Apache access restriction based on file and directory name

Question

I'd like to configure httpd.conf to deny files that match either of the following:

1. A directory that starts with . or _
2. A file that starts with . or _, but does not match __\w+__\.\w+

For example:

/_private/anything       ->  deny (rule 1)
/_private/__init__.py    ->  deny (rule 1)
/_private/_private.txt   ->  deny (rule 1+2)

/public/_private.txt     ->  deny (rule 2)
/public/__private.txt    ->  deny (rule 2)
/public/__public__.txt   ->  allow

I've been working with <Directory ~ "..."> and <Files ~ "..."> as well as RewriteRule, but haven't been able to get it working just right.

Suggestions much appreciated!

Thanks!

---

Update: in response to CK:

<Directory "/var/www/html">
    Order allow,deny
    Allow from all
</Directory>

---

Update 2: Does anyone know why this directive is matching and denying a url like /_test.php, when it is clearly not a "directory" ? (I removed ALL <Files> sections except the .htaccess one.)

<Directory ~ "/[._]">
    Order allow,deny
    Deny from all
</Directory>

Answer 1

EDIT: from comment reply original post wasn't quite right - below is new Rewrite rule set:

RewriteRule /\..+ - [F]
RewriteCond %{REQUEST_URI} ^/[^_]+/__\w+__\.\w+$ [NC]
RewriteRule ^ - [S=1]
RewriteRule /_.+ - [F]

Order is important here: - forbid anything starting with period (.) first - its a "global" rule with no special case. - the special case of __\w+__.\w+ must be allowed through next S=1 skips the next rule being - forbid anything starting with underscore (_)

Answer 2

It sounds like you are looking for "DirectoryMatch and FileMatch.

From the apache httpd website. http://httpd.apache.org/docs/2.0/mod/core.html#directorymatch

< DirectoryMatch> and < /DirectoryMatch> are used to enclose a group of directives which will apply only to the named directory and sub-directories of that directory, the same as . However, it takes as an argument a regular expression.

http://httpd.apache.org/docs/2.0/mod/core.html#filesmatch

The < FilesMatch> directive limits the scope of the enclosed directives by filename, just as the < Files> directive does. However, it accepts a regular expression.

Answer 3

as with most things like this, the order of rules is crucial.

the best rule of thumb, IMO, is to put the special-case exceptions first and then the general case rule, like so:

1. allow files that match (^|/)__\w+__.\w+$
2. deny files or directories that match (^|/)[._]

if the order were reversed from the above, then the file-match exception would never even be reached, so wouldn't have any effect.

BTW, why have such silly rules? why not just put public files in one directory and private files in another? why have private files like '_private.txt' in a directory called /public? why make your public file and directory names so annoyingly similar to your private names? it would make more sense to do things in a more convenient, sensible fashion - sometimes the best answer is DDTT - "Don't Do That, Then".