Chapter 26 WebSite Server Configuration

 

---

The Groups page of Server Admin (shown in is used for managing groups and groups membership. It has three sections:

Authentication Realm

This area works exactly the same as it does on the Users page. Here you select which realm will be affected by the changes you make on the rest of the page. Note that on both the Users and Groups pages, you can create or delete realms.

Group

You can select an existing group in a realm, add a new group, or delete a group. Every realm automatically has an Administrators and a Users group. All users in a realm are members of Users and cannot be removed.

Group Membership

You can view and change the selected group's membership list. All available users in the selected realm will appear in the non-members box (if they aren't already members). To add a user to the group, select her name and press the Add button. It is easier to add users to groups on the Users page when you create them and set their passwords. If the Group(s) you want to add them to are already created, you can add them there and save a possible extra step.

Once you have your users, groups, and realms set up, you can assign access based on them on the Access Control page. Access can also be assigned based on IP address or hostname of the requesting browser. You also use this page to disable automatic directory listings and determine how the server will control access restrictions per URL.

The Access Control page is shown in It has several sections:

URL Path or Special Function

You can select, add, or delete a URL path or special function. The URL path cannot specify a file, so all files and subdirectories under that directory have the restrictions applied to them. You can protect any document or CGI directory. To add a new URL path, press the New button. In the popup dialog, type in the new URL path and select a realm to which it will be restricted. Since restrictions are applied by path, many "control points" may exist along a path. The deepest access control point determines the access restrictions at a particular level. In other words, when the server receives a request from a browser, it starts at the level of the request and works up levels until it finds a control point. The server applies the restrictions at that point and stops; it does not look at restrictions above that point. The special functions are URLs that start with a tilde (~) character and are handled in a special way by the server. Some special function URLs only retrieve data, such a ~stats or ~imagemap. Other special function URLs cause the server to perform an administrative task, such as ~cycle-acc or ~cycle-err to cycle the access and error logs. All of the special function URLs in WebSite are on the Access Control list, although only those that cause the server to do something are protected. You cannot delete special functions from the access control list.

Disable Directory Listings

This checkbox disables automatic directory listings for the selected URL. Users will be able to view or download documents in that URL directory hierarchy only with the specific filename. You can also add user authentication and class restrictions to a URL with disabled directory listings (i.e., authorized users can receive a directory listing).

Logical OR Users and Class

This checkbox tells the server how to evaluate access control. When the box is not checked, the server uses the default method, first looking for class restrictions and then for user authentication (if the class restrictions are met). If the box is checked, the server evaluates both class restrictions and user authentication. If either condition is met, the server returns the requested URL.

Authorized Users & Groups

You can view or change the users and/or groups authorized for the selected URL path or special function. The realm for this URL is displayed above the list. If no users or groups are shown in this box, then the URL has no user authentication restrictions.

Class Restrictions

In this section of the Access Control page, you specify which connections to the Web are allowed and which are denied. First decide the logic the server should follow in testing connections. Should it first deny and then allow, or first allow and then deny? Which you should choose depends on the scope of restriction. To delete an entry, select the entry from the appropriate box and press Delete. To add a new entry, place the cursor in the appropriate box and press New. A popup dialog will open where you type in the address. Class restrictions accept three kinds of entries: all, a full or partial IP address, or a full or partial domain name. You can use metacharacters (* and ?) to match all or part of either IP addresses or domain names. If you use domain names, you must turn on DNS reverse lookup on the Logging page. The server then looks up the name for the IP address of each requesting node. It is recommended that you don't use domain names or DNS reverse lookup because the extra DNS traffic and waiting time may adversely affect server performance.

---

Logging

---