To allow a directory to be restricted within a .htaccess file, you first need to ensure that the access.conf file allows user authentication to be setup in a .htaccess file. This is controlled by the AuthConfig override. The access.conf file should include AllowOverride AuthConfig to allow the authentication directives to be used in a .htaccess file. To restrict a directory to any user listed in the users file just created, you should create a .htaccess file containing:

AuthName restricted stuff
AuthType Basic
AuthUserFile /usr/local/etc/httpd/users
AuthGroupFile /usr/local/etc/httpd/group

require valid-user
AuthName, specifies a realm name for this protection.
AuthType directive tells the server what protocol is to be used for authentication. (Basic or Digest)
AuthUserFile tells the server the location of the user file created by htpasswd. A similar directive, AuthGroupFile, can be used to tell the server the location of a groups file (see below).
valid-user tells the server that any username in the users file can be used. But it could be configured to allow only certain users in:
require user martin jane

2. Groups Authentication

create a group called staff containing users who are allowed to access internal pages. To restrict access to just users in the staff group, you would use

require group staff

Multiple groups can be listed, and require user can also be given, in which case any user in any of the listed groups, or any user listed explicitly, can access the resource. For example

require group staff admin

require user adminuser

which would allow any user in group staff or group admin, or the user adminuser, to access this resource after entering a valid password. A group file consists of lines giving a group name followed by a space-separated list of users in that group. For example:

staff:martin jane
admin:art adminuser

The AuthGroupFile directive is used to tell the server the location of the group file. Note that the maximum line length within the group file in about 8000 characters (actually 8kB).

3. Workstation authentication

If you want to restrcit the workstation access, you can simply first find out the address, say "nslookup spike.cs.umbc.edu", it gives:

Server: localhost
Address: 127.0.0.1

Name: spike.cs.umbc.edu
Address: 130.85.100.80

Then in your .htaccess file, you write
order deny,allow
deny from 130.85.100.80
allow from 130.85.100.75

where "order deny,allow" gives the order of deny and allow. then the second and third line tell which workstation has/has not access priviledge to it.

4. Limiting Methods Differently

Limit GET POST PUT
require valid-user

Limit POST
require group staff

5. Ading more functions

If the Digest method is NOT used in your server, you can download some related modeule from "ftp://ftp.apache.org/apache/dist/contrib/modules/" to your Apache /src/ directory, and then Having got the module source, Apache needs to be configured so that it will compile this code. To do this, edit the Configuration file in the src directory, and add a suitable Module line. This will have the format

Module name_module mod_something.o

The first argument, name_module, must match the name given in the module's source code - look for the 'module definition' near the end of the file, which will look like this:

module name_module = {
NULL,
...
};

The name_module text in the Configuration file must match the name_module text in the module source exactly. The second argument on the Module line is the filename of the module, with the final .c replaced by .o.

After editing Configuration, re-compile Apache.
Finally, stop your current server (with kill -TERM pid), install the new httpd executable, and start it running (e.g. ./httpd -d /usr/local/httpd).

The below are some module.c files available such as:

mod_limit.c: limits on daily usage by users
mod_block.c: allows you to block access to your site that was referred to from a certain URL.
and so on.

III) My example:

1. The following is my sample .htaccess file:

*******************************************************
AuthUserFile /home/grad1/yxie2/www/httpd/users
AuthGroupFile /home/grad1/yxie2/www/httpd/group
AuthName restricted stuff
AuthType Basic

order deny,allow
deny from 130.85.100.80
allow from 130.85.100.75


Limit GET POST PUT
require group staff
require user yifan

2. The following is my sample users/group file in httpd/

After "make httpd", and "httpd -c users added-userid", you need to add password consistently for twice.

in file users:
yifan:0DQHymO4cNcBc
jordan:wdVBz5izhCpVQ
may:WvEzjl5ZztnFs
pippen:4RUN3gFxqxhT6

group file is:
staff:jordan pippen

3. find out the workstation address, creat an access domain for the local region or specific workstation.

4. Go to URL "http://www.cs.umbc.edu/~yxie2/auth.html", click on "Restricted Entry", you get

_______________________________________________________________________________
|Netscape:Password
|? Enter username for restricted stuff at cs.umbc.edu
|User ID:
|Password:
| OK Clear Cancel
|_______________________________________________________________________________

IV) Potential problem

While authentication does allow resources to be restricted to particular users, there are potential security issues. Some of these are:

1. You need to ensure that the resource is restricted against all methods. Use of "Limit GET", for instance, leaves POST and other request methods unprotected.

2. The username and password are stored in a plain text file. While the password is encrypted, it is not completely safe against decryption, so the file should not be accessible to other users on the system.

3. The Basic authentication scheme transmits passwords across the Internet unencrypted, so they could be intercepted. The Digest method, is intended to address this issue (follow the "adding more functions" by adding more modules in the way we have talked before)