Internet security : Using Access Control List

Make money from your photos, videos and blogs. Get Started Now!

Posted in: Internet Security in yayasiri's Blog

Another method of controlling access to the server is to use access control list (ACL) files. These are files named .www_acl which reside in the directory of the files to be protected. ACL files can be used in two ways:

As a secondary form of access control, on top of the protection offered by protection directives in the http.conf file.

As the sole form of access control. You still need Protection and Protect directives, because they define the password file to use and the directory to protect. However if you code the following line in the Protection directive, the Mask entries in it will be ignored, so long as there is an ACL file in the target directory:

ACLOverride On

An ACL file consists of a series of lines of the form:

file : method : user_or_group

The file specification can contain wildcards (*) in the same way as the definitions in the Protect directives in the configuration file. The methods supported are also similar to those found in Protection directives, but without the suffix Mask. The user or group specification is exactly the same as in a Protection directive.

We will illustrate this with an example. We have a password file (D:\WWW\httpd.password) containing two user IDs, bob and alice. In our httpd.cnf file we have the following Protection and Protect directives:

Protection BOB {

ServerID Myserver

Authtype Basic

GetMask A11(*)

ACKIverrude On

PasswdFile D:\WWW\httpd.password

}

Protect /bobstuff/* BOB

Notice that we are assigning the protection to all files below the /bobstuff subdirectory (in fact, this maps to D:\usserv\bobstuff on our OS/2 server because of the catchall Pass directive). We now create a .www_acl file in the bobstuff directory containing the following lines:

*.html : GET : A11(*)

*.html : GET : bob

Now, user ID alice can retrieve any files with extension html, but only bob can retrieve files with the special extension, html. Any file with a different extension (neither html or htmx) will not be accessible because there is no ACL entry to match it. If we had no specified ACLOverride On in he configuration file , this would not be so.