Using the access configuration file
The access.conf file is the third file that must be configured to set up an HTTP server. You can configure or reconfigure the access.conf file by setting the value of one or more directives. You can open the access.conf file and change the value of a directive in a text editor. The access.conf file is responsible for setting the security of the HTTP server. For example, you can set the Allow directive to allow an HTTP client with a specific IP address access to the HTTP server. You can also use the Deny directive to prohibit an HTTP client with a specific IP address access to the HTTP server. Listed below are the important directives which appear in the access.conf file.
All the directives that appear in the access.conf file must appear between opening and closing directory tags. You must specify the directory in the opening tag. For example, if you want to specify the /var/www/ directory, you would specify this directory in the opening directory tag. The opening tag must be followed by a closing tag. For example:
<Directory /var/www>
</Directory>
You can specify a directive, which is applicable to the directory, within the directory tags. For example you could insert the AllowOverride directive within the directory tags. For example:
<Directory /var/www>
AllowOverride None
</Directory>
Notes
If you neglect to place a directive within the directory tags, the HTTP server will not apply the directive.
Options
You can set which HTTP server features are available in a particular directory. You can set the Options directive to none, or you can set the Options directive to one or more of the following:
Allallows all options with the exception of MultiViews
ExecCGIlets the HTTP server execute CGI scripts
FollowSymLinkslets the HTTP server follow symbolic links in the given directory
IncludesNOEXEClets server-side includes but the #exec command and #include of cgi scripts are disabled
Includesserver-side includes are permitted. For information about server-side includes, see "Working with Server Side Includes."
Indexeslets the HTTP server return a listing of the directory if the HTTP server cannot locate a directory index. For example, if the HTTP server cannon find index.html.
MultiViews lets the HTTP server use MultiViews. MultiViews allow the HTTP server to search the directory structure looking for a specific file. This is a useful feature, but may slow the HTTP server's performance.
You can set more then one option for the Options directive. In the following example the Indexes and MultiViews options are set:
<Directory /var/www>
Options Indexes MultiViews
</Directory>
You can set the all options except for the MultiViews. Refer to the following:
<Directory /var/www>
Options All
</Directory>
Notes
In the two examples above, the directory is /var/www. This directory is located on the HTTP server.
The default setting is All.
AllowOverride
The HTTP server needs to know which directives declared in the .htaccess file can override access information located in the access.conf file. You can set security settings in a .htaccess file. If security settings defined in the .htaccess file contradict security settings defined in the access.conf file, the HTTP server needs to know which settings in the access.conf file can be overridden. You can set the Override directive to None, in which case the HTTP server does not read the .htaccess file. You can set this directive to one of the following values:
AuthConfiglets you use the authorization directives
FileInfolets you use the directives that control document types
Indexeslets you use the directives that control directory indexing
Limitlets you use the directives that control host access
Optionslets you use the directives that control specific directory features
Nonelets you inform the HTTP server not to override access information
In the following example, the AllowOverride directive is set to None.
<Directory /var/www>
AllowOverride None
</Directory>
Notes
For information about .htaccess, see the AccessFileName directive in "Using the srm configuration file."
It is possible to set access control information in the access.conf file or in the files located in a specific directory, in which case the AccessFileName directive specifies the file extension. It is recommended that newer users set access information in the access.conf file.
Order
You can use the Order directive to determine the order that the Allow and Deny directives are evaluated. The Allow and Deny directives determine which HTTP clients can access a given directory. You can set this directive to one of the following:
deny,allowevaluates the Deny directives before the Allow directives
allow,denyevaluates the Allow directives before the Deny directives
mutual-failuregrants access to the HTTP clients that appear on the allow list and do not appear on the deny list
In the following example, the Allow directive is evaluated before the Deny directives.
<Directory /var/www/>
Order allow,deny
allow from all
deny from 120.150.8.43
deny from 120.150.106.6
deny from 120.150.4.65
</Directory>
Allow
You can set the Allow directive to allow an HTTP client access to a specific directory. You can set this directive to one of the following:
allspecifies that all HTTP clients are allowed access
An IP addressspecifies an IP address of an HTTP client
In the following example, the Allow directive is set to all. All HTTP clients can access the /var/www directory, except for HTTP clients with the specified IP addresses.
<Directory /var/www>
Order allow,deny
allow from all
deny from 120.150.8.43
deny from 120.150.106.6
deny from 120.150.4.65
</Directory>
Deny
Setting the Deny directive prohibits an HTTP client from accessing a specified directory. You can deny access to the document root directory to prevent an HTTP client from accessing the Web site. For information about the document root directory, see the DocumentRoot directive in "Using the srm configuration file."
You can set the Deny directive to be one of the following:
allspecifies that all HTTP clients are denied access
An IP addressspecifies an IP address of an HTTP client
In the following example, three IP addresses are prohibited from accessing the /var/www directory. You can multiple Deny directives.
<Directory /var/www/Islands>
Order allow,deny
allow from all
deny from 120.150.8.43
deny from 120.150.106.6
deny from 120.150.4.65
</Directory>