mod_access.html revision 618d2847990e59c6fa82b74b160453e1048a2957
22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder<!-- Background white, links blue (unvisited), navy (visited), red (active) -->
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder BGCOLOR="#FFFFFF"
e6d40133bc9f858308654afb1262b8b483ec5922Till Mossakowski TEXT="#000000"
679d3f541f7a9ede4079e045f7758873bb901872Till Mossakowski LINK="#0000FF"
679d3f541f7a9ede4079e045f7758873bb901872Till Mossakowski VLINK="#000080"
1bb1684c83317dfd1692ab53415027b67d8f2faeTill Mossakowski ALINK="#FF0000"
f3faf4e4346b6224a3aaeeac11bac8b5c8932a29Christian Maeder<!--#include virtual="header.html" -->
4a8f990902448d0562fbe1a98ce685ddbd531d38Christian MaederThis module is contained in the <CODE>mod_access.c</CODE> file, and
f3faf4e4346b6224a3aaeeac11bac8b5c8932a29Christian Maederis compiled in by default. It provides access control based on client
996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maederhostname or IP address.
74b841a4b332085d5fd79975a13313c2681ae595Christian Maeder<LI><A HREF="#allowfromenv">allow from env=</A>
f3faf4e4346b6224a3aaeeac11bac8b5c8932a29Christian Maeder<LI><A HREF="#denyfromenv">deny from env=</A>
ba904a15082557e939db689fcfba0c68c9a4f740Christian Maeder<h2><A name="allow">allow directive</A></h2>
7bf4436b6f9987b070033a323757b206c898c1beChristian Maeder<!--%plaintext <?INDEX {\tt allow} directive> -->
c5bc8d60f7c753f81746828329d9e92db1ab7abaChristian Maeder><STRONG>Syntax:</STRONG></A> allow from <EM>host host ...</EM><BR>
ba904a15082557e939db689fcfba0c68c9a4f740Christian Maeder><STRONG>Context:</STRONG></A> directory, .htaccess<BR>
ad270004874ce1d0697fb30d7309f180553bb315Christian MaederThe allow directive affects which hosts can access a given directory.
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder<DD>All hosts are allowed access
95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder<DT>A (partial) domain-name
95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder<DD>Hosts whose names match, or end in, this string are allowed access.
95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder<DT>A full IP address
95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder<DD>An IP address of a host allowed access
95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder<DT>A partial IP address
95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder<DD>The first 1 to 3 bytes of an IP address, for subnet restriction.
95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder<DT>A network/netmask pair (<STRONG>Apache 1.3 and later</STRONG>)
95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder<DD>A network a.b.c.d, and a netmask w.x.y.z. For more fine-grained subnet
95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder<DT>A network/nnn CIDR specification (<STRONG>Apache 1.3 and later</STRONG>)
95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder<DD>Similar to the previous case, except the netmask consists of nnn
95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder high-order 1 bits. (i.e. 10.1.0.0/16 is the same as 10.1.0.0/255.255.0.0)
9192fdd8f0e682ac0f0183dd854d5210fbfa4ec5Christian Maeder<BLOCKQUOTE><CODE>allow from .ncsa.uiuc.edu</CODE></BLOCKQUOTE>
f1b14608f0f3db464c3aded480e49522d73b08e5Christian MaederAll hosts in the specified domain are allowed access.
9192fdd8f0e682ac0f0183dd854d5210fbfa4ec5Christian MaederNote that this compares whole components; <CODE>bar.edu</CODE>
95c27038582e8a2ce24923bee69ef15931b8b87bChristian MaederSee also <A HREF="#deny">deny</A>, <A HREF="#order">order</A>, and
7688e20f844fe88f75c04016841ebb5e5e3d927fChristian Maeder<A HREF="mod_browser.html#browsermatch">BrowserMatch</A>.
12368e292c1abf7eaf975f20ee30ef7820ac5dd5Christian Maeder<A name="allowfromenv"><STRONG>Syntax:</STRONG> allow from env=<EM>variablename</EM></A><BR>
be3f5e3e69900ececafea5b010a8400f26af5362Christian Maeder><STRONG>Context:</STRONG></A> directory, .htaccess<BR>
be3f5e3e69900ececafea5b010a8400f26af5362Christian Maeder><STRONG>Module:</STRONG></A> mod_access<BR>
0d0047d6eb457b56ff10987569769a420754a56fChristian Maeder HREF="directive-dict.html#Compatibility"
0d0047d6eb457b56ff10987569769a420754a56fChristian Maeder><STRONG>Compatibility:</STRONG></A> Apache 1.2 and above
12368e292c1abf7eaf975f20ee30ef7820ac5dd5Christian MaederThe allow from env directive controls access to a directory by the
0d0047d6eb457b56ff10987569769a420754a56fChristian Maederexistence (or non-existence) of an environment variable.
0d0047d6eb457b56ff10987569769a420754a56fChristian Maeder<Directory /docroot>
278af20bd154d99e884bdf8c66d35d36699643c9Christian Maeder order deny,allow
996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder deny from all
278af20bd154d99e884bdf8c66d35d36699643c9Christian Maeder allow from env=let_me_in
412aa5e819f3cd18f0be10b5571661036515b151Christian Maeder</Directory>
a67bea25edc56bbab82c1a1fc6b51e132452188cChristian MaederIn this case browsers with the user-agent string <TT>KnockKnock/2.0</TT> will
278af20bd154d99e884bdf8c66d35d36699643c9Christian Maederbe allowed access, and all others will be denied.
278af20bd154d99e884bdf8c66d35d36699643c9Christian MaederSee also <A HREF="#denyfromenv">deny from env</A>
278af20bd154d99e884bdf8c66d35d36699643c9Christian Maeder<!--%plaintext <?INDEX {\tt deny} directive> -->
81337d455794a0b50fae10b53d0ed85d9e8f2fafChristian Maeder><STRONG>Syntax:</STRONG></A> deny from <EM>host host ...</EM><BR>
81337d455794a0b50fae10b53d0ed85d9e8f2fafChristian Maeder><STRONG>Context:</STRONG></A> directory, .htaccess<BR>
46947810076241f06f3e2919edb2289ed84d6c15Christian MaederThe deny directive affects which hosts can access a given directory.
46947810076241f06f3e2919edb2289ed84d6c15Christian Maeder<DD>all hosts are denied access
4dfed20c33d6c11a723c0c34d4a38006b9f8d4c1Christian Maeder<DT>A (partial) domain-name
a4cb1786d23060c8521a88f08f9909589fa83a12Christian Maeder<DD>host whose name is, or ends in, this string are denied access.
46947810076241f06f3e2919edb2289ed84d6c15Christian Maeder<DT>A full IP address
4dfed20c33d6c11a723c0c34d4a38006b9f8d4c1Christian Maeder<DD>An IP address of a host denied access
4dfed20c33d6c11a723c0c34d4a38006b9f8d4c1Christian Maeder<DT>A partial IP address
4dfed20c33d6c11a723c0c34d4a38006b9f8d4c1Christian Maeder<DD>The first 1 to 3 bytes of an IP address, for subnet restriction.
cc4537e2e13b93e08fc8391d3abb8e412cb71b80Christian Maeder<DT>A network/netmask pair (<STRONG>Apache 1.3 and later</STRONG>)
46947810076241f06f3e2919edb2289ed84d6c15Christian Maeder<DD>A network a.b.c.d, and a netmask w.x.y.z. For more fine-grained subnet
a4cb1786d23060c8521a88f08f9909589fa83a12Christian Maeder<DT>A network/nnn CIDR specification (<STRONG>Apache 1.3 and later</STRONG>)
4dfed20c33d6c11a723c0c34d4a38006b9f8d4c1Christian Maeder<DD>Similar to the previous case, except the netmask consists of nnn
a4cb1786d23060c8521a88f08f9909589fa83a12Christian Maeder high-order 1 bits. (i.e. 10.1.0.0/16 is the same as 10.1.0.0/255.255.0.0)
4dfed20c33d6c11a723c0c34d4a38006b9f8d4c1Christian Maeder<BLOCKQUOTE><CODE>deny from 16</CODE></BLOCKQUOTE>
cc4537e2e13b93e08fc8391d3abb8e412cb71b80Christian MaederAll hosts in the specified network are denied access.
6892075087077b9a2f9baa1663be4afcee2e7254Christian MaederNote that this compares whole components; <CODE>bar.edu</CODE>
a4cb1786d23060c8521a88f08f9909589fa83a12Christian MaederSee also <A HREF="#allow">allow</A> and <A HREF="#order">order</A>.
fa15ba427d20bfe2b50fbe6e2f6f51616aaed016Christian Maeder<A name="denyfromenv"><STRONG>Syntax:</STRONG> deny from env=<EM>variablename</EM></A><BR>
996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder><STRONG>Context:</STRONG></A> directory, .htaccess<BR>
95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder><STRONG>Module:</STRONG></A> mod_access<BR>
3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder HREF="directive-dict.html#Compatibility"
792df0347edab377785d98c63e2be8e2ce0a8bdeChristian Maeder><STRONG>Compatibility:</STRONG></A> Apache 1.2 and above
4dfed20c33d6c11a723c0c34d4a38006b9f8d4c1Christian MaederThe deny from env directive controls access to a directory by the
4dfed20c33d6c11a723c0c34d4a38006b9f8d4c1Christian Maederexistence (or non-existence) of an environment variable.
de66af0f4b27f08f81c7ca9c573ef9cdf7ca7a07Christian Maeder<Directory /docroot>
c30cfe2a6ab063befdfb47449bc286caee6d8fc3Christian Maeder order allow,deny
c30cfe2a6ab063befdfb47449bc286caee6d8fc3Christian Maeder allow from all
bdf2e01977470bedcb4425e2dadabc9e9f6ba149Ewaryst Schulz deny from env=go_away
eaf02872307b4578250fbeb9dc371cac177b0924Ewaryst Schulz</Directory>
95c27038582e8a2ce24923bee69ef15931b8b87bChristian MaederIn this case browsers with the user-agent string <TT>BadRobot/0.9</TT> will
df098122ddc81fe1cb033a151f7305c1dda2dc81Christian Maederbe denied access, and all others will be allowed.
a05cad7f2f387b795a71a3aaec543c78e1b89d38Christian MaederSee also <A HREF="#allowfromenv">allow from env</A>
a67bea25edc56bbab82c1a1fc6b51e132452188cChristian Maeder<h2><A name="order">order directive</A></h2>
c0380b947eef252db81ee562246bb732555427f4Till Mossakowski<!--%plaintext <?INDEX {\tt order} directive> -->
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder><STRONG>Syntax:</STRONG></A> order <EM>ordering</EM><BR>
6892075087077b9a2f9baa1663be4afcee2e7254Christian Maeder><STRONG>Default:</STRONG></A> <CODE>order deny,allow</CODE><BR>
7a6c50ecdec40e0278e8ed4fdadfd669112d887dChristian Maeder><STRONG>Context:</STRONG></A> directory, .htaccess<BR>
22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian MaederThe order directive controls the order in which <A HREF="#allow">allow</A> and
4c7f058cdd19ce67b2b5d4b7f69703d0f8a21e38Christian Maeder<A HREF="#deny">deny</A> directives are evaluated. <EM>Ordering</EM> is one
4c7f058cdd19ce67b2b5d4b7f69703d0f8a21e38Christian Maeder<DT>deny,allow
58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowski<DD>the deny directives are evaluated before the allow directives. (The
a05cad7f2f387b795a71a3aaec543c78e1b89d38Christian Maederinitial state is OK.)
7a6c50ecdec40e0278e8ed4fdadfd669112d887dChristian Maeder<DT>allow,deny
a05cad7f2f387b795a71a3aaec543c78e1b89d38Christian Maeder<DD>the allow directives are evaluated before the deny directives. (The
9192fdd8f0e682ac0f0183dd854d5210fbfa4ec5Christian Maederinitial state is FORBIDDEN.)
58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowski<DT>mutual-failure
a05cad7f2f387b795a71a3aaec543c78e1b89d38Christian Maeder<DD>Only those hosts which appear on the allow list and do not appear
7a6c50ecdec40e0278e8ed4fdadfd669112d887dChristian Maederon the deny list are granted access. (The initial state is irrelevant.)
9192fdd8f0e682ac0f0183dd854d5210fbfa4ec5Christian Maeder<STRONG>Note that in all cases every <CODE>allow</CODE> and <CODE>deny</CODE>
a05cad7f2f387b795a71a3aaec543c78e1b89d38Christian Maederstatement is evaluated, there is no "short-circuiting".</STRONG>
e379124f467e5d0ef7d3c0ca238bff0521f70831Till Mossakowski order deny,allow<BR>
c5bc8d60f7c753f81746828329d9e92db1ab7abaChristian Maeder deny from all<BR>
4dfed20c33d6c11a723c0c34d4a38006b9f8d4c1Christian MaederHosts in the ncsa.uiuc.edu domain are allowed access; all other hosts are
6b00a9239fe7c804524099ca3d25f4ffc6079ceeChristian Maederdenied access.
b9804822fb178b0fc27ce967a6a8cedc42c5bf90Christian Maeder<!--#include virtual="footer.html" -->