-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathbin-htaccess.txt
181 lines (165 loc) · 8.04 KB
/
bin-htaccess.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
# Sample bin/.htaccess file. If you require .htaccess files for your apache
# configuration, tailor this file using the below instructions.
#
############### TAILORING INSTRUCTIONS #################
#
# This file controls access to Foswiki scripts - to make Apache use it, rename this
# file to 'bin/.htaccess' and REPLACE THE FOLLOWING STRINGS WHEREVER YOU SEE
# THEM IN THIS FILE WITH PATHS SPECIFIC TO YOUR INSTALLATION.
# Most required values have corresponding items in the Path Settings section of
# configure. The following 5 strings must be updated:
#
# {DataDir}
# {WorkingDir}
# {DefaultUrlHost}
# {ScriptUrlPath}
# {Administrators}
#
# Replace {DataDir} with the full path of the Topic files store (file path, not
# URL) e.g. /usr/local/foswiki/data Do not include a trailing slash. Do not
# include the { or } in the results.
#
# Example: "Change all" {DataDir} /var/www/foswiki/data
# AuthUserFile {DataDir}/.htpasswd becomes
# AuthUserFile /var/www/foswiki/data/.htpasswd
#
# Replace {WorkingDir} with the full path of a workarea directory (file path,
# no URL) e.g. /usr/local/foswiki/working Do not include a trailing slash.
# This directory MUST NOT BE ACCESSIBLE VIA THE WEB!
#
# Replace {DefaultUrlHost} with the root of all Foswiki URLs e.g.
# http://myhost.com:123. This is only used for htdigest authentication and
# can be ignored in most installations. Do not include a trailing slash
#
# Replace {ScriptUrlPath} with the 'cgi-bin' part of URLs used
# to access the Foswiki bin directory e.g. '/foswiki/cgi-bin'
#
# Note: The combined {DefaultUrlHost}{ScriptUrlPath} will be used as the URL prefix:
# to access the foswiki scripts. For example, to access the /view script:
# http://myhost.com:123/foswiki/cgi-bin/view
# {DefaultUrlHost }{ScriptUrlPath }/view
#
# Replace {Administrators} with a space-separated list of the login
# name(s) of the person(s) allowed to run the configure script
# e.g. admin configure root superhero
# Foswiki ships an example .htdigest file containing just the "admin" user.
# Other users must be added to .htdigest manually. See the "htdigest" shell
# command provided by apache.
#
# Previous versions of Foswiki shared a common .htpasswd file between Wiki users and the
# configure admin user. It is recommented to separate these roles.
#
# When this file has been completely tailored, complete your configuration at:
# {DefaultUrlHost}{ScriptUrlPath}/configure
##################################
# We set an environment variable called anonymous_spider
# Setting a BrowserMatchNoCase to ^$ is important. It prevents Foswiki from
# including its own topics as URLs and also prevents other Foswikis from
# doing the same. This is important to prevent the most obvious
# Denial of Service attacks.
# You can expand this by adding more BrowserMatchNoCase statements to
# block evil browser agents trying the impossible task of mirroring a Foswiki
# Example:
# BrowserMatchNoCase ^SiteSucker anonymous_spider
BrowserMatchNoCase ^$ anonymous_spider
# Now set default access rights.
Order Allow,Deny
Allow from all
Deny from env=anonymous_spider
# Use CGI & Perl to handle all files in 'bin' directory, i.e. run as scripts -
# this should remove the need to rename files to end in '.pl' etc, if your web
# hosting provider permits this. Remove if using mod_perl. Look at
# http://foswiki.org/Extensions/FastCGIEngineContrib to get info about FastCGI
# support.
SetHandler cgi-script
# Password file for Foswiki users
#
# Authentication type (htpasswd file) (comment out this if you configure htpasswd / LDAP support)
AuthUserFile {DataDir}/.htpasswd
AuthName 'Enter your WikiName. (First name and last name, no space, no dots, capitalized, e.g. JohnSmith). Cancel to register if you do not have one.'
AuthType Basic
#for htdigest password suport uncomment the following
#AuthDigestDomain / {DefaultUrlHost}
#AuthDigestFile {DataDir}/.htdigest
#BrowserMatch "MSIE" AuthDigestEnableQueryStringHack=On
#AuthDigestProvider file
#AuthUserFile {DataDir}/.htpasswd
# For "Digest" authentication to work properly, this string must match
# the value of configuration variable $authRealm
#AuthName 'Enter your WikiName. (First name and last name, no space, no dots, capitalized, e.g. JohnSmith). Cancel to register if you do not have one.'
#AuthType Digest
#for LDAP password support uncomment the following (and fix up the paths)
#AuthLDAPURL ldap://yourldapserver/dc=yourldapserver,dc=com?uid?sub?(objectClass=posixAccount)
#AuthLDAPGroupAttribute memberUid
#AuthLDAPGroupAttributeIsDN off
#<Limit GET POST PUT>
# require group cn=mygroup,ou=groups,dc=yourldapserver,dc=com
#</Limit>
#AuthName ByPassword
#AuthType Basic
# File to return on access control error (e.g. wrong password)
# By convention this is the UserRegistration page, that allows users
# to register with the Foswiki. Apache requires this to be a *local* path.
# Comment this out if you setup Foswiki to completely deny access to WikiGuest
# in all webs or change the path to a static html page.
# Alternatively if your users are all known to be registered you may want
# to redirect them to the ResetPassword page. Only uncomment one of these
# lines:
ErrorDocument 401 {ScriptUrlPath}/view/System/UserRegistration
# ErrorDocument 401 {ScriptUrlPath}/view/System/ResetPassword
# Set options for excuting CGI and allow symlinks for e.g. viewauth
# This also unsets any options allowing directory indexing etc.
Options ExecCGI FollowSymLinks
# Limit access to configure to specific IP addresses and or users.
# Make sure configure is not open to the general public.
# IP addresses are entered space delimited, and can wildcarded by
# omitting octets from the end, ie, Allow from 127 192.168
# The configure script is designed for administrators only.
# The script itself and the information it reveals can be abused by
# attackers if not properly protected against public access.
# - ErrorDocument should point to apache default - redirecting to a Foswiki
# script may not be functional yet.
<FilesMatch "configure.*">
SetHandler cgi-script
ErrorDocument 401 default
ErrorDocument 404 default
Order Deny,Allow
Deny from all
# Set the next line as follows:
# - All, then both the required usesr AND the client ip address must match
# - Any, then either the required user, OR the client ip address must match
Satisfy All
Require user {Administrators}
Allow from 127.0.0.1 192.168.1.10
#
# The following optional configuration will further protect your
# configuration. "admin" is default super user identification.
# An initial htdigest file is shipped with Foswiki in the working/configure directory.
# It contains a single Userid "admin" with no password set. For the initial login
# to configure, enter user admin, with no password.
#
# When the admin password is saved in configure, this file password will be synchronized.
# Note that only this specific file in the {WorkingDir}/configure is updated, and if
# you choose to use it, it should be kept separate from the .htpasswd file
# in the data directory.
#
#AuthType Digest
#AuthDigestProvider file
#AuthUserFile {WorkingDir}/configure/.htdigest-configure
#AuthName 'Foswiki System Configuration'
#BrowserMatch "MSIE" AuthDigestEnableQueryStringHack=On
</FilesMatch>
# These are scripts that might change content. The regular expression uses ".*"
# at the end so it matches the scripts even if you had to add a .cgi or .pl
# extension. If you want to require login for any other scripts, modify the
# regular expression below as appropriate.
# NB. The resetpasswd & passwd scripts are used to reset and change passwords.
# They do their own validation of the user and therefore
# should not use "require valid-user"
# When using Apache type login the following defines the Foswiki scripts
# that makes Apache ask the browser to authenticate. It is correct that
# scripts such as view, resetpasswd & passwd are not authenticated.
# (un-comment to activate)
#<FilesMatch "(attach|edit|manage|rename|save|upload|mail|logon|rest|.*auth).*">
# require valid-user
#</FilesMatch>