4

I'd like to restrict access to a certain directory in my webroot to all users that belong to a specific group.

I know that I can create a .htpasswd file that specifies a user, or even several users, that should be accepted for HTTP Basic/Digest Authentication, but is it possible to have Apache accept any username/password from the local Linux machine's users?

To go a step further, is it possible (through .htpasswd or other means that anyone is aware of) to allow any valid user within a specific group?

Improve this question
  • It might be helpful to others if you provide some more details on what you're trying to accomplish. – dan♦ Jul 17 '13 at 23:15
  • 1
    @dan: I've revised my question. – Charlie Schliesser Jul 17 '13 at 23:59
1

There were a few similar questions on serverfault.com that searching didn't uncover:

Basically, PAM and mod_auth_pam or mod_auth_external are potential ways to achieve this.

Improve this answer
  • It warrants repeating that authentication over HTTP using server login and password information is a serious security risk. The question didn't indicate if this was intended for over the Internet or intranet, which is why I asked for more details. For others reading this, it's important to note the security risks for exposing your server, even if there are options...of which the first two appear to be no longer supported, and the later appears to use basic authentication over HTTP. – dan♦ Jul 18 '13 at 6:08
  • For more about the security risks of doing this, as acknowledged by the author of pwauth, referenced on the Google project page as working with mod-auth-external, see: Security Risks – dan♦ Jul 18 '13 at 6:09
  • 1
    Thanks Dan, that link to the security risks is extremely helpful. SSL and other items on the "Mitigating Risk" list would help, but I still may abandon this idea after reading that the mod(s) do not offer a method for slowing down password attempts (i.e. throw thousands of HTTP requests simultaneously to brute force). – Charlie Schliesser Jul 18 '13 at 13:39
  • No problem. I usually try to provide an answer for whatever is asked, but in this case I felt it was more important not to disseminate potentially harmful information to others. It's a good question to learn from though, which is what this site is all about :-) – dan♦ Jul 18 '13 at 20:18
0

is it possible to have Apache accept any username/password from the local Linux machine's users?

For security reasons, this would be a very bad idea. Over the Internet, web traffic can be spied on by hackers, who would then have access to user login and password information for your server. Also, passwords on modern Linux systems are stored with encryption, which is meant to be only readable by the superuser. See this for more about that.

If you are by chance interested in providing secured access to Internet users, but unsecured access to users on your local network, then you could consider this. I would make sure however that this implemented over HTTPS using an SSL, instead of HTTP. And depending on how sensitive your data is, it might be wise to use separate servers for each set of users if possible.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.