Access control for an httpd server is configured by means of one or more Access Control Files (ACFs). There is a global ACF and one or more per-directory ACFs.
The global ACF is a required server configuration file located in the conf directory. The exact location is specified by the AccessConfig directive of httpd.conf. It can contain access controls for any directories on the server.
Per-directory ACFs are files named by the AccessFileName directive of srm.conf. They can contain access controls for that directory and any subdirectories.
Access control directives can be placed into groups. The following sections describe these groups of directives. Each section lists the directives it contains and provides links to the NCSA documentation for each directive.
Directory sections specify the access information for a single directory or pattern of directories. They are specified using the Directory directive.
All access control directives are applied to a specific set of directories. In the global ACF, these directories must be named by directory section directives. The syntax for a directory section is similar to a pair of HTML tags:
<Directory dir> ... access control directives ... </Directory>
dir is an identifier for the directory where the access control directives will apply. It can contain wildcards.
For a per-directory ACF, a directory section directive is already implied, in effect it encloses the entire contents of the file. The dir to which it applies is the directory where it resides.
In either case, directory sections apply to all their subdirectories unless overridden by another ACF.
The AllowOverride directive can appear only in the global ACF. It determines which server access control features can be controlled by directives in the per-directory ACFs. The syntax is:
AllowOverride override-list
where override-list contains one or more of the following:
The Options directive determines which server features can be controlled by directives in the per-directory ACFs. The syntax is:
Options options-list
where options-list contains one or more of the following:
With browsers that support user authentication, it is possible to require users to enter a name and password before accessing a protected document. These directives control the authentication support in the server.
The AuthName directive sets the name of the authorization realm for a directory. This is so your users will know which username and password to use. The syntax is:
AuthName name
where name is the name of the authorization realm.
The AuthType directive sets the type of authorization used in a directory. The syntax is:
AuthType type
where type is "Basic", the only type currently supported.
The AuthUserFile directive specifies the user file to be used for authentication. The user file can be created with the htpasswd support program. The syntax is:
AuthUserFile path
where path is the absolute path of a user file.
The AuthGroupFile directive directive specifies the group file to be used for authentication. The format of a group file is a series of lines containing a group name immediately followed by a colon, then a list of members separated by spaces. The syntax is:
AuthGroupFile path
where path is the absolute path of a group file.
Access limiting sections allow or deny access to documents within a directory based on the name of the host trying to retrieve them. They are specified using the Limit directive.
All access limiting directives must appear inside of a limit section. The syntax for a limit section is similar to a pair of HTML tags:
<Limit method-list> ... limiting directives ... </Limit>
where method-list contains one or more of the following:
Only the following directives are allowed inside of a limit section:
The order directive affects the order in which deny and allow directives are evaluated within a Limit section. The syntax is:
order ord
where is one of the following:
The deny directive specifies hosts which will be denied access. The syntax is:
deny from host-list
where host-list contains one or more hosts specified in one of the following ways:
The deny directive specifies hosts which will be allowed access. The syntax is:
allow from host-list
where host-list contains one or more hosts specified in one of the following ways:
The syntax is:
require entity entity-list
where entity is of the following:
and entity-list is a list of named entities.
Many directives that you can use in directory sections of an ACF are exactly the same as directives from srm.conf, with the exception of the scope where they are in effect. These duplicated directives are: