Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Basically we have a Wiki that has some sensitive information stored in it - not the best I know but my predecessor set it up. I want to be able to request password access from any one who is not on the local network subnet. Those on the local subnet should be able to proceed without entering a password.

The following .htaccess does not seem to work any more as it is letting non-local access without requiring the password:

AuthName "Our Wiki"
AuthType Basic
AuthUserFile /path/to/passwd/file
AuthGroupFile /dev/null
Require valid-user
Allow from 192.168
Satisfy Any
order deny,allow

And I cannot work out why. The WikkaWiki it is supposed to be protecting was recently upgraded, which clobbered the .htaccess file so I restored the above from memory/googling. Maybe I am missing an important directive?

The full .htaccess is as follows:

AuthName "Our Wiki"
AuthType Basic
AuthUserFile /path/to/passwd/file
AuthGroupFile /dev/null
Require valid-user
Allow from 192.168
Satisfy Any

SetEnvIfNoCase Referer ".*(adultsite|picturesplace|learnthebiz|pi-o).*" BadReferrer

order deny,allow
deny from env=BadReferrer

<IfModule mod_rewrite.c>
        # turn on rewrite engine
        RewriteEngine on
        RewriteBase /
        # if request is a directory, make sure it ends with a slash
        RewriteCond %{REQUEST_FILENAME} -d
        RewriteRule ^(.*/[^/]+)$ $1/

        # if not rewritten before, AND requested file is wikka.php
        # turn request into a query for a default (unspecified) page
        RewriteCond %{QUERY_STRING} !wakka=
        RewriteCond %{REQUEST_FILENAME} wikka.php
        RewriteRule ^(.*)$ wikka.php?wakka= [QSA,L]

        # if not rewritten before, AND requested file is a page name
        # turn request into a query for that page name for wikka.php
        RewriteCond %{QUERY_STRING} !wakka=
        RewriteRule ^(.*)$ wikka.php?wakka=$1 [QSA,L]
</IfModule>
share|improve this question

4 Answers 4

up vote 3 down vote accepted

you are wrong in this line

order deny,allow

should be

order allow,deny

Look at the table in mod_authz_host documentation

share|improve this answer
    
That doesn't appear to fix the issue. It just causes everyone (including those in the subnet) to be queried for a login to see the wiki. –  Treffynnon Nov 2 '09 at 13:31
    
Ok I have since gone back and had a play with it again. You are correct that does seem to fix the issue. –  Treffynnon Nov 9 '09 at 18:05

Why do you consider keeping sensitive information in Wiki bad? If your HTTP connections run over TLS, there should be no harm.

To your problem. We're using MediaWiki and I just tryed editing LocalSettings.php:

$wgGroupPermissions['*']['edit'] = false;
$wgGroupPermissions['*']['read'] = false;

if ($_SERVER['REMOTE_ADDR']=='192.168.1.1') {
  $wgGroupPermissions['*']['read'] = true;
  $wgGroupPermissions['*']['edit'] = true;
}

...and it works. What this piece of code does is that it blocks reading/editing, if the user is not logged on. But it the client IP equals the one above, it can freely edit and read Wiki.

Maybe you can hack PHP of WikkaWiki in similar manner.

share|improve this answer
    
WikkaWiki doesn't appear to work that way but you can hack the php. Please see my answer below. –  Treffynnon Nov 2 '09 at 13:40

To restrict the wiki to only users that have been given login credentials you can edit wikka.php on line 405 (right above the $wikka->Run) by adding the following lines.

if('UserSettings' != $page and
   !is_array($wakka->GetUser())) {
    header('Location: /UserSettings');
    exit;
}

Then in your wikka config you will also want to stop new registrations being allowed to go through. Otherwise someone could simply register and see your important information. On line 51 change the following from:

'allow_user_registration' => '1',

to:

'allow_user_registration' => '0',

Now everyone will be challenged for a password to access any wiki page except the login page ('UserSettings'). This is not a bad thing because it is much faster to browse the wiki when logged in anyway as it doesn't need to do hostname look ups!

Not quite what I was hoping for but it does work none the less.

Thanks for all your suggestions everyone.

share|improve this answer

Try this:

Order deny,allow
Deny from all
AuthName "Our Wiki"
AuthType Basic
AuthUserFile /path/to/passwd/file
AuthGroupFile /dev/null
Require valid-user
Allow from 192.168
Satisfy Any

You also should consider to remove/comment out this block:

SetEnvIfNoCase Referer ".*($LIST_OF_ADULT_WORDS).*" BadReferrer

order deny,allow
deny from env=BadReferrer

since directives on top should force any external requester to authenticate first.

share|improve this answer
    
I have tried your suggestion but it is still letting outside traffic in without request a password. Thanks. –  Treffynnon Sep 30 '09 at 12:29
    
Are you sure apache is seeing the 'outside' traffic as outside? If you have proxy or something in the path outside requests might appear to not be outside. Check your access log to double check. –  Zoredache Oct 3 '09 at 1:34
    
Yeah it is identified as outside traffic. –  Treffynnon Nov 2 '09 at 13:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.