You are viewing a plain text version of this content. The canonical link for it is here.
Posted to modperl@perl.apache.org by "Kevin A. McGrail" <km...@pccc.com> on 2005/07/16 21:55:48 UTC
.htaccess question
We have a .htaccess with AuthDBI working perfectly under MP1 and MP2. I've
deleted the data source information but here is the .htaccess we use:
AuthName "Private Site: Unauthorized Access Prohibited"
AuthType Basic
PerlAuthenHandler Apache::AuthDBI::authen
PerlSetVar Auth_DBI_data_source dbi:mysql:(working database source)
PerlSetVar Auth_DBI_pwd_table users
PerlSetVar Auth_DBI_uid_field login
PerlSetVar Auth_DBI_pwd_field password
PerlSetVar Auth_DBI_encryption_method sha1hex/md5hex/crypt
require valid-user
I have tried in vain to figure out a way to make it some that there is no
password from intranet. In pseudo code,
if (192.168.1) { continue } else { do everything above }
Is there a way to do something like this in .htaccess or do I need to make
another mod to AuthDBI?
Regards,
KAM
Re: .htaccess question
Posted by "Kevin A. McGrail" <km...@pccc.com>.
Thanks. I've read that paragraph before and never interpreted it that way
until you pointed it out.
As best I can tell, this is the correct syntax for the pseudocode I posted
previously. From 5 minutes of testing, it looks like what we needed.
AuthName "Private Site: Unauthorized Access Prohibited"
AuthType Basic
PerlAuthenHandler Apache::AuthDBI::authen
PerlSetVar Auth_DBI_data_source dbi:mysql:database=etc...
PerlSetVar Auth_DBI_pwd_table users
PerlSetVar Auth_DBI_uid_field login
PerlSetVar Auth_DBI_pwd_field password
PerlSetVar Auth_DBI_encryption_method sha1hex/md5hex/crypt
Satisfy any
Order Deny,Allow
Deny from all
Allow from 10.10.10
require valid-user
Regards,
KAM
Re: .htaccess question
Posted by Geoffrey Young <ge...@modperlcookbook.org>.
Kevin A. McGrail wrote:
> Not sure really.
>
> I'm trying to make sure that this is the case in pseudocode.
>
> Deny from everyone unless:
>
> 1. From intranet without a password
> -or-
> 2. Anywhere else with a password and valid-user using ApacheDBI
right. that's exactly what Satisfy is for
http://httpd.apache.org/docs/mod/core.html#satisfy
HTH
--Geoff
Re: .htaccess question
Posted by "Kevin A. McGrail" <km...@pccc.com>.
Not sure really.
I'm trying to make sure that this is the case in pseudocode.
Deny from everyone unless:
1. From intranet without a password
-or-
2. Anywhere else with a password and valid-user using ApacheDBI
Regards,
KAM
> <Location /foo>
> Satisfy Any
> Allow from 192.168.2.10
> PerlAuthenHandler Apache::AuthDBI
Re: .htaccess question
Posted by Geoffrey Young <ge...@modperlcookbook.org>.
Philip M. Gollucci wrote:
> Kevin A. McGrail wrote:
>
>> :-) Already read that but I can probably add this as a feature to Apache
>> AuthDBI. Something like AutoLogin or AllowIntranet or something with
>> an IP
>> range that will be matched for and then "meet" the required valid-user
>> requirement.
>>
>>
> I can't think of a good one, but I would use something more generic then
> AllowIntranet. Something involving IP and Range
> or Subnet
are you guys describing
<Location /foo>
Satisfy Any
Allow from 192.168.2.10
PerlAuthenHandler Apache::AuthDBI
...
?
--Geoff
Re: .htaccess question
Posted by "Philip M. Gollucci" <pg...@p6m7g8.com>.
Kevin A. McGrail wrote:
>:-) Already read that but I can probably add this as a feature to Apache
>AuthDBI. Something like AutoLogin or AllowIntranet or something with an IP
>range that will be matched for and then "meet" the required valid-user
>requirement.
>
>
I can't think of a good one, but I would use something more generic then
AllowIntranet. Something involving IP and Range
or Subnet
>Shouldn't be that hard. What's the best way to get the most current devel
>code of ApacheDBI? I've been losing track of patches but saw it was up on
>CPAN now. I uploaded it to CPAN, its not index though. You can get it from my directory.
>
http://search.cpan.org/~pgollucci
FYI: I'll move the patches and distros to
http://people.apache.org/~pgollucci when I get a chance.
--
END
---------------------------------------------------------
What doesn't kill us can only make us stronger.
Nothing is impossible.
Philip M. Gollucci (pgollucci@p6m7g8.com) 301.254.5198
Consultant / http://p6m7g8.net/Resume/resume.shtml
Senior Developer / Liquidity Services, Inc.
http://www.liquidityservicesinc.com
http://www.liquidation.com
http://www.uksurplus.com
http://www.govliquidation.com
http://www.gowholesale.com
Re: .htaccess question
Posted by "Kevin A. McGrail" <km...@pccc.com>.
> > Is there a way to do something like this in .htaccess or do I need to
make
> > another mod to AuthDBI?
> Not that I know of.
>
> The closest thing I can think of is: (I'll bet you read it already)
> http://httpd.apache.org/docs-2.0/howto/auth.html
>
> but that won't do it.
:-) Already read that but I can probably add this as a feature to Apache
AuthDBI. Something like AutoLogin or AllowIntranet or something with an IP
range that will be matched for and then "meet" the required valid-user
requirement.
Shouldn't be that hard. What's the best way to get the most current devel
code of ApacheDBI? I've been losing track of patches but saw it was up on
CPAN now.
> Just FYI, if you have root, you'll want to these things inside a
> <Directory> container in the main httpd.conf or vhost.conf file for
> performance reasons instead of in .htaccess.
Thanks. I know. I even still use the XbitHack too which I should disable
as I rarely ever use SSI.
Regards,
KAM
Re: .htaccess question
Posted by "Philip M. Gollucci" <pg...@p6m7g8.com>.
Kevin A. McGrail wrote:
> I have tried in vain to figure out a way to make it some that there is no
> password from intranet. In pseudo code,
>
> if (192.168.1) { continue } else { do everything above }
>
> Is there a way to do something like this in .htaccess or do I need to make
> another mod to AuthDBI?
Not that I know of.
The closest thing I can think of is: (I'll bet you read it already)
http://httpd.apache.org/docs-2.0/howto/auth.html
but that won't do it.
Just FYI, if you have root, you'll want to these things inside a
<Directory> container in the main httpd.conf or vhost.conf file for
performance reasons instead of in .htaccess.
--
END
------------------------------------------------------------
What doesn't kill us can only make us stronger.
Nothing is impossible.
Philip M. Gollucci (pgollucci@p6m7g8.com) 301.254.5198
Consultant / http://p6m7g8.net/Resume/
Senior Developer / Liquidity Services, Inc.
http://www.liquidityservicesinc.com
http://www.liquidation.com
http://www.uksurplus.com
http://www.govliquidation.com
http://www.gowholesale.com