IBM WebSphere V5.0 Security - CGISecurity

A .htaccess file placed in one directory applies to all its subdirectories. In such acase it is equivalent to a section in the httpd.conf file. If there is morethan one access files in a directory tree, the directives set in a file forsubdirectory take precedence over the directives in the parent directory.There are a number of directives that can be overridden. When dealing withsecurity, we are interested in the AuthConfig category of directives that will allowthe use of authorization directives such as AuthUserFile, AuthGroupFile,AuthDBMGroupFile and others. To override this category, change the directive inhttpd.conf file to:Example 4-3 Security configuration in httpd.confAllowOverride AuthConfigOptions NoneFor more information on how to use .htaccess see the Apache tutorial at:http://apache-server.com/tutorials/ATusing-htaccess.htmlThe drawback of using .htaccess files is a negative impact on the performance ofthe Web server. As mentioned before, when the use of .htaccess files is enabled,for any resource requested from one directory, Web server also checks all parentdirectories for .htaccess files and tries to merge the configuration in order todecide whether the user is entitled to read the resource or not.The other problem with the .htaccess files is the system management. It isdifficult to maintain, especially in a centralized security infrastructure.4.1.3 Other Web server security aspectsThis book is not dedicated fully to discussing Web server security, and a samplescenario only has been chosen to show how to secure Web server using LDAPuser registry. This LDAP server can be shared with the application server in orderto manage a user’s authorization to specific Web application resources. This isdiscussed in the following chapters.However, when writing about Web server security, it not necessary to mentionother possible means that can be used to secure either the Web server daemonprocess or user access to Web server resources. Next is a short list of what youcan take into account for securing the Web server when designing the system torun secure Web applications:44 IBM WebSphere V5.0 Security Handbook