mod_auth

MODULE

mod_auth

MODULE SUMMARY

User authentication using text files.

DESCRIPTION

This module provides for basic user authentication using textual files. The following config directives are described:

• allow
• AuthUserFile
• AuthName
• AuthUserFile
• <Directory>
• require

The Directory config directive is central to be able to restrict access to certain areas of the server. Please read about the Directory config directive.

DIRECTIVE: "allow"

Syntax: allow from host host ...
Default: allow from all
Module: mod_auth(3)
Context: <Directory>
Related: allow, AuthGroupFile, AuthName, require

allow defines a set of hosts which should be granted access to a given directory. host is one of the following:

all

All hosts are allowed access.

A regular expression (Read regexp(3))

All hosts having a numerical IP address matching the specific regular expression are allowed access.

For example:

allow from 123.34.56.11
    

All hosts in the specified domain are allowed access.

DIRECTIVE: "AuthGroupFile"

Syntax: AuthGroupFile filename
Default: - None -
Module: mod_auth(3)
Context: <Directory>
Related: allow, AuthName, AuthUserFile, require

AuthGroupFile sets the name of a text file which contains the list of user groups for user authentication. filename is the absolute path to the group file.

Each line of the group file contains a group name followed by a colon, followed by the member user names separated by spaces. For example:

group1: bob joe ante
    

For security reasons, make sure that the AuthGroupFile is stored outside the document tree of the Web server. If it is placed in the directory which it protects, clients will be able to download it.

DIRECTIVE: "AuthName"

Syntax: AuthName auth-domain
Default: - None -
Module: mod_auth(3)
Context: <Directory>
Related: allow, AuthGroupFile, AuthUserFile, require

AuthName sets the name of the authorization realm (auth-domain) for a directory. This string informs the client about which user name and password to use.

DIRECTIVE: "AuthUserFile"

Syntax: AuthUserFile filename
Default: - None -
Module: mod_auth(3)
Context: <Directory>
Related: allow, AuthGroupFile, AuthName, require

AuthUserFile sets the name of a text file which contains the list of users and passwords for user authentication. filename is the absolute path to the user file.

Each line of the user file contains a user name followed by a colon, followed by the non-encrypted password. The behavior is undefined if user names are duplicated. For example:

ragnar:s7Xxv7
edward:wwjau8
    

For security reasons, make sure that the AuthUserFile is stored outside the document tree of the Web server. If it is placed in the directory which it protects, clients will be able to download it.

DIRECTIVE: "Directory"

Syntax: <Directory regexp-filename>
Default: - None -
Module: mod_auth(3)
Related: allow, AuthGroupFile, AuthUserFile, AuthName, require

<Directory> and </Directory> are used to enclose a group of directives which applies only to the named directory and sub-directories of that directory. regexp-filename is an extended regular expression (See regexp(3)). For example:

<Directory /usr/local/httpd[12]/htdocs>
     AuthName My Secret Garden
     AuthUserFile /var/tmp/server_root/auth/user
     AuthUserFile /var/tmp/server_root/auth/group
     require user ragnar edward
     require group group1
     allow from 123.345.344.5
</Directory>
    

If multiple directory sections match the directory (or its parents), then the directives are applied with the shortest match first.

DIRECTIVE: "require"

Syntax: require entity-name entity entity ...
Default: - None -
Module: mod_auth(3)
Context: <Directory>
Related: allow, AuthGroupFile, AuthName, AuthUserFile

require defines users which should be granted access to a given directory using a secret password. The allowed syntaxes are:

require user user-name user-name ...

Only the named users can access the directory.

require group group-name group-name ...

Only users in the named groups can access the directory.

EWSAPI MODULE INTERACTION

Uses the following EWSAPI interaction data, if available:

{real_name,{Path,AfterPath}}

as defined in mod_alias(3).

Exports the following EWSAPI interaction data, if possible:

{remote_user,User}

The user name with which the user has authenticated himself.

Uses the following exported EWSAPI functions:

• mod_alias:path/3

SEE ALSO

httpd(3), mod_alias(3), mod_auth_mnesia(3)

AUTHORS

Joakim Grebenö - jocke@erix.ericsson.se