BadRobot/0.9</TT> will
be denied access, and all others will be allowed.

<P>
See also <A HREF="#allowfromenv">allow from env</A>
and <A HREF="#order">order</A>.
</P>
<HR>

<h2><A name="order">order directive</A></h2>
<P>
<!--%plaintext &lt;?INDEX {\tt order} directive&gt; -->
<A
 HREF="directive-dict.html#Syntax"
 REL="Help"
><STRONG>Syntax:</STRONG></A> order <EM>ordering</EM><BR>
<A
 HREF="directive-dict.html#Default"
 REL="Help"
><STRONG>Default:</STRONG></A> <CODE>order deny,allow</CODE><BR>
<A
 HREF="directive-dict.html#Context"
 REL="Help"
><STRONG>Context:</STRONG></A> directory, .htaccess<BR>
<A
 HREF="directive-dict.html#Override"
 REL="Help"
><STRONG>Override:</STRONG></A> Limit<BR>
<A
 HREF="directive-dict.html#Status"
 REL="Help"
><STRONG>Status:</STRONG></A> Base<BR>
<A
 HREF="directive-dict.html#Module"
 REL="Help"
><STRONG>Module:</STRONG></A> mod_access
</P>
<P>
The order directive controls the order in which <A HREF="#allow">allow</A> and
<A HREF="#deny">deny</A> directives are evaluated. <EM>Ordering</EM> is one
of
</P>
<DL>
<DT>deny,allow
<DD>the deny directives are evaluated before the allow directives.  (The
initial state is OK.)
<DT>allow,deny
<DD>the allow directives are evaluated before the deny directives.  (The
initial state is FORBIDDEN.)
<DT>mutual-failure
<DD>Only those hosts which appear on the allow list and do not appear
on the deny list are granted access.  (The initial state is irrelevant.)
</DL>
<P>
<STRONG>Note that in all cases every <CODE>allow</CODE> and <CODE>deny</CODE>
statement is evaluated, there is no &quot;short-circuiting&quot;.</STRONG>
</P>
<P>
Example:
</P>
<BLOCKQUOTE><CODE>
    order deny,allow<BR>
    deny from all<BR>
    allow from .ncsa.uiuc.edu<BR>
</CODE></BLOCKQUOTE>
<P>
Hosts in the ncsa.uiuc.edu domain are allowed access; all other hosts are
denied access.
</P>
<!--#include virtual="footer.html" -->
</BODY>
</HTML>