Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a web server with several virtual hosts. Some of those hosts have an associated ssl site. I have a DirectoryMatch directive in my main config file which requires basic authentication to any directory with secured as part of the directory path. On sites that have an SSL site, I have a rewrite rule (located in the non ssl config for that site), that redirects to the SSL site, same uri.

The problem is the http (80) site asks for credentials first, and then the https (443) site asks for credentials again. I would like to prevent the http site from asking and thus avoid the potential for someone entering credentials and having them sent in clear text. I know I could move the DirectoryMatch down to the specific site, and just put the auth statement in the SSL config, but that would introduce the possibility of forgetting to protect critical directories when creating new sites.

Here are the pertinent declarations: httpd.conf (all sites):

<DirectoryMatch "_secured_">
    AuthType Basic
    AuthName "+ + + Restrcted Area on Server + + +"
    AuthUserFile /home/websvr/.auth/std.auth
    Require valid-user
</DirectoryMatch>

site.conf (specific to individual site)

<DirectoryMatch "_secured_">
    RewriteEngine On
    RewriteRule .*(_secured_.*) https://site.com/$1
</DirectoryMatch>

Is there a way to leave DirectoryMatch in the main config file and prevent the request for authorization from the http site?

Running Apache 2 on Ubuntu 10.04 server from the default package. I have AllowOverride set to none - I prefer to handle things in the config files instead of .htaccess.

share|improve this question

1 Answer 1

up vote 3 down vote accepted

You have to do the rewrite before the auth request.

What your other rewrite rules look like? If they're all the same as the example, you could move them into the main DirectoryMatch. Write a check to see if the site is SSL. If not, redirect.

Then the auth would happen afterwards. Something like:

<DirectoryMatch "_secured_">

    RewriteCond %{SERVER_PORT} !^443$
    RewriteRule ^.*(_secured_.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

    AuthType Basic
    AuthName "+ + + Restrcted Area on Server + + +"
    AuthUserFile /home/websvr/.auth/std.auth
    Require valid-user
</DirectoryMatch>
share|improve this answer
    
The problem is I have 5 sites, only 2 of which have SSL sites. –  Scott Mar 3 '11 at 15:39
    
Do the non-SSL sites have secure sections? If not, the DirectoryMatch won't match and you're safe. You can also change the RewriteCond to check for specific domain names; then it will only trigger on those three sites. –  Steven Mar 3 '11 at 15:47
    
The non ssl sites do have secured dirctories. I think I will check for domain names in the rewriteRule. –  Scott Mar 3 '11 at 16:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.