Russian Style .htaccess rewrite

Forbidding all files:

Deny from all

Allow access from a certain IP address:

Order Allow Deny
Deny from all
Allow from this IP

your_IP is a specific IP

Order Allow Deny
Deny from all
Allow from 192.164.3.199

Forbid access from a certain IP address:

Order Allow Deny
Deny from all
Deny from this IP

Using this IP is similar to the example above.

Forbidding a group of files by mask:

<Files ~ "\.(inc|phps|scgi)$">
Order Allow,Deny
Deny from all
</Files>

Defines access to a file by its extension. For example, forbidding web visitors to access files with the "inc" extension:

<Files ~ "\.(inc)$">
Order Allow,Deny
Deny from all
</Files>

In this example the Apache server can access files with this extension.

Forbidding a particular file:

You can forbid a particular file using its name and extension.

<Files config.inc.php>
Order Allow,Deny
Deny from all
</Files>

This example forbids the file config.inc.php to be accessed. Setting a password

Password for a directory:

AuthName "Private zone"
AuthType Basic
AuthUserFile /home/site/.htpasswd
require valid-user

AuthName will be displayed for the user and can be used to explain authentication request. The value of AuthUserFile defines the location where the file with passwords for accessing this directory is stored. This file is created by a special tool named htpasswd or online at htpasswd generator.

For example, we create the following .htaccess file in the protected directory:

AuthName "Only Authenticated Users"
AuthType Basic
AuthUserFile /pub/site.com/.htpasswd
require valid-user

In this example, the user requesting this directory will read the message "Only Authenticated Users", the file with passwords for access must be stored in the directory /pub/site.com/ and it must be named .htpasswd . The directory is specified from the server root. If you specify the directory incorrectly, Apache will not be able to read the .htpasswd file and nobody will get access to this directory.

Password for one file only:

Similar to protecting a whole directory with a password, you can set a password for one file only. An example of setting a password to the file private.zip:

<Files private.zip>
AuthName "Users zone"
AuthType Basic
AuthUserFile /home/site/.htpasswd
</Files>

Password for a group of files:

Similarly, you can use

<Files ~ "\.(inc|sql|...other_extensions...)$">

to set password for files by mask. An example of setting a password for accessing all files with the "sql" extension:

<Files ~ "\.(sql)$">
AuthName "Users zone"
AuthType Basic
AuthUserFile /home/site/.htpasswd
</Files>

Checking access rights

Task: there is a directory named a1 containing two subdirectories (a2, a3), there are two access levels for users. The first group can access only a1 and a2, the second group can access all three directories. You should perform authentication only once - when accessing a1, but observe access rights for а2 and а3.

The username and password are requested only once while accessing а1 - if the user has access to а2, the password it not requested again. If the user has no access to а3, he will see the message "Enter the password".

www.site.com/a1
www.site.com/a1/а2
www.site.com/a1/a3
a1 - common and protected at the same time
а2 and а3 only for certain users.

The .htaccess file for the directory а1:

AuthName "Input password"
AuthType Basic
AuthUserFile "/home/site/htdocs/locked/.htpasswd"
<Files *.*>
require valid-user
</Files>

The .htaccess file for the directory а2:

AuthName "Input password"
AuthType Basic
AuthUserFile "/home/site/htdocs/locked/.htpasswd"
<Files *.*>
require user user1 user2 user3
</Files *.*>

The .htaccess file for the directory а3:

AuthName "Input password"
AuthType Basic
AuthUserFile "/home/site/htdocs/locked/.htpasswd"
<Files *.*>
require user user1 user4 user5
</Files *.*>

Redirecting Visitors

Redirecting to another URL:

To redirect a visitor to http://site.com, add the following to .htaccess

Redirect / http://www.site.com

Displaying different pages depending on the visitor's IP address:

SetEnvIf REMOTE_ADDR <required_IP> REDIR="redir"
RewriteCond %{REDIR} redir
RewriteRule ^/$ /another_page.html

For example, redirecting visitors with IP 192.167.131.1 to the page index.html:

SetEnvIf REMOTE_ADDR 192.167.131.1 REDIR="redir"
RewriteCond %{REDIR} redir
RewriteRule ^/$ /index.html

Redirecting a visitor when he request certain pages:

It is already for all network viruses and scanners. Now any request with the address /_vti_bin will be automatically redirected to Microsoft:

redirect /_vti_bin http://www.microsoft.com
redirect /scripts http://www.microsoft.com
redirect /MSADC http://www.microsoft.com
redirect /c http://www.microsoft.com
redirect /d http://www.microsoft.com
redirect /_mem_bin http://www.microsoft.com
redirect /msadc http://www.microsoft.com
RedirectMatch (.*)\cmd.exe$ http://www.microsoft.com$1

How to change the default page?

To change the page that will be displayed when a visitor access a directory, write:

DirectoryIndex <necessary page>

It is possible to specify several pages:

DirectoryIndex index.shtml index.php index.php3 index.html index.htm

How to make Apache process SSI directives?

SSI Allows you to "assemble" a page using its parts. You have the code of the menu in one part, the code of the header in another part and the footer in a third part. And the visitor sees a usual page consisting of the code stored in your parts.

Some settings in httpd.conf are required.

Add

Options Includes

After that add the following to the .htaccess file:

AddHandler server-parsed .shtml .shtm .html .htm

We advise you to use the program htpasswd generator

How to process Apache errors yourself?

The most interesting and useful Apache errors are 403-404, 500.

403 - the user has not been authenticated, access denied (Forbidden).
404 - the requested document (file, directory) is not found.
500 - internal server error (for example, an error in the syntax of the .htaccess file).

For the user to see your own error messages for these error, add the following to .htaccess:

ErrorDocument 403 /errors/403.html
ErrorDocument 404 /errors/404.html
ErrorDocument 500 /errors/500.html

If error 404 occurs, the user receives the file errors/403.html.

It is convenient to create your own handler for some errors. Add the following to .htaccess:

ErrorDocument 403 /errors/error.php?403
ErrorDocument 404 /errors/error.php?404
ErrorDocument 500 /errors/error.php?500

How to forbid the contents of a directory to be displayed if it has no index file?

Suppose all graphics used on your site is stored in the 'img' directory. A visitor can type the address of this directory in his browser and see the list of all your image files. Of course, it will not cause any damage, but you might forbid the visitor to view this directory as well. Add the following to .htaccess:

Options -Indexes

Is it possible to specify the encoding of all file the browser receives documents in by default?

When the Internet only came to existence and first browsers appeared, it often happened that the browser could not automatically determine which of the Russian encodings a document was written in and the browser displayed a complete mess. To avoid it, specify that all pages will be encoded in Windows-1251:

AddDefaultCharset windows-1251

SOURCE
About these ads

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s