Red Hat DIRECTORY SERVER 2.0 - GATEWAY Manual de usuario descargar pdf (Pagina 76)

Chapter 10. Access control

Access control by client IP address

As ever, this functionality is provided by a module: access_module from library

mod_access.so.

LoadModule access_module modules/mod_access.so

Figure 10-1. Loading access_module

This module offers us three commands: Allow, Deny and Order.

These restrictions need not cover the whole server, and typically don’t. They can be

placed within a <Directory> block or delegated conﬁguration ﬁle to restrict access

to only a subtree of the server. If you want to cover the whole web server then the

document root must be used for the <Directory> block.

The Order command takes one of two arguments: Deny,Allow and Allow,Deny. No

whitespace is allowed around the comma. While it may look like a comma-delimited

list it is not; it is just a pair of rather strange looking arguments that have a comma as

one of their characters.

If the argument is Deny,Allow (the default) then the initial state is that all access is

allowed, then all the Deny statements are processed and then they are overridden by

the Allow statements.

If the argument is Allow,Deny then then the initial state is that all access is prohibited,

then all the Allow statements are processed and then they are overridden by the

Deny,Allow statements. This is best illustrated with some examples.

Order Allow,Deny

Deny from csx.cam.ac.uk

Allow from cam.ac.uk

Deny from csi.cam.ac.uk

</Directory>

Figure 10-2. A Allow,Deny example

Table 10-1. The processing of a request by client gauss.csi.cam.ac.uk

Stage Match? State

Initial All requests refused.

Allow from cam.ac.uk Rule matches. Access is allowed.

Deny from csx.cam.ac.uk Rules does not match. No change in state.

Deny from csi.cam.ac.uk Rule matches. Access is denied.

Final Access is denied.

The addresses given in the Allow and Deny statements can be speciﬁed in a variety

of ways. The examples given are for the Allow command but are equally applicable

to the Deny command.

Syntax summary: Options on the Allow command

Allow from cam.ac.uk

Access is allowed from any host whose name ends with cam.ac.uk.

Allow from 131.111.11.148

Access is allowed for queries originating from 131.111.11.148. Note that any

1 2 ... 71 72 73 74 75 76 77 78 79 80 81 ... 95 96

Sin comentarios

Red Hat DIRECTORY SERVER 2.0 - GATEWAY Manual de usuario Pagina 76