Using.htaccess to Restrict Access to OU Directories

Transcription

1 Using.htaccess to Restrict Access to OU Directories Last Updated: 7/8/15/ by Webmasters can place.htaccess files in any directory in OU or on Cavern to restrict access. The two examples shown at the end of this document will allow for, respectively, access to the directory by username, or access to the directory by anyone who has a UARK account. Correct username and password will need to be entered by the user when presented the prompt in order to authenticate. When using this, please be sure that the webpage requesting the credentials is using the https protocol. Otherwise, the credentials will be sent over the network in plain text. Please also use agnostic protocols for any resources used in the secure directory. An example of an agnostic protocol for an image would be: <img src= // />. Notice that there is no http or https. Using the method will allow the server to request the image either over http or https, depending on the protocol used when the page is served to the user. If resources are retrieved over http when the page is being served over https, any user of the website will get annoying unsecured content prompts and a warning over the https portion in the address bar of the web browser. Included within this document are the different processes required for accomplishing.htaccess configurations, whether on the OU server or on Cavern. I..htaccess on OU 1. A new text file should be created on the desktop. Name the file, htaccess.txt (without the quotes). 2. Copy whichever code block is needed. Code blocks are at the end of this document. 3. Update the highlighted sections of the code so that they are configured to the needs of the directory that will be needing the access restrictions. 4. Save the file. 5. Login to OU CMS to the proper account and website. Navigate to the folder that needs to be restricted. Click the gray Upload button that is beneath the top navigation bar

2 6. Once the user has either selected or dragged and dropped the file to be uploaded, set whatever permissions necessary (Access Group field), then click the grey rename button just to the right of the filename in the modal window, rename the file to.htaccess (without the quotes) [shown in the below screenshot]. Then, click the blue ok button. Then, click the blue Start Upload button. Finally, publish the file to production. 7) Then go to the URL for the directory that you ve secured. You should see a login prompt when the page is served.

3 8) If using the first block of code, be sure all users listed in the.htaccess file can access the directory.

4 II..htaccess on Cavern 1. In order to place and configure.htaccess files on Cavern, a different method has to be used than the method used for OU. SSH will need to be used to manage the.htaccess file on Cavern. Use the SSH tool of your choice, or download PuTTY at This example will use screenshots from PuTTy. 2. Once PuTTy is installed, click on the putty.exe icon and then click run. 3. Input cavern.uark.edu for IP address. The PuTTy configuration screens should look like the following screenshot:

5

6 4. When a user logs in, enter the username/account name for whatever directory the user is trying to access on cavern. Hit enter, then type in the password. Please note that the characters will not show as you type, however, upon completing typing the password, hit enter and the prompt should then authenticate. Here is a screenshot showing what the prompt looks like.

7 5. Upon successful login, the display will look like:

8 6. Use the command ls -la to view the files in the current directory. The switch -la is needed to view the hidden.htaccess files. Use the command cd to change directories. Here is a cheat sheet for SSH commands (which work for PuTTy): After navigating to the correct directory where the.htaccess file should be placed, and after typing ls -la the user should see the folder and file contents, similar to:

9 7. Type mkdir testdir to create a folder called testdir in the current directory where the user has cd ed into. Type ls -la to see the new directory listed. 8. Cd into the testdir. Finally to create the new.htaccess file, at the server prompt in PuTTy, enter: nano.new-htaccess to open a new, empty file.

10 9. Copy either of the blocks from the end of this document, paste it into notepad to remove and special characters, then cut and paste into putty by using a copy command to copy the text from the notepad and click into putty, and then left click the mouse button, which copies whatever is in the clipboard into the SSH screen. It should look something like: 10. Type Ctrl X to exit. Then type y to save, and finally hit the enter key. The directory should now be secure. Be sure to test it. Please note that if you have to edit the.new-htaccess file, it is best to change it in the notepad, delete all of the code in the PuTTy shell (move the green cursor by using the arrow keys on the keyboard, then backspace key), then repaste the code into the window and then follow the same steps here in #10.

11 Working Code Examples In the examples below, simply change the highlighted lines to the information specific to the user s use case. The top block allows for only specific users, while the bottom code allows any user with a UARK account. SSLRequireSSL ErrorDocument AuthType Basic AuthName "uark.edu. Please enter your UARK username and password" AuthBasicProvider ldap AuthzLDAPAuthoritative on AuthLDAPURL "ldap://ds.uark.edu/ou=people,dc=uark,dc=edu?uid Require ldap-user lucero akorat cnixon rjedwar marys gall webserv SSLRequireSSL ErrorDocument AuthType Basic AuthName "uark.edu. Please enter your UARK username and password" AuthBasicProvider ldap AuthzLDAPAuthoritative on AuthLDAPURL "ldaps://ds.uark.edu:636/ou=people,dc=uark,dc=edu" Require valid-user

12

13