Scenario 1: block all access to Apache except to a list of whitelisted IP addresses and networks
Apache configuration snippet:
<Directory /var/www/html/>
IncludeOptional /etc/apache2/whitelist.conf
Order allow,deny
Allow from all
</Directory>
Contents of whitelist.conf file:
# local server IPs
Require ip 127.0.0.1
Require ip 172.31.2.2
# Office network
Require ip 1.2.3.0/24
# Other IP addresses
Require ip 4.5.6.7/32
Require ip 5.6.7.8/32
etc.
Scenario 2: enable basic HTTP authentication but allow specific IP addresses through with no authentication
Apache configuration snippet:
<Directory /var/www/html/>
AuthType basic
AuthBasicProvider file
AuthName "Restricted Content"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user
IncludeOptional /etc/apache2/whitelist.conf
Satisfy Any
</Directory>
The contents of whitelist.conf are similar to the ones in Scenario 1.
Scenario 3: enable basic HTTP authentication but allow access to specific URLs with no authentication
Apache configuration snippet:
<Directory /var/www/html/>
Order allow,deny
Allow from all
AuthType Basic
AuthName "Restricted Content"
AuthUserFile /etc/apache2/.htpasswd
SetEnvIf Request_URI /.well-known/acme-challenge/* noauth=1
<RequireAny>
Require env noauth
Require valid-user
</RequireAny>
</Directory>
This is useful when you install SSL certificates from Let's Encrypt and you need to allow the Let's Encrypt servers access to the HTTP challenge directory.
No comments:
Post a Comment