Apache Webserver

cornish · 08-09-2007, 05:29 AM

I have installed an Ubuntu LAMP server on our Windows domain, it hosts a Database that the IT Dept need to access though out the sites.

This part is working fine the only problem I have at the moment is that any old Joe can also access this server by typing the name in a browser.

How do I control the access to /var/www so only a certain group of users can you view the website, i.e myDomain/IT-Dept?

brianmcgee · 08-09-2007, 06:16 AM

You could place the following settings into your httpd.conf (don't forget to reload server!) so that only the IP range for your administrators is enabled to access the directory:

Code:

<Directory /var/www/html/some/dir>
      	Order Deny,Allow
      	Deny from all
      	Allow from 111.22.33
</Directory>

or you could create a .htaccess file that is placed in the according directory.

If you also want that only specific users may access the site you should create a .htaccess and .htpasswd:

.htaccess

Code:

    AuthName Restricted Area
    AuthType Basic
    AuthUserFile /some/path/.htpasswd
    require valid-user
#    require user user1
#    require user user5

.htpasswd

Code:

    user1:4Rw6jvSWm8E3c
    user2:lBpXKPKYBNVhg
    ...

You can create the password file with:

Code:

# htpasswd -c /some/path/.htpasswd username
New password:
Re-type new password:
Adding password for user username

Or you could use an online generator [1].

[1] http://aspirine.org/htpasswd_en.html