 |  |
| |
So far we have dealt with potential users on an individual basis. We can also allow access from or deny access to specific IP addresses, hostnames, or groups of addresses and hostnames. The commands are allow from and deny from.
The order in which the allow and deny commands are applied is not set by the order in which they appear in your file. The default order is deny then allow : if a client is excluded by deny, it is excluded unless it matches allow. If neither is matched, the client is granted access.
The order in which these commands is applied can be set by the order directive.
| allow from |
allow from host host ... directory, .htaccess
The allow directive controls access to a directory. The argument host can be one of the following:
| allow from env |
allow from env=variablename ... directory, .htaccess
The allow from env directive controls access by the existence of a named environment variable. For instance:
BrowserMatch ^KnockKnock/2.0 let_me_in <Directory /docroot> order deny,allow deny from all allow from env=let_me_in </Directory>
| deny from |
deny from host host ... directory, .htaccess
The deny from directive controls access by host. The argument host can be one of the following:
| deny from env |
deny from env=variablename ... directory, .htaccess
The deny from env directive controls access by the existence of a named environment variable. For instance:
BrowserMatch ^BadRobot/0.9 go_away <Directory /docroot> order allow,deny allow from all deny from env=go_away </Directory>
Access by a browser called BadRobot v0.9 sets an environment variable go_away, which in turn triggers deny from.
| Order |
order ordering directory, .htaccess
The ordering argument is one word (i.e., it is not allowed to contain a space) and controls the order in which the foregoing directives are applied. If two order directives apply to the same host, the last one to be evaluated prevails:
allow from all
which lets everyone in and is hardly worth writing, or we could say:
allow from 123.156 deny from all
order allow,deny allow from 123.156 deny from all
deny from 123.156.3.5
deny from badguys.com
Good intentions, however, are not enough: before conferring any trust in a set of access rules, you want to test them very thoroughly in private before exposing them to the world. Try the site with as many different browsers as you can muster: Netscape and MSIE can behave surprisingly differently. Having done that, try the site from a public-access terminal — in a library, for instance.
|  | |
| 5.8. Variations on a Theme |  | 5.10. DBM Files on Unix |
Copyright © 2003 O'Reilly & Associates. All rights reserved.