2 - Raspberry PI Community Projects

• MultiViews enables content negotiation; this can be used by the server to return a web
page matching the preferred language as configured in the browser.
BACK TO BASICS
.htaccess file
The .htaccess file contains Apache configuration directives enforced each
time a request concerns an element of the directory where it is stored. The
scope of these directives also recurses to all the subdirectories within.
Most of the directives that can occur in a Directory block are also legal in a
.htaccess file.
The AllowOverride directive lists all the options that can be enabled or disabled by way of a
.htaccess file. A common use of this option is to restrict ExecCGI, so that the administrator
chooses which users are allowed to run programs under the web server's identity (the wwwdata
user).
11.2.3.1. Requiring Authentication
In some circumstances, access to part of a website needs to be restricted, so only legitimate
users who provide a username and a password are granted access to the contents.
Require valid-user
AuthName "Private directory"
AuthType Basic
AuthUserFile /etc/apache2/authfiles/htpasswd-private
Example 11.19
.htaccess file requiring authentication
SECURITY
No security
The authentication system used in the above example (Basic) has minimal
security as the password is sent in clear text (it is only encoded as base64,
which is a simple encoding rather than an encryption method). It should also
be noted that the documents “protected” by this mechanism also go over the
network in the clear. If security is important, the whole HTTP connection
should be encrypted with SSL.
The /etc/apache2/authfiles/htpasswd-private file contains a list of users and passwords;
it is commonly manipulated with the htpasswd command. For example, the following command
is used to add a user or change their password:
# htpasswd /etc/apache2/authfiles/htpasswd-private user
New password:
Re-type new password:
Adding password for user user
272 The Debian Administrator's Handbook