You want to implement secure authorised access to folders in your sme server ibays.

The default settings in sme server allow you to secure the ibays using the Information Bay panel in server manager, by creating an ibay password which is used to allow authorised access to the ibay from the Internet, but this does not control access to individual folders.

The use of a .htaccess file and associated password file can control the security of subfolders within ibays by username and password. .htaccess is not enabled by default and requires the installation of a rpm, see separate contrib at

http://contribs.org/contribs/nightspirit/e-smith-htaccess/e-smith-htaccess-1.1-2.noarch.rpm

.htaccess files are inherently exposed to the Internet and require the correct permissions to be applied to ensure that unauthorised access is not allowed, therefore creating a security risk.

The better way to implement .htaccess in sme server is to use custom templates, which are only under the control of the administrator and cannot be tampered with by anonymous Internet users. Using this method you do NOT need to install the abovementioned rpm.

See these resources for further information about creating and using htaccess although much of that information is not applicable to the method outlined in this HOWTO.

It will assist you to determine the contents of the htaccess file that will be placed into the custom template fragment.

For further information about custom template see:

http://contribs.org/modules/phpwiki/index.php/Customizing

This how to is based on forum posts and my own investigations, thanks particularly to Charlie Brady.

This method involves creating a httpd.conf custom template fragment with the required information.

Initially you will need to determine the contents of your .htacess file to be used in the fragment. Refer to the .htaccess links above for more details but a basic .htaccess file would contain the following:

AuthUserFile /etc/passwordfilename

AuthGroupFile /dev/null

AuthName "My Site Security Group"

AuthType Basic

<Limit GET>

order deny,allow

require valid-user

</Limit>

The AuthUserFile will be the location on your sme server of the htaccess password file. You can choose whichever name and location you want, but the password file SHOULD NOT be placed in a publicly accessible are ie NOT in web site folders. Note that this file is created using the htpasswd command (see steps later).

The AuthName can be any name you want.

The rest of the details are basic and can be amended to suit your particular requirements. The contents shown will suffice for standard situations.

Next you need to create the custom template.

Log on to your server command prompt as root or with root privileges and do:

mkdir -p /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf

(assuming that it does not already exist)

Create a fragment with a name of your choice in

cd /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf

pico 50AddSecureIbayFolder

Using the htaccess file contents example from above, and assuming we want to secure an ibay subfolder called

/home/e-smith/files/ibays/ibayname/html/foldername/subfoldername

edit the fragment file to contain the following

<Directory /home/e-smith/files/ibays/ibayname/html/foldername/subfoldername>

AuthUserFile /etc/passwordfilename

AuthGroupFile /dev/null

AuthName "My Site Security Group"

AuthType Basic

<Limit GET>

order deny,allow

require valid-user

</Limit>

</Directory>

then do

/sbin/e-smith/expand-template /etc/httpd/conf/httpd.conf

/etc/e-smith/events/actions/restart-httpd-graceful

Now you need to create the password file

do

cd /etc

(or cd /location_you_want_password_file_in)

then do

htpasswd -c passwordfilename user1

then you will be asked to enter the password

and then asked to confirm the password

The user name and password will be encoded into the password file

To add additional users and passwords do

htpasswd passwordfilename user2

then you will be asked to enter the password

and then asked to confirm the password

htpasswd passwordfilename user3

then you will be asked to enter the password

and then asked to confirm the password

and so on….

You should only use the -c switch when entering the first user.

If you use the -c switch when entering additional user details you will overwrite the password file completely and only have the one user entry there.

Now you can test the web site access.

Browse to your newly secured location ie

You will be asked for a user Id and password.

Enter any combination that is in your password file to gain access.