Question on IP restriction in Apache

[kirank]

Hi,

I was wondering if anyone can suggest me a better approach to configure apac
he server to restrict users to access only certain pages of my web site.

My scenario is as follows

I've 5 pages, whcih users can directly get to

example i've a.jsp,b.jsp,c.jsp,d.jsp,e.jsp.

Some IP's should only be allowed to view a.jsp and b.jsp.

While some other IP's are restricted to view c.jsp, d.jsp and e.jsp.

I used the following lines in httpd.conf to acheive this

<Location Test/a.jsp>
deny from all
allow from 127.0.0.1 68.199.184.63
</Location>

<Location Test/b.jsp>
deny from all
allow from 127.0.0.1 68.199.184.63
</Location>

<Location Test/c.jsp>
deny from all
allow from 128.128.2.3 129.125.4.5
</Location>

<Location Test/d.jsp>
deny from all
allow from 128.128.2.3 129.125.4.5
</Location>

<Location Test/e.jsp>
deny from all
allow from 128.128.2.3 129.125.4.5
</Location>

I placed these 5 blocks in my httpd.conf file and restriction is taking plac
e and users with the IP's mentioned in blocks a & b are not able to access c
,d,e page.

As everyone can see this is cumbersome and if I've a whole lot more pages th
e config file will surely get bulkier with all these "Location" tags

I was wondering if there is any other sophisticated way to club all the URI'
s that have the same Access Control List (ACL)

For example something like

<Location Test/a.jsp, Test/b.jsp>
deny from all
allow from 127.0.0.1 68.199.184.63
</Location>

I tried this but it didnt work. Hope someone could suggest me a better way t
o do this.

Thanks,
kiran

[jdMorgan]

kiran,

Welcome to WebmasterWorld!

There are many ways to do this; You can choose the method that is easiest to use with your existing directory structure.

First, take a look at LocationMatch, DirectoryMatch, and FilesMatch in Apache core [httpd.apache.org]. All of these "Match" directives will allow you to use regular-expressions pattern matching and "alternation" to make your job easier. For example,

<LocationMatch ^Test/[cd]\.jsp$>
deny from all
allow from 128.128.2.3 129.125.4.5
</LocationMatch>

if "c" and "d" are literal location names, or

<LocationMatch ^Test/(apples¦oranges)\.jsp$>
deny from all
allow from 128.128.2.3 129.125.4.5
</LocationMatch> 

for alternate string matching. Note that the broken pipe "¦" characters above must be replaced with solid pipe characters before use; Pipe characters posted on this board are modified by the forum software.

You may also be able to use SetEnvIf and allow from <var> to combine IP addresses and requested URLs if that is a better solution for your specific case.

Jim