Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I hope I came to the right sub for this question.

Basically here is the scenario:

You have folder name Testfolder which is hosted on Apache. Test folder has files that only certain users on the domain can read see them.

Example file1.htm = Can only be viewed by all users file2.htm = Can only be viewed by Domain Admin, Guy2, Guy3

So when you acess them via example \WebServer\Site Name\testfolder\file1 & file2.htm they are viewed correctly by their respective users.

However when you go to testwebsite.com/testfolder , all files are viewed by anyone and ignore the folder permissions. Any ideas on why that is happening? If anyone could help with this issue it would be MUCH appreciated. Thanks for reading.

Also the way permissions are set are through NTFS - see below Right click file > properties > security > add users that are allowed to view the file.

Note: This is on Windows 2008R2

Question is there a way to authorize users on a domain to view files & folders though?

Virtual Host

DocumentRoot "D:\wordpress"
ServerName "testserver1"
ServerAlias "testserver1.com"
<Directory "D:\wordpress\Test Files">
    AllowOverride None
    Options FollowSymLinks Includes MultiViews 
</Directory>

share|improve this question
    
What user is the IIS using to access the files? –  zwarag Feb 6 '13 at 15:14
    
Not using IIS, using Apache but its run under the Administrator of the webserver. –  Scarlett J. Feb 6 '13 at 15:25
    
Sry my bad. So you mean, you apache access the files with admin user? I'm not talking about what user is executing apache. –  zwarag Feb 6 '13 at 15:31
    
Misunderstood your question sorry, I'm trying to access the files as a regular domain user. So when I type for example testserver1.com/file2.htm (Which I shouldn't be able to see because of file permissions) I can still view it. –  Scarlett J. Feb 6 '13 at 15:34
add comment

1 Answer 1

When you access a file throught a Webbrowser, you dont use the user you used to login into your domain.
Instead, apache uses a localuser(at the webserver) to access this files.

There are now 2 ways how to keep files from unwanted access.

  • You can chance the user apache uses to access the files. (this is a bit more work but for sure the smarter way to keep single files from beeing read from everybody in Windows). Windows apache uder different user
  • You use .htaccess files to have an extra authentification when accessing folders or files. (this has nothing to do with your domain authentification) .htaccess password
share|improve this answer
    
Question is there a way to authorize users on a domain to view files & folders though? –  Scarlett J. Feb 6 '13 at 16:04
    
indeed there is a way, have a look at held-im-ruhestand.de/software/… if this answerd your question, pls don't forget to accept this answer by checking the accept symbol on the left! –  zwarag Feb 7 '13 at 8:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.