Apache Guide: Apache Authentication, Part 1 Page 3

There are two sets of Perl modules available for managing your password files and group files with Perl.

The first one, which is probably the recommended one, is the HTTPD-User-Manage package, which you can obtain from CPAN (http://www.cpan.org/modules/by-module/HTTPD/), allows you to manage a variety of authentication files on a variety of web servers. It is extremely full-featured and lets you do all the sorts of things that you expect to be able to do. These modules were written by Lincoln Stein and Doug MacEachern.

The other set of modules I really only mention as shameless self-promotion. Apache::Htpasswd, by Kevin Meltzer, and Apache::Htgroup, by me, provide a simpler interface to managing password and group files specifically for Apache. These modules are also available on CPAN.

What Other Neat Stuff Can I Do?

Authentication by username and password is only part of the story. Frequently you want to let people in based on something other than who they are. Something such as where they are coming from.

The allow and deny directives let you allow and deny access based on the host name, or host address, of the machine requesting a document. The directive goes hand-in-hand with these is the order directive, which tells Apache in which order to apply the filters.

The usage of these directives is:

       allow from address



where address is an IP address (or a partial IP address) or a fully
qualified domain name (or a partial domain name).


For example, if you have someone spamming your message board, and you want
to keep them out, you could do the following:
       deny from 205.252.46.165



Visitors coming from that address will not be able to see the content behind
this directive. If, instead, you have a machine name, rather than an IP
address, you can use that:
       deny from dc.numbersusa.com



And, if you'd like to block access from an entire domain, you can specify
just part of an address or domain name:
        deny from 192.101.205
        deny from cyberthugs.com
        deny from ke



Using order will let you be sure that you are actually
restricting things to the group that you want to let in, by combining a
deny and an allow directive:
        order deny,allow
        deny from all
        allow from dev.rcbowen.com



Listing just the allow directive would not do what you want,
because it will let folks from that host in, in addition to letting everyone
in. What you want is to let only those folks in. 
More Information


You should also read the documentation for mod_auth (http://www.apache.org/docs/mod/mod_auth.html),
which contains some more information about how this all works. And the FAQ on
the Apache site has some good stuff about authentication, starting at
http://www.apache.org/docs/misc/FAQ.html#dnsauth.

Next Week


Next week, I'll talk about mod_auth_dbm and
mod_auth_mysql, which are two ways to authenticate against a
database, rather than against a text-file password list. This is much faster.