2

Basically we have a Wiki that has some sensitive information stored in it - not the best I know but my predecessor set it up. I want to be able to request password access from any one who is not on the local network subnet. Those on the local subnet should be able to proceed without entering a password.

The following .htaccess does not seem to work any more as it is letting non-local access without requiring the password:

AuthName "Our Wiki"
AuthType Basic
AuthUserFile /path/to/passwd/file
AuthGroupFile /dev/null
Require valid-user
Allow from 192.168
Satisfy Any
order deny,allow

And I cannot work out why. The WikkaWiki it is supposed to be protecting was recently upgraded, which clobbered the .htaccess file so I restored the above from memory/googling. Maybe I am missing an important directive?

The full .htaccess is as follows:

AuthName "Our Wiki"
AuthType Basic
AuthUserFile /path/to/passwd/file
AuthGroupFile /dev/null
Require valid-user
Allow from 192.168
Satisfy Any

SetEnvIfNoCase Referer ".*(adultsite|picturesplace|learnthebiz|pi-o).*" BadReferrer

order deny,allow
deny from env=BadReferrer

<IfModule mod_rewrite.c>
        # turn on rewrite engine
        RewriteEngine on
        RewriteBase /
        # if request is a directory, make sure it ends with a slash
        RewriteCond %{REQUEST_FILENAME} -d
        RewriteRule ^(.*/[^/]+)$ $1/

        # if not rewritten before, AND requested file is wikka.php
        # turn request into a query for a default (unspecified) page
        RewriteCond %{QUERY_STRING} !wakka=
        RewriteCond %{REQUEST_FILENAME} wikka.php
        RewriteRule ^(.*)$ wikka.php?wakka= [QSA,L]

        # if not rewritten before, AND requested file is a page name
        # turn request into a query for that page name for wikka.php
        RewriteCond %{QUERY_STRING} !wakka=
        RewriteRule ^(.*)$ wikka.php?wakka=$1 [QSA,L]
</IfModule>

4 Answers 4

3

you are wrong in this line

order deny,allow

should be

order allow,deny

Look at the table in mod_authz_host documentation

2
  • That doesn't appear to fix the issue. It just causes everyone (including those in the subnet) to be queried for a login to see the wiki.
    – Treffynnon
    Nov 2, 2009 at 13:31
  • Ok I have since gone back and had a play with it again. You are correct that does seem to fix the issue.
    – Treffynnon
    Nov 9, 2009 at 18:05
1

Why do you consider keeping sensitive information in Wiki bad? If your HTTP connections run over TLS, there should be no harm.

To your problem. We're using MediaWiki and I just tryed editing LocalSettings.php:

$wgGroupPermissions['*']['edit'] = false;
$wgGroupPermissions['*']['read'] = false;

if ($_SERVER['REMOTE_ADDR']=='192.168.1.1') {
  $wgGroupPermissions['*']['read'] = true;
  $wgGroupPermissions['*']['edit'] = true;
}

...and it works. What this piece of code does is that it blocks reading/editing, if the user is not logged on. But it the client IP equals the one above, it can freely edit and read Wiki.

Maybe you can hack PHP of WikkaWiki in similar manner.

1
  • WikkaWiki doesn't appear to work that way but you can hack the php. Please see my answer below.
    – Treffynnon
    Nov 2, 2009 at 13:40
0

To restrict the wiki to only users that have been given login credentials you can edit wikka.php on line 405 (right above the $wikka->Run) by adding the following lines.

if('UserSettings' != $page and
   !is_array($wakka->GetUser())) {
    header('Location: /UserSettings');
    exit;
}

Then in your wikka config you will also want to stop new registrations being allowed to go through. Otherwise someone could simply register and see your important information. On line 51 change the following from:

'allow_user_registration' => '1',

to:

'allow_user_registration' => '0',

Now everyone will be challenged for a password to access any wiki page except the login page ('UserSettings'). This is not a bad thing because it is much faster to browse the wiki when logged in anyway as it doesn't need to do hostname look ups!

Not quite what I was hoping for but it does work none the less.

Thanks for all your suggestions everyone.

0

Try this:

Order deny,allow
Deny from all
AuthName "Our Wiki"
AuthType Basic
AuthUserFile /path/to/passwd/file
AuthGroupFile /dev/null
Require valid-user
Allow from 192.168
Satisfy Any

You also should consider to remove/comment out this block:

SetEnvIfNoCase Referer ".*($LIST_OF_ADULT_WORDS).*" BadReferrer

order deny,allow
deny from env=BadReferrer

since directives on top should force any external requester to authenticate first.

3
  • I have tried your suggestion but it is still letting outside traffic in without request a password. Thanks.
    – Treffynnon
    Sep 30, 2009 at 12:29
  • Are you sure apache is seeing the 'outside' traffic as outside? If you have proxy or something in the path outside requests might appear to not be outside. Check your access log to double check.
    – Zoredache
    Oct 3, 2009 at 1:34
  • Yeah it is identified as outside traffic.
    – Treffynnon
    Nov 2, 2009 at 13:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .