limiting pages to intranet

[sonun]

Hi, I want some pages to be displayed to only those on trhe intranet and the reast to be avialable world-wide. Where do I control that ?? In /etc/hosts.allow ??
Like put a line like, httpd: thissubnet allow rest disallow ??
But how to limit access to specific pages.
Thanks.

 

[nme]

You could put your restricted pages in a different directory then set up Allow and Deny directives.

<Directory /intranet>
Order Deny,Allow
Deny from all
Allow from myintranet.com
</Directory>

For more info on this see the apache documentation:

http://httpd.apache.org/docs/mod/mod_access.html

 

[Wullie]

Hi all,

Just be aware that if you use this method, then it is so easy to spoof the details passed in the browser. This means that someone spoofing the details have the same access that you have from the intranet.

Better ways to do it would be to set up htaccess password protection or run a seperate instance of apache on another port for the intranet users.

Hope this helps Wullie

http://www.freshlookdesign.co.uk

http://www.searchit-now.co.uk

http://www.survivorhelp.co.uk

 

[nme]

Wullie,

Very interesting - how do they go about the spoof, is it just a URL parameter?

Also, you say about setting up this .htaccess password protection. Is there anyway of having a single sign on with the .htaccess method? I have heard of .htaccess but have never been shown what it can do, do you have any generic examples (or know of any good sources of information, i.e. setting it up from scratch) as at the moment I am using the directory directives. I'm not going to say where since you know how to spoof

Wouldn't the separate copy of Apache on a different port need a firewall to stop internet users from just overidding the default port and geting the content?

nme

 

[Wullie]

Hi mate,

The details can be spoofed by altering the headers sent by the browser. Just the same as the referral page and browser version etc, can also be spoofed. For example, I could be running IE4 and I could send the headers to your servers so that it would think that I had IE6 or NN6.

The htaccess authentication is really easy to use and is just a case of setting up 2 different files on the server. The files are .htaccess and .htpasswd

The .htaccess goes in the directory that you want to protect and the .htpasswd can go in virtually any directory that you want.

To create a htaccess file, you can use a little script that I am working on..

http://support.freshlookdesign.co.uk/htaccess.shtml

This will create the htaccess for you and if you use Windows then it also gives directions on how to crate the htpasswd file.

Now, when that is set up, a user accessing the protected directory will receive a prompt to login. Once logged in, they have access to that directory and also any subdirectories without logging in again.

They only have to login again after they close that browser window, so even if they logged in, visited another site and then returned they would still be logged in.

About the seperate port issue.. If you wanted to do that then yes you would be better off setting the firewall to block all outside access to that port and this makes it much more secure as a port scan from outside would not even show a server running on that port..

Hope this helps Wullie

http://www.freshlookdesign.co.uk

http://www.searchit-now.co.uk

http://www.survivorhelp.co.uk

 

[nme]

Wullie,

Windows NT will not allow me to have a file that starts with a . but doesn't have an extension - it just brings back an error saying you must type a filename.

All the examples I have browsed through show how to set it all up for a unix/linux server, I have not come across a Windows example yet.

Any ideas - do I just use a file called &quot;htaccess&quot; instead?

Thanks

nme

 

[Wullie]

Hi mate,

This is quite a common problem but for some reason, only certain machines give this error..

How are you creating the file?? It should be in notepad and then SAVE AS..

One other thing to try is maybe use the htpasswd app to create a file called .htaccess

This method should work in theory. After you create the file, change the contents and then copy that anytime you want to use htaccess.

Otherwise, you will need to change the filename that Apache looks for. Make sure that if you do this, you also alter the deny rule to reflect the new filename. Otherwise, any of your visitors can read your htaccess files.

The htpasswd file should create no problem..

Hope this helps Wullie

http://www.freshlookdesign.co.uk

http://www.searchit-now.co.uk

http://www.survivorhelp.co.uk

 

[nme]

Wullie,

I've sorted it out - for some reason (I'm guessing its a Service pack thing) I can't create these files that start with a . in Windows Explorer, but I can create the file then rename it with the command prompt. I can then find this file and edit it with notepad as normal.

I have a question about the path for the htpasswd file, since its NT - how do I reference the path? I was just putting
AuthUserFile C:\Program Files\Apache\Apache\.htpasswd
but it was coming back with an error. I got around this by putting the htpasswd file into the same directory as the htaccess file and just giving the filename for the AuthUserFile.

And my last problem was that my password isn't recognised (I've typed it right, I copied and pasted it out of a notepad session) - I am using IE5. Is this something to do with my dodgy fix for the htpasswd file location?

Thanks

nme

 

[Jasen]

Paths in the httpconf and .htaccess files are unix style, I.E. backwards on a windows box.
Your path should be c:/program files/Apache/...

Besides the AuthUserFile directive, did you inlude the other directives? &quot;Require&quot; for instance?
something like this:

AuthType Basic
AuthName &quot;put a name here&quot;
AuthUserFile c:/program files/Apache/Apache/.htpasswd
Require user nme

Note you need to include the username you want to grant access on the require line.

 

[Wullie]

Note you need to include the username you want to grant access on the require line.

No.... You don't ever NEED to do this.

Any usernames and passwords in that particular htpasswd file will automatically have access to the protected directory.

The only time you need to do that is if you dont' want all the users to access.

And use your paths such as /program files/Apache/

This saves a lot of hassle if you ever move to a unix host.

Hope this helps Wullie

http://www.freshlookdesign.co.uk

http://www.searchit-now.co.uk

http://www.survivorhelp.co.uk

 

[Jasen]

Oh. Well shoot, I've doing that for months. haha.. darn documentation is not very clear on that concept.

 

[Wullie]

Hi mate,

The syntax should be like the following:

AuthUserFile /path/to/.htpasswd
AuthGroupFile /dev/null
AuthName &quot;Restricted Area&quot;
AuthType Basic

<Limit GET POST>
require valid-user
</Limit>

Then any user in the file will have access.

Hope this helps Wullie

http://www.freshlookdesign.co.uk

http://www.searchit-now.co.uk

http://www.survivorhelp.co.uk