AuthDigestAlgorithm Directive

Description: Selects the algorithm used to calculate the challenge and response hases in digest authentication

Syntax: @@ -64,13 +65,14 @@ response hases in digest authentication

+ MD5-sess is not correctly implemented yet. + +

AuthDigestDomain Directive

Description: URIs that are in the same protection space for digest authentication

Syntax: - AuthDigestDomain URI [URI] ...

Context: + AuthDigestDomain URI [URI] ...

Context: directory, .htaccess

Override: AuthConfig

Status: Experimental

Module: @@ -98,14 +100,14 @@ authentication

Syntax:

AuthDigestFile Directive

Description:	Location of the text file containing the list of users and encoded passwords for digest authentication
Syntax: -	`AuthDigestFile file-path`
Context: +	`AuthDigestFile file-path`
Context:	directory, .htaccess
Override:	AuthConfig
Status:	Experimental
Module:	mod_auth_digest

The AuthDigestFile directive sets the name of a textual file containing the list of users and encoded - passwords for digest authentication. File-path is the + passwords for digest authentication. File-path is the absolute path to the user file.

The digest file uses a special format. Files in this format @@ -114,21 +116,21 @@ of users and encoded passwords for digest authentication

AuthDigestGroupFile Directive

Description:	Name of the text file containing the list of groups for digest authentication
Syntax: -	`AuthDigestGroupFile file-path`
Context: +	`AuthDigestGroupFile file-path`
Context:	directory, .htaccess
Override:	AuthConfig
Status:	Experimental
Module:	mod_auth_digest

The AuthDigestGroupFile directive sets the name of a textual file containing the list of groups and their - members (user names). File-path is the absolute path to + members (user names). File-path is the absolute path to the group file.

Each line of the group file contains a groupname followed by a colon, followed by the member usernames separated by spaces. Example:

mygroup: bob joe anne

Note that searching large text files is very inefficient.

@@ -145,11 +147,13 @@ server

Syntax: server config

Status: Experimental

Module: mod_auth_digest

Not implemented yet. -

+ Not implemented yet. +

AuthDigestNonceFormat Directive

passwords for authentication - - - - - + +

Description: Determines how the nonce is generated

Syntax: - AuthDigestNonceFormat format

Context: + AuthDigestNonceFormat format

Context: directory, .htaccess

Override: AuthConfig

Status: Experimental

Module: @@ -158,7 +162,7 @@ server

Syntax:

AuthDigestNonceLifetime Directive

Description: How long the server nonce is valid

Syntax: - AuthDigestNonceLifetime seconds

Default: + AuthDigestNonceLifetime seconds

Default: AuthDigestNonceLifetime 300

Context: directory, .htaccess

Override: AuthConfig

Status: @@ -167,10 +171,10 @@ server

Syntax:

The AuthDigestNonceLifetime directive controls how long the server nonce is valid. When the client contacts the server using an expired nonce the server will send - back a 401 with stale=true. If seconds is + back a 401 with stale=true. If seconds is greater than 0 then it specifies the amount of time for which the nonce is valid; this should probably never be set to less than 10 - seconds. If seconds is less than 0 then the nonce never + seconds. If seconds is less than 0 then the nonce never expires.

AuthDigestQop Directive

Description: @@ -183,16 +187,17 @@ authentication
Syntax:	Experimental
Module:	mod_auth_digest

The AuthDigestQop directive determines - the quality-of-protection to use. auth will only do - authentication (username/password); auth-int is + the quality-of-protection to use. auth will only do + authentication (username/password); auth-int is authentication plus integrity checking (an MD5 hash of the entity - is also computed and checked); none will cause the module + is also computed and checked); none will cause the module to use the old RFC-2069 digest algorithm (which does not include - integrity checking). Both auth and auth-int may + integrity checking). Both auth and auth-int may be specified, in which the case the browser will choose which of - these to use. none should only be used if the browser for + these to use. none should only be used if the browser for some reason does not like the challenge it receives otherwise.

auth-int is not implemented - yet.

+ auth-int is not implemented yet. +

\ No newline at end of file diff --git a/docs/manual/mod/mod_auth_digest.xml b/docs/manual/mod/mod_auth_digest.xml index ec2b63d993..dfe15f496d 100644 --- a/docs/manual/mod/mod_auth_digest.xml +++ b/docs/manual/mod/mod_auth_digest.xml @@ -2,6 +2,7 @@ + mod_auth_digest User authentication using MD5 Digest Authentication. @@ -20,7 +21,7 @@ Require Satisfy -

Using Digest Authentication +

Using Digest Authentication

Using MD5 Digest authentication is very simple. Simply set up authentication normally, using "AuthType Digest" and @@ -29,18 +30,20 @@ "AuthDigestGroupFile". Then add a "AuthDigestDomain" directive containing at least the root URI(s) for this protection space. Example:

- - <Location /private/>
- AuthType Digest
- AuthName "private area"
- AuthDigestDomain /private/ http://mirror.my.dom/private2/
- AuthDigestFile /web/auth/.digest_pw
- Require valid-user
- </Location> - - -Note - + + + <Location /private/>
+ + AuthType Digest
+ AuthName "private area"
+ AuthDigestDomain /private/ http://mirror.my.dom/private2/
+ AuthDigestFile /web/auth/.digest_pw
+ Require valid-user
+ + </Location> + + + Note

Digest authentication provides a more secure password system than Basic authentication, but only works with supporting browsers. As of July 2002, the major browsers that support digest @@ -51,15 +54,14 @@ href="http://www.mozilla.org">Mozilla. Since digest authentication is not as widely implemented as basic authentication, you should use it only in controlled settings.

- - +

AuthDigestFile Location of the text file containing the list of users and encoded passwords for digest authentication -AuthDigestFile file-path +AuthDigestFile file-path directory.htaccess AuthConfig @@ -67,7 +69,7 @@ of users and encoded passwords for digest authentication

The AuthDigestFile directive sets the name of a textual file containing the list of users and encoded - passwords for digest authentication. File-path is the + passwords for digest authentication. File-path is the absolute path to the user file.

The digest file uses a special format. Files in this format @@ -81,7 +83,7 @@ of users and encoded passwords for digest authentication AuthDigestGroupFile Name of the text file containing the list of groups for digest authentication -AuthDigestGroupFile file-path +AuthDigestGroupFile file-path directory.htaccess AuthConfig @@ -89,14 +91,14 @@ for digest authentication

The AuthDigestGroupFile directive sets the name of a textual file containing the list of groups and their - members (user names). File-path is the absolute path to + members (user names). File-path is the absolute path to the group file.

Each line of the group file contains a groupname followed by a colon, followed by the member usernames separated by spaces. Example:

-mygroup: bob joe anne + mygroup: bob joe anne

Note that searching large text files is very inefficient.

@@ -120,25 +122,26 @@ authentication

The AuthDigestQop directive determines - the quality-of-protection to use. auth will only do - authentication (username/password); auth-int is + the quality-of-protection to use. auth will only do + authentication (username/password); auth-int is authentication plus integrity checking (an MD5 hash of the entity - is also computed and checked); none will cause the module + is also computed and checked); none will cause the module to use the old RFC-2069 digest algorithm (which does not include - integrity checking). Both auth and auth-int may + integrity checking). Both auth and auth-int may be specified, in which the case the browser will choose which of - these to use. none should only be used if the browser for + these to use. none should only be used if the browser for some reason does not like the challenge it receives otherwise.

auth-int is not implemented - yet.

+ + auth-int is not implemented yet. + AuthDigestNonceLifetime How long the server nonce is valid -AuthDigestNonceLifetime seconds +AuthDigestNonceLifetime seconds AuthDigestNonceLifetime 300 directory.htaccess @@ -148,11 +151,11 @@ authentication

The AuthDigestNonceLifetime directive controls how long the server nonce is valid. When the client contacts the server using an expired nonce the server will send - back a 401 with stale=true. If seconds is + back a 401 with stale=true. If seconds is greater than 0 then it specifies the amount of time for which the nonce is valid; this should probably never be set to less than 10 - seconds. If seconds is less than 0 then the nonce never - expires. -

+ --> @@ -226,12 +231,13 @@ response hases in digest authentication selects the algorithm used to calculate the challenge and response hashes.

MD5-sess is not correctly implemented - yet. -

+ --> @@ -239,7 +245,7 @@ response hases in digest authentication AuthDigestDomain URIs that are in the same protection space for digest authentication -AuthDigestDomain URI [URI] ... +AuthDigestDomain URI [URI] ... directory.htaccess AuthConfig @@ -269,6 +275,3 @@ authentication - - - diff --git a/docs/manual/mod/mod_info.html.en b/docs/manual/mod/mod_info.html.en index 8a62c2d806..fd239a2fe3 100644 --- a/docs/manual/mod/mod_info.html.en +++ b/docs/manual/mod/mod_info.html.en @@ -69,10 +69,10 @@ information displayed by the server-info handler

- AddModuleInfo mod_authn_file.c 'See <a \ + AddModuleInfo mod_deflate.c 'See <a \ - href="http://www.apache.org/docs-2.0/mod/mod_authn_file.html">\ - http://www.apache.org/docs-2.0/mod/mod_authn_file.html</a>' + href="http://www.apache.org/docs-2.0/mod/mod_deflate.html">\ + http://www.apache.org/docs-2.0/mod/mod_deflate.html</a>'

\ No newline at end of file diff --git a/docs/manual/mod/mod_info.xml b/docs/manual/mod/mod_info.xml index be76579240..bb3fce9391 100644 --- a/docs/manual/mod/mod_info.xml +++ b/docs/manual/mod/mod_info.xml @@ -73,10 +73,10 @@ information displayed by the server-info handler the module module-name. Example:

- AddModuleInfo mod_authn_file.c 'See <a \
+ AddModuleInfo mod_deflate.c 'See <a \
- href="http://www.apache.org/docs-2.0/mod/mod_authn_file.html">\
- http://www.apache.org/docs-2.0/mod/mod_authn_file.html</a>' + href="http://www.apache.org/docs-2.0/mod/mod_deflate.html">\
+ http://www.apache.org/docs-2.0/mod/mod_deflate.html</a>' diff --git a/docs/manual/mod/mod_speling.html.en b/docs/manual/mod/mod_speling.html.en index fdfd444fcb..01b0920e41 100644 --- a/docs/manual/mod/mod_speling.html.en +++ b/docs/manual/mod/mod_speling.html.en @@ -54,7 +54,6 @@ module for Apache 1.1, but was limited to miscapitalizations. As of Apache 1.3, it is part of the Apache distribution. Prior to Apache 1.3.2, the CheckSpelling directive was only available in the "server" and "virtual host" contexts.

This directive enables or disables the spelling module. When enabled, keep in mind that

@@ -77,4 +76,12 @@ of Apache 1.3, it is part of the Apache distribution. Prior to Apache get incorrectly treated as the negotiated file "/stats.html". + + +

mod_speling should not be enabled in DAV + enabled directories, because it will try to "spell fix" newly created + resource names against existing filenames, e.g., when trying to upload + a new document doc43.html it might redirect to an existing + document doc34.html, which is not what was intended. +

\ No newline at end of file diff --git a/docs/manual/mod/mod_speling.xml b/docs/manual/mod/mod_speling.xml index 4aa2a9523e..c9b418eab9 100755 --- a/docs/manual/mod/mod_speling.xml +++ b/docs/manual/mod/mod_speling.xml @@ -65,7 +65,6 @@ of Apache 1.3, it is part of the Apache distribution. Prior to Apache "server" and "virtual host" contexts. -

This directive enables or disables the spelling module. When enabled, keep in mind that

@@ -89,6 +88,7 @@ of Apache 1.3, it is part of the Apache distribution. Prior to Apache "/stats.html". +

mod_speling should not be enabled in DAV enabled directories, because it will try to "spell fix" newly created resource names against existing filenames, e.g., when trying to upload @@ -96,8 +96,6 @@ of Apache 1.3, it is part of the Apache distribution. Prior to Apache document doc34.html, which is not what was intended.

- - diff --git a/docs/manual/mod/obs_mod_access.html.en b/docs/manual/mod/obs_mod_access.html.en deleted file mode 100644 index 58fe845d6a..0000000000 --- a/docs/manual/mod/obs_mod_access.html.en +++ /dev/null @@ -1,270 +0,0 @@ - - -mod_access - Apache HTTP Server

Apache > HTTP Server > Documentation > Version 2.0 > Modules

Obsolete Apache Module mod_access

Description: -	Provides access control based on client hostname, IP -address, or other characteristics of the client request.
Status: -	Obsolete (replaced by `mod_authz_host` since 2.0.44)
Module Identifier: -	access_module
Source File: -	mod_access.c
Compatibility: -	Available only in versions up to 2.0.43

Summary

This module is obsolete!

Note, that this module has been marked as obsolete. A bunch - of modules was introduced in Apache version 2.0.44 that - support the new Authentication/Authorization provider mechnism.

- -

If you want to use host based access control, you have to invoke the - mod_authz_host module now.

- -

This document is kept only for historical reasons and no - longer maintained.

- -

The directives provided by mod_access are used in <Directory>, <Files>, and <Location> sections as well as - .htaccess - files to control access to particular parts of the server. Access - can be controlled based on the client hostname, IP address, or - other characteristics of the client request, as captured in environment variables. The Allow and Deny directives are used to - specify which clients are or are not allowed access to the server, - while the Order - directive sets the default access state, and configures how the - Allow and Deny directives interact with each - other.

- -

Both host-based access restrictions and password-based - authentication may be implemented simultaneously. In that case, - the Satisfy directive is used - to determine how the two sets of restrictions interact.

- -

In general, access restriction directives apply to all - access methods (GET, PUT, - POST, etc). This is the desired behavior in most - cases. However, it is possible to restrict some methods, while - leaving other methods unrestricted, by enclosing the directives - in a <Limit> section.

Directives

Allow
Deny
Order

Allow Directive

Description: -	Controls which hosts can access an area of the -server
Syntax: -	`Allow from - all\|host\|env=env-variable - [host\|env=env-variable] ...`
Context: -	directory, .htaccess
Override: -	Limit
Status: -	Obsolete
Module: -	mod_access

- -

The Allow directive affects which hosts can - access an area of the server. Access can be controlled by - hostname, IP Address, IP Address range, or by other - characteristics of the client request captured in environment - variables.

- -

The first argument to this directive is always - from. The subsequent arguments can take three - different forms. If Allow from all is specified, then - all hosts are allowed access, subject to the configuration of the - Deny and Order directives as discussed - below. To allow only particular hosts or groups of hosts to access - the server, the host can be specified in any of the - following formats:

- -

A (partial) domain-name: Example: Allow from apache.org
- Hosts whose names match, or end in, this string are allowed - access. Only complete components are matched, so the above - example will match foo.apache.org but it will - not match fooapache.org. This configuration will - cause the server to perform a reverse DNS lookup on the - client IP address, regardless of the setting of the HostnameLookups - directive.
A full IP address: Example: Allow from 10.1.2.3
- An IP address of a host allowed access
A partial IP address: Example: Allow from 10.1
- The first 1 to 3 bytes of an IP address, for subnet - restriction.
A network/netmask pair: Example: Allow from - 10.1.0.0/255.255.0.0
- A network a.b.c.d, and a netmask w.x.y.z. For more - fine-grained subnet restriction.
A network/nnn CIDR specification: Example: Allow from 10.1.0.0/16
- Similar to the previous case, except the netmask consists of - nnn high-order 1 bits.

- -

Note that the last three examples above match exactly the - same set of hosts.

- -

IPv6 addresses and IPv6 subnets can be specified as shown - below:

- -

- Allow from fe80::a00:20ff:fea7:ccea - Allow from fe80::a00:20ff:fea7:ccea/10 -

- -

The third format of the arguments to the - Allow directive allows access to the server - to be controlled based on the existence of an environment variable. When Allow from - env=env-variable is specified, then the request is - allowed access if the environment variable env-variable - exists. The server provides the ability to set environment - variables in a flexible way based on characteristics of the client - request using the directives provided by - mod_setenvif. Therefore, this directive can be - used to allow access based on such factors as the clients - User-Agent (browser type), Referer, or - other HTTP request header fields.

- -

Example:

- SetEnvIf User-Agent ^KnockKnock/2.0 let_me_in - <Directory /docroot> - - Order Deny,Allow - Deny from all - Allow from env=let_me_in - - </Directory> -

- -

In this case, browsers with a user-agent string beginning - with KnockKnock/2.0 will be allowed access, and all - others will be denied.

Deny Directive

Description: -	Controls which hosts are denied access to the -server
Syntax: -	`Deny from - all\|host\|env=env-variable - [host\|env=env-variable] ...`
Context: -	directory, .htaccess
Override: -	Limit
Status: -	Obsolete
Module: -	mod_access

This directive allows access to the server to be restricted - based on hostname, IP address, or environment variables. The - arguments for the Deny directive are - identical to the arguments for the Allow directive.

Order Directive

Description: -	Controls the default access state and the order in which -Allow and Deny are -evaluated.
Syntax: -	`Order ordering`
Default: -	`Order Deny,Allow`
Context: -	directory, .htaccess
Override: -	Limit
Status: -	Obsolete
Module: -	mod_access

- -

The Order directive controls the default - access state and the order in which Allow and Deny directives are evaluated. - Ordering is one of

- -

Deny,Allow: The Deny directives - are evaluated before the Allow directives. Access is - allowed by default. Any client which does not match a - Deny directive or does - match an Allow - directive will be allowed access to the server.
Allow,Deny: The Allow - directives are evaluated before the Deny directives. Access is denied - by default. Any client which does not match an Allow directive or does match a - Deny directive will be - denied access to the server.
Mutual-failure: Only those hosts which appear on the Allow list and do not appear on - the Deny list are - granted access. This ordering has the same effect as Order - Allow,Deny and is deprecated in favor of that - configuration.

- -

Keywords may only be separated by a comma; no whitespace is - allowed between them. Note that in all cases every Allow and Deny statement is evaluated.

- -

In the following example, all hosts in the apache.org domain - are allowed access; all other hosts are denied access.

- -

- Order Deny,Allow - Deny from all - Allow from apache.org -

- -

In the next example, all hosts in the apache.org domain are - allowed access, except for the hosts which are in the - foo.apache.org subdomain, who are denied access. All hosts not - in the apache.org domain are denied access because the default - state is to deny access to the server.

- -

- Order Allow,Deny - Allow from apache.org - Deny from foo.apache.org -

- -

On the other hand, if the Order in the last - example is changed to Deny,Allow, all hosts will - be allowed access. This happens because, regardless of the - actual ordering of the directives in the configuration file, - the Allow from apache.org will be evaluated last - and will override the Deny from foo.apache.org. - All hosts not in the apache.org domain will also - be allowed access because the default state will change to - allow.

- -

The presence of an Order directive can affect - access to a part of the server even in the absence of accompanying - Allow and Deny directives because of its effect - on the default access state. For example,

- -

- <Directory /www> - - Order Allow,Deny - - </Directory> -

- -

will deny all access to the /www directory - because the default access state will be set to - deny.

- -

The Order directive controls the order of access - directive processing only within each phase of the server's - configuration processing. This implies, for example, that an - Allow or Deny directive occurring in a - <Location> section will - always be evaluated after an Allow or Deny directive occurring in a - <Directory> section or - .htaccess file, regardless of the setting of the - Order directive. For details on the merging - of configuration sections, see the documentation on How Directory, Location and Files sections - work.

\ No newline at end of file diff --git a/docs/manual/mod/obs_mod_access.xml b/docs/manual/mod/obs_mod_access.xml deleted file mode 100644 index 765f4c7a32..0000000000 --- a/docs/manual/mod/obs_mod_access.xml +++ /dev/null @@ -1,325 +0,0 @@ - - - - - -mod_access - -Provides access control based on client hostname, IP -address, or other characteristics of the client request. - -Obsolete -replaced by mod_authz_host since 2.0.44 -mod_access.c -access_module -Available only in versions up to 2.0.43 - -

- This module is obsolete! -

Note, that this module has been marked as obsolete. A bunch - of modules was introduced in Apache version 2.0.44 that - support the new Authentication/Authorization provider mechnism.

- -

If you want to use host based access control, you have to invoke the - mod_authz_host module now.

- -

This document is kept only for historical reasons and no - longer maintained.

- - -

The directives provided by mod_access are used in Directory, Files, and Location sections as well as - .htaccess - files to control access to particular parts of the server. Access - can be controlled based on the client hostname, IP address, or - other characteristics of the client request, as captured in environment variables. The Allow and Deny directives are used to - specify which clients are or are not allowed access to the server, - while the Order - directive sets the default access state, and configures how the - Allow and Deny directives interact with each - other.

- -

Both host-based access restrictions and password-based - authentication may be implemented simultaneously. In that case, - the Satisfy directive is used - to determine how the two sets of restrictions interact.

- -

- -Satisfy -Require - - -Allow - -Controls which hosts can access an area of the -server - Allow from - all|host|env=env-variable - [host|env=env-variable] ... -directory.htaccess - -Limit - - - -

The Allow directive affects which hosts can - access an area of the server. Access can be controlled by - hostname, IP Address, IP Address range, or by other - characteristics of the client request captured in environment - variables.

- -

The first argument to this directive is always - from. The subsequent arguments can take three - different forms. If Allow from all is specified, then - all hosts are allowed access, subject to the configuration of the - Deny and Order directives as discussed - below. To allow only particular hosts or groups of hosts to access - the server, the host can be specified in any of the - following formats:

- -

A (partial) domain-name: Example: Allow from apache.org
- Hosts whose names match, or end in, this string are allowed - access. Only complete components are matched, so the above - example will match foo.apache.org but it will - not match fooapache.org. This configuration will - cause the server to perform a reverse DNS lookup on the - client IP address, regardless of the setting of the HostnameLookups - directive.
A full IP address: Example: Allow from 10.1.2.3
- An IP address of a host allowed access
A partial IP address: Example: Allow from 10.1
- The first 1 to 3 bytes of an IP address, for subnet - restriction.
A network/netmask pair: Example: Allow from - 10.1.0.0/255.255.0.0
- A network a.b.c.d, and a netmask w.x.y.z. For more - fine-grained subnet restriction.
A network/nnn CIDR specification: Example: Allow from 10.1.0.0/16
- Similar to the previous case, except the netmask consists of - nnn high-order 1 bits.

- -

Note that the last three examples above match exactly the - same set of hosts.

- -

IPv6 addresses and IPv6 subnets can be specified as shown - below:

- - - Allow from fe80::a00:20ff:fea7:ccea
- Allow from fe80::a00:20ff:fea7:ccea/10 - - -

The third format of the arguments to the - Allow directive allows access to the server - to be controlled based on the existence of an environment variable. When Allow from - env=env-variable is specified, then the request is - allowed access if the environment variable env-variable - exists. The server provides the ability to set environment - variables in a flexible way based on characteristics of the client - request using the directives provided by - mod_setenvif. Therefore, this directive can be - used to allow access based on such factors as the clients - User-Agent (browser type), Referer, or - other HTTP request header fields.

- - Example: - SetEnvIf User-Agent ^KnockKnock/2.0 let_me_in
- <Directory /docroot>
- - Order Deny,Allow
- Deny from all
- Allow from env=let_me_in
- - </Directory> - - -

In this case, browsers with a user-agent string beginning - with KnockKnock/2.0 will be allowed access, and all - others will be denied.

- - - - - - -Deny - -Controls which hosts are denied access to the -server - - Deny from - all|host|env=env-variable - [host|env=env-variable] ... -directory.htaccess - -Limit - - -

This directive allows access to the server to be restricted - based on hostname, IP address, or environment variables. The - arguments for the Deny directive are - identical to the arguments for the Allow directive.

- - - - - - -Order - -Controls the default access state and the order in which -Allow and Deny are -evaluated. - - Order ordering -Order Deny,Allow -directory.htaccess - -Limit - - - -

The Order directive controls the default - access state and the order in which Allow and Deny directives are evaluated. - Ordering is one of

- -

Deny,Allow: The Deny directives - are evaluated before the Allow directives. Access is - allowed by default. Any client which does not match a - Deny directive or does - match an Allow - directive will be allowed access to the server.
Allow,Deny: The Allow - directives are evaluated before the Deny directives. Access is denied - by default. Any client which does not match an Allow directive or does match a - Deny directive will be - denied access to the server.
Mutual-failure: Only those hosts which appear on the Allow list and do not appear on - the Deny list are - granted access. This ordering has the same effect as Order - Allow,Deny and is deprecated in favor of that - configuration.

- -

Keywords may only be separated by a comma; no whitespace is - allowed between them. Note that in all cases every Allow and Deny statement is evaluated.

- -

In the following example, all hosts in the apache.org domain - are allowed access; all other hosts are denied access.

- - - Order Deny,Allow
- Deny from all
- Allow from apache.org - - -

- - - Order Allow,Deny
- Allow from apache.org
- Deny from foo.apache.org - - -

On the other hand, if the Order in the last - example is changed to Deny,Allow, all hosts will - be allowed access. This happens because, regardless of the - actual ordering of the directives in the configuration file, - the Allow from apache.org will be evaluated last - and will override the Deny from foo.apache.org. - All hosts not in the apache.org domain will also - be allowed access because the default state will change to - allow.

- -

The presence of an Order directive can affect - access to a part of the server even in the absence of accompanying - Allow and Deny directives because of its effect - on the default access state. For example,

- - - <Directory /www>
- - Order Allow,Deny
- - </Directory> - - -

will deny all access to the /www directory - because the default access state will be set to - deny.

- -

The Order directive controls the order of access - directive processing only within each phase of the server's - configuration processing. This implies, for example, that an - Allow or Deny directive occurring in a - Location section will - always be evaluated after an Allow or Deny directive occurring in a - Directory section or - .htaccess file, regardless of the setting of the - Order directive. For details on the merging - of configuration sections, see the documentation on How Directory, Location and Files sections - work.

- - - - - diff --git a/docs/manual/mod/obs_mod_auth.html.en b/docs/manual/mod/obs_mod_auth.html.en deleted file mode 100644 index 5ddf6036b3..0000000000 --- a/docs/manual/mod/obs_mod_auth.html.en +++ /dev/null @@ -1,163 +0,0 @@ - - -mod_auth - Apache HTTP Server

Apache > HTTP Server > Documentation > Version 2.0 > Modules

Obsolete Apache Module mod_auth

Description: -	User authentication using text files
Status: -	Obsolete (obsolete since 2.0.44)
Module Identifier: -	auth_module
Source File: -	mod_auth.c
Compatibility: -	Available only in versions up to 2.0.43

Summary

This module is obsolete!

Note, that this module has been marked as obsolete. A bunch - of modules was introduced in Apache version 2.0.44 that - support the new Authentication/Authorization provider mechnism.

- -

In order to get the ability of HTTP Basic Authentication, you have - to use the mod_auth_basic module that implements - the HTTP part. mod_authn_file provides for user - authentication based on plain text files. File based group - authorization is now done by the mod_authz_groupfile - module.

- -

This document is kept only for historical reasons and no - longer maintained.

- -

This module allows the use of HTTP Basic Authentication to - restrict access by looking up users in plain text password and - group files. Similar functionality and greater scalability is - provided by mod_auth_dbm. HTTP Digest - Authentication is provided by - mod_auth_digest.

- -

AuthAuthoritative Directive

Description: -	Sets whether authorization and authentication are -passed to lower level modules
Syntax: -	`AuthAuthoritative on\|off`
Default: -	`AuthAuthoritative on`
Context: -	directory, .htaccess
Override: -	AuthConfig
Status: -	Obsolete
Module: -	mod_auth

This information has not been updated for Apache 2.0, which - uses a different system for module ordering.

- -

Setting the AuthAuthoritative directive - explicitly to 'off' allows for both - authentication and authorization to be passed on to lower level - modules (as defined in the Configuration and - modules.c files) if there is no - userID or rule matching the supplied - userID. If there is a userID and/or rule specified; the usual - password and access checks will be applied and a failure will give - an Authorization Required reply.

- -

So if a userID appears in the database of more than one module; - or if a valid Require - directive applies to more than one module; then the first module - will verify the credentials; and no access is passed on; - regardless of the AuthAuthoritative setting.

- -

A common use for this is in conjunction with one of the - database modules; such as mod_auth_dbm, - mod_auth_msql, and mod_auth_anon. - These modules supply the bulk of the user credential checking; but - a few (administrator) related accesses fall through to a lower - level with a well protected AuthUserFile.

- -

By default; control is not passed on; and an unknown userID or - rule will result in an Authorization Required reply. Not setting - it thus keeps the system secure; and forces an NCSA compliant - behaviour.

- -

Security

Do consider the implications of - allowing a user to allow fall-through in his .htaccess file; and - verify that this is really what you want; Generally it is easier - to just secure a single .htpasswd file, than it is to secure a - database such as mSQL. Make sure that the AuthUserFile and the AuthGroupFile are stored outside the - document tree of the web-server; do not put them in the - directory that they protect. Otherwise, clients will be able to - download the AuthUserFile - and the AuthGroupFile. -

AuthGroupFile Directive

Description: -	Sets the name of a text file containing the list -of user groups for authentication
Syntax: -	`AuthGroupFile file-path`
Context: -	directory, .htaccess
Override: -	AuthConfig
Status: -	Obsolete
Module: -	mod_auth

The AuthGroupFile directive sets the - name of a textual file containing the list of user groups for user - authentication. File-path is the path to the group - file. If it is not absolute (i.e., if it doesn't begin - with a slash), it is treated as relative to the ServerRoot.

- -

Each line of the group file contains a groupname followed by a - colon, followed by the member usernames separated by spaces. - Example:

- -

mygroup: bob joe anne

- -

Note that searching large text files is very - inefficient; AuthDBMGroupFile should be used - instead.

- -

Security

Make sure that the AuthGroupFile is - stored outside the document tree of the web-server; do not - put it in the directory that it protects. Otherwise, clients will - be able to download the AuthGroupFile.

AuthUserFile Directive

Description: -	Sets the name of a text file containing the list of users and -passwords for authentication
Syntax: -	`AuthUserFile file-path`
Context: -	directory, .htaccess
Override: -	AuthConfig
Status: -	Obsolete
Module: -	mod_auth

The AuthUserFile directive sets the name - of a textual file containing the list of users and passwords for - user authentication. File-path is the path to the user - file. If it is not absolute (i.e., if it doesn't begin - with a slash), it is treated as relative to the ServerRoot.

- -

Each line of the user file contains a username followed by - a colon, followed by the crypt() encrypted - password. The behavior of multiple occurrences of the same user is - undefined.

- -

The utility htpasswd - which is installed as part of the binary distribution, or which - can be found in src/support, is used to maintain - this password file. See the man page for more - details. In short:

- -

Create a password file 'Filename' with 'username' as the - initial ID. It will prompt for the password:

- -

htpasswd -c Filename username

- -

Add or modify 'username2' in the password file 'Filename':

- -

htpasswd Filename username2

- -

Note that searching large text files is very - inefficient; AuthDBMUserFile should be used - instead.

- -

Security

Make sure that the AuthUserFile is - stored outside the document tree of the web-server; do not - put it in the directory that it protects. Otherwise, clients will - be able to download the AuthUserFile.

\ No newline at end of file diff --git a/docs/manual/mod/obs_mod_auth.xml b/docs/manual/mod/obs_mod_auth.xml deleted file mode 100644 index 9085ccf7d6..0000000000 --- a/docs/manual/mod/obs_mod_auth.xml +++ /dev/null @@ -1,190 +0,0 @@ - - - - - -mod_auth -User authentication using text files -Obsolete -obsolete since 2.0.44 -mod_auth.c -auth_module -Available only in versions up to 2.0.43 - -

- This module is obsolete! -

Note, that this module has been marked as obsolete. A bunch - of modules was introduced in Apache version 2.0.44 that - support the new Authentication/Authorization provider mechnism.

- -

In order to get the ability of HTTP Basic Authentication, you have - to use the mod_auth_basic module that implements - the HTTP part. mod_authn_file provides for user - authentication based on plain text files. File based group - authorization is now done by the mod_authz_groupfile - module.

- -

This document is kept only for historical reasons and no - longer maintained.

- - -

This module allows the use of HTTP Basic Authentication to - restrict access by looking up users in plain text password and - group files. Similar functionality and greater scalability is - provided by mod_auth_dbm. HTTP Digest - Authentication is provided by - mod_auth_digest.

- -

-Require -Satisfy -AuthName -AuthType - - -AuthGroupFile -Sets the name of a text file containing the list -of user groups for authentication -AuthGroupFile file-path -directory.htaccess - -AuthConfig - - -

The AuthGroupFile directive sets the - name of a textual file containing the list of user groups for user - authentication. File-path is the path to the group - file. If it is not absolute (i.e., if it doesn't begin - with a slash), it is treated as relative to the ServerRoot.

- -

Each line of the group file contains a groupname followed by a - colon, followed by the member usernames separated by spaces. - Example:

- - mygroup: bob joe anne - -

Note that searching large text files is very - inefficient; AuthDBMGroupFile should be used - instead.

- - Security -

Make sure that the AuthGroupFile is - stored outside the document tree of the web-server; do not - put it in the directory that it protects. Otherwise, clients will - be able to download the AuthGroupFile.

- - - - - -AuthUserFile -Sets the name of a text file containing the list of users and -passwords for authentication -AuthUserFile file-path -directory.htaccess - -AuthConfig - - -

The AuthUserFile directive sets the name - of a textual file containing the list of users and passwords for - user authentication. File-path is the path to the user - file. If it is not absolute (i.e., if it doesn't begin - with a slash), it is treated as relative to the ServerRoot.

- -

Each line of the user file contains a username followed by - a colon, followed by the crypt() encrypted - password. The behavior of multiple occurrences of the same user is - undefined.

- -

Create a password file 'Filename' with 'username' as the - initial ID. It will prompt for the password:

- - htpasswd -c Filename username - -

Add or modify 'username2' in the password file 'Filename':

- - htpasswd Filename username2 - -

Note that searching large text files is very - inefficient; AuthDBMUserFile should be used - instead.

- - Security -

Make sure that the AuthUserFile is - stored outside the document tree of the web-server; do not - put it in the directory that it protects. Otherwise, clients will - be able to download the AuthUserFile.

- - - - - -AuthAuthoritative -Sets whether authorization and authentication are -passed to lower level modules -AuthAuthoritative on|off -AuthAuthoritative on -directory.htaccess - -AuthConfig - - - This information has not been updated for Apache 2.0, which - uses a different system for module ordering. - -

Setting the AuthAuthoritative directive - explicitly to 'off' allows for both - authentication and authorization to be passed on to lower level - modules (as defined in the Configuration and - modules.c files) if there is no - userID or rule matching the supplied - userID. If there is a userID and/or rule specified; the usual - password and access checks will be applied and a failure will give - an Authorization Required reply.

- -

So if a userID appears in the database of more than one module; - or if a valid Require - directive applies to more than one module; then the first module - will verify the credentials; and no access is passed on; - regardless of the AuthAuthoritative setting.

- -

A common use for this is in conjunction with one of the - database modules; such as mod_auth_dbm, - mod_auth_msql, and mod_auth_anon. - These modules supply the bulk of the user credential checking; but - a few (administrator) related accesses fall through to a lower - level with a well protected AuthUserFile.

- -

- - Security Do consider the implications of - allowing a user to allow fall-through in his .htaccess file; and - verify that this is really what you want; Generally it is easier - to just secure a single .htpasswd file, than it is to secure a - database such as mSQL. Make sure that the AuthUserFile and the AuthGroupFile are stored outside the - document tree of the web-server; do not put them in the - directory that they protect. Otherwise, clients will be able to - download the AuthUserFile - and the AuthGroupFile. - - - - - diff --git a/docs/manual/mod/obs_mod_auth_anon.html.en b/docs/manual/mod/obs_mod_auth_anon.html.en deleted file mode 100644 index 6dcb4add9f..0000000000 --- a/docs/manual/mod/obs_mod_auth_anon.html.en +++ /dev/null @@ -1,190 +0,0 @@ - - -mod_auth_anon - Apache HTTP Server

Apache > HTTP Server > Documentation > Version 2.0 > Modules

Obsolete Apache Module mod_auth_anon

Description: -	Allows "anonymous" user access to authenticated - areas
Status: -	Obsolete (replaced by `mod_authn_anon` since 2.0.44)
Module Identifier: -	auth_anon_module
Source File: -	mod_auth_anon.c
Compatibility: -	Available only in versions up to 2.0.43

Summary

This module is obsolete!

Note, that this module has been marked as obsolete. A bunch - of modules was introduced in Apache version 2.0.44 that - support the new Authentication/Authorization provider mechnism.

- -

In order to get the same functionality, you have to invoke the - mod_authn_anon module now.

- - - - -

This document is kept only for historical reasons and no - longer maintained.

- -

This module does access control in a manner similar to - anonymous-ftp sites; i.e. have a 'magic' user id - 'anonymous' and the email address as a password. These email - addresses can be logged.

- -

Combined with other (database) access control methods, this - allows for effective user tracking and customization according - to a user profile while still keeping the site open for - 'unregistered' users. One advantage of using Auth-based user - tracking is that, unlike magic-cookies and funny URL - pre/postfixes, it is completely browser independent and it - allows users to share URLs.

Directives

Anonymous
Anonymous_Authoritative
Anonymous_LogEmail
Anonymous_MustGiveEmail
Anonymous_NoUserID
Anonymous_VerifyEmail

Topics

Example

Example

- -

The example below (when combined with the Auth directives of a - htpasswd-file based (or GDM, mSQL etc.) base access - control system allows users in as 'guests' with the following - properties:

- -

It insists that the user enters a userId. - (Anonymous_NoUserId)
It insists that the user enters a password. - (Anonymous_MustGiveEmail)
The password entered must be a valid email address, ie. - contain at least one '@' and a '.'. - (Anonymous_VerifyEmail)
The userID must be one of anonymous guest www test - welcome and comparison is not case - sensitive.
And the Email addresses entered in the passwd field are - logged to the error log file - (Anonymous_LogEmail)

- -

Excerpt of httpd.conf:

- -

- Anonymous_NoUserId off - Anonymous_MustGiveEmail on - Anonymous_VerifyEmail on - Anonymous_LogEmail on - Anonymous anonymous guest www test welcome - - AuthName "Use 'anonymous' & Email address for guest entry" - AuthType basic - - # An - AuthUserFile/AuthDBUserFile/AuthDBMUserFile - # directive must be specified, or use - # Anonymous_Authoritative for public access. - # In the .htaccess for the public directory, add: - <Files *> - - Order Deny,Allow - Allow from all - - Require valid-user - - </Files> -

Anonymous Directive

Description: -	Specifies userIDs that areallowed access without -password verification
Syntax: -	`Anonymous user [user] ...`
Context: -	directory, .htaccess
Override: -	AuthConfig
Status: -	Obsolete
Module: -	mod_auth_anon

A list of one or more 'magic' userIDs which are allowed - access without password verification. The userIDs are space - separated. It is possible to use the ' and " quotes to allow a - space in a userID as well as the \ escape character.

- -

Please note that the comparison is - case-IN-sensitive.
- I strongly suggest that the magic username - 'anonymous' is always one of the allowed - userIDs.

- -

Example:

- Anonymous anonymous "Not Registered" 'I don\'t know' -

- -

This would allow the user to enter without password - verification by using the userId's 'anonymous', - 'AnonyMous','Not Registered' and 'I Don't Know'.

Anonymous_Authoritative Directive

Description: -	Configures if authorization will fall-through -to other methods
Syntax: -	`Anonymous_Authoritative on\|off`
Default: -	`Anonymous_Authoritative off`
Context: -	directory, .htaccess
Override: -	AuthConfig
Status: -	Obsolete
Module: -	mod_auth_anon

When set 'on', there is no fall-through to other authorization - methods. So if a userID does not match the values specified in the - Anonymous directive, - access is denied.

- -

Be sure you know what you are doing when you decide to - switch it on. And remember that it is the linking order of the - modules (in the Configuration / Make file) which details the - order in which the Authorization modules are queried.

Anonymous_LogEmail Directive

Description: -	Sets whether the password entered will be logged in the -error log
Syntax: -	`Anonymous_LogEmail on\|off`
Default: -	`Anonymous_LogEmail on`
Context: -	directory, .htaccess
Override: -	AuthConfig
Status: -	Obsolete
Module: -	mod_auth_anon

When set on, the default, the 'password' entered - (which hopefully contains a sensible email address) is logged in - the error log.

Anonymous_MustGiveEmail Directive

Description: -	Specifies whether blank passwords are allowed
Syntax: -	`Anonymous_MustGiveEmail on\|off`
Default: -	`Anonymous_MustGiveEmail on`
Context: -	directory, .htaccess
Override: -	AuthConfig
Status: -	Obsolete
Module: -	mod_auth_anon

Specifies whether the user must specify an email address as - the password. This prohibits blank passwords.

Anonymous_NoUserID Directive

Description: -	Sets whether the userID field may be empty
Syntax: -	`Anonymous_NoUserID on\|off`
Default: -	`Anonymous_NoUserID off`
Context: -	directory, .htaccess
Override: -	AuthConfig
Status: -	Obsolete
Module: -	mod_auth_anon

When set on, users can leave the userID (and - perhaps the password field) empty. This can be very convenient for - MS-Explorer users who can just hit return or click directly on the - OK button; which seems a natural reaction.

Anonymous_VerifyEmail Directive

Description: -	Sets whether to check the password field for a correctly -formatted email address
Syntax: -	`Anonymous_VerifyEmail on\|off`
Default: -	`Anonymous_VerifyEmail off`
Context: -	directory, .htaccess
Override: -	AuthConfig
Status: -	Obsolete
Module: -	mod_auth_anon

When set on the 'password' entered is checked for - at least one '@' and a '.' to encourage users to enter valid email - addresses (see the above Auth_LogEmail).

\ No newline at end of file diff --git a/docs/manual/mod/obs_mod_auth_anon.xml b/docs/manual/mod/obs_mod_auth_anon.xml deleted file mode 100644 index 8689f9628a..0000000000 --- a/docs/manual/mod/obs_mod_auth_anon.xml +++ /dev/null @@ -1,226 +0,0 @@ - - - - - -mod_auth_anon -Allows "anonymous" user access to authenticated - areas -Obsolete -replaced by mod_authn_anon since 2.0.44 -mod_auth_anon.c -auth_anon_module -Available only in versions up to 2.0.43 - -

- This module is obsolete! -

Note, that this module has been marked as obsolete. A bunch - of modules was introduced in Apache version 2.0.44 that - support the new Authentication/Authorization provider mechnism.

- -

In order to get the same functionality, you have to invoke the - mod_authn_anon module now.

- - - - -

This document is kept only for historical reasons and no - longer maintained.

- - -

This module does access control in a manner similar to - anonymous-ftp sites; i.e. have a 'magic' user id - 'anonymous' and the email address as a password. These email - addresses can be logged.

- -

Example - -

The example below (when combined with the Auth directives of a - htpasswd-file based (or GDM, mSQL etc.) base access - control system allows users in as 'guests' with the following - properties:

- -

It insists that the user enters a userId. - (Anonymous_NoUserId)
It insists that the user enters a password. - (Anonymous_MustGiveEmail)
The password entered must be a valid email address, ie. - contain at least one '@' and a '.'. - (Anonymous_VerifyEmail)
The userID must be one of anonymous guest www test - welcome and comparison is not case - sensitive.
And the Email addresses entered in the passwd field are - logged to the error log file - (Anonymous_LogEmail)

- -

Excerpt of httpd.conf:

- - - Anonymous_NoUserId off
- Anonymous_MustGiveEmail on
- Anonymous_VerifyEmail on
- Anonymous_LogEmail on
- Anonymous anonymous guest www test welcome
-
- AuthName "Use 'anonymous' & Email address for guest entry"
- AuthType basic
-
- # An - AuthUserFile/AuthDBUserFile/AuthDBMUserFile
- # directive must be specified, or use
- # Anonymous_Authoritative for public access.
- # In the .htaccess for the public directory, add:
- <Files *>
- - Order Deny,Allow
- Allow from all
-
- Require valid-user
- - </Files> - -

- - -Anonymous -Specifies userIDs that areallowed access without -password verification -Anonymous user [user] ... -directory.htaccess - -AuthConfig - - -

- -

Please note that the comparison is - case-IN-sensitive.
- I strongly suggest that the magic username - 'anonymous' is always one of the allowed - userIDs.

- - Example: - Anonymous anonymous "Not Registered" 'I don\'t know' - - -

This would allow the user to enter without password - verification by using the userId's 'anonymous', - 'AnonyMous','Not Registered' and 'I Don't Know'.

- - - - -Anonymous_Authoritative -Configures if authorization will fall-through -to other methods -Anonymous_Authoritative on|off -Anonymous_Authoritative off -directory.htaccess - -AuthConfig - - -

When set 'on', there is no fall-through to other authorization - methods. So if a userID does not match the values specified in the - Anonymous directive, - access is denied.

- -

- - - - -Anonymous_LogEmail -Sets whether the password entered will be logged in the -error log -Anonymous_LogEmail on|off -Anonymous_LogEmail on -directory.htaccess - -AuthConfig - - -

When set on, the default, the 'password' entered - (which hopefully contains a sensible email address) is logged in - the error log.

- - - - -Anonymous_MustGiveEmail -Specifies whether blank passwords are allowed -Anonymous_MustGiveEmail on|off -Anonymous_MustGiveEmail on -directory.htaccess - -AuthConfig - - -

Specifies whether the user must specify an email address as - the password. This prohibits blank passwords.

- - - - -Anonymous_NoUserID -Sets whether the userID field may be empty -Anonymous_NoUserID on|off -Anonymous_NoUserID off -directory.htaccess - -AuthConfig - - -

- - - - -Anonymous_VerifyEmail -Sets whether to check the password field for a correctly -formatted email address -Anonymous_VerifyEmail on|off -Anonymous_VerifyEmail off -directory.htaccess - -AuthConfig - - -

When set on the 'password' entered is checked for - at least one '@' and a '.' to encourage users to enter valid email - addresses (see the above Auth_LogEmail).

- - - - \ No newline at end of file diff --git a/docs/manual/mod/obs_mod_auth_dbm.html.en b/docs/manual/mod/obs_mod_auth_dbm.html.en deleted file mode 100644 index 0fe3d2d45d..0000000000 --- a/docs/manual/mod/obs_mod_auth_dbm.html.en +++ /dev/null @@ -1,189 +0,0 @@ - - -mod_auth_dbm - Apache HTTP Server

Apache > HTTP Server > Documentation > Version 2.0 > Modules

Obsolete Apache Module mod_auth_dbm

Description: -	Provides for user authentication using DBM - files
Status: -	Obsolete (obsolete since 2.0.44)
Module Identifier: -	auth_dbm_module
Source File: -	mod_auth_dbm.c
Compatibility: -	Available only in versions up to 2.0.43

Summary

This module is obsolete!

Note, that this module has been marked as obsolete. A bunch - of modules was introduced in Apache version 2.0.44 that - support the new Authentication/Authorization provider mechnism.

- -

In order to get the ability of HTTP Basic Authentication, you have - to use the mod_auth_basic module that implements - the HTTP part. mod_authn_dbm provides for user - authentication based on DBM-files. DBM-File based group - authorization is now done by the mod_authz_dbm - module.

- -

This document is kept only for historical reasons and no - longer maintained.

- -

This module provides for HTTP Basic Authentication, where - the usernames and passwords are stored in DBM type database - files. It is an alternative to the plain text password files - provided by mod_auth.

Directives

AuthDBMAuthoritative
AuthDBMGroupFile
AuthDBMType
AuthDBMUserFile

AuthDBMAuthoritative Directive

Description: -	Sets whether authentication and authorization will be -passwed on to lower level modules
Syntax: -	`AuthDBMAuthoritative on\|off`
Default: -	`AuthDBMAuthoritative on`
Context: -	directory, .htaccess
Override: -	AuthConfig
Status: -	Obsolete
Module: -	mod_auth_dbm

- -

This information has not been updated to take into account the -new module ordering techniques in Apache 2.0

- -

Setting the AuthDBMAuthoritative - directive explicitly to 'off' allows for both - authentication and authorization to be passed on to lower level - modules (as defined in the Configuration and - modules.c file if there is no userID - or rule matching the supplied userID. If there is - a userID and/or rule specified; the usual password and access - checks will be applied and a failure will give an Authorization - Required reply.

- -

A common use for this is in conjunction with one of the - basic auth modules; such as mod_auth. Whereas this - DBM module supplies the bulk of the user credential checking; a - few (administrator) related accesses fall through to a lower - level with a well protected .htpasswd file.

- -

By default, control is not passed on and an unknown userID - or rule will result in an Authorization Required reply. Not - setting it thus keeps the system secure and forces an NCSA - compliant behaviour.

- -

Security: Do consider the implications of allowing a user to - allow fall-through in his .htaccess file; and verify that this - is really what you want; Generally it is easier to just secure - a single .htpasswd file, than it is to secure a database which - might have more access interfaces.

AuthDBMGroupFile Directive

Description: -	Sets the name of the database file containing the list -of user groups for authentication
Syntax: -	`AuthDBMGroupFile file-path`
Context: -	directory, .htaccess
Override: -	AuthConfig
Status: -	Obsolete
Module: -	mod_auth_dbm

The AuthDBMGroupFile directive sets the - name of a DBM file containing the list of user groups for user - authentication. File-path is the absolute path to the - group file.

- -

The group file is keyed on the username. The value for a - user is a comma-separated list of the groups to which the users - belongs. There must be no whitespace within the value, and it - must never contain any colons.

- -

Security: make sure that the - AuthDBMGroupFile is stored outside the - document tree of the web-server; do not put it in the - directory that it protects. Otherwise, clients will be able to - download the AuthDBMGroupFile unless - otherwise protected.

- -

Combining Group and Password DBM files: In some cases it is - easier to manage a single database which contains both the - password and group details for each user. This simplifies any - support programs that need to be written: they now only have to - deal with writing to and locking a single DBM file. This can be - accomplished by first setting the group and password files to - point to the same DBM:

- -

- AuthDBMGroupFile /www/userbase - AuthDBMUserFile /www/userbase -

- -

The key for the single DBM is the username. The value consists - of

- -

- Unix Crypt-ed Password:List of Groups[:(ignored)] -

- -

The password section contains the Unix crypt() - password as before. This is followed by a colon and the comma - separated list of groups. Other data may optionally be left in the - DBM file after another colon; it is ignored by the authentication - module. This is what www.telescope.org uses for its combined - password and group database.

AuthDBMType Directive

Description: -	Sets the type of database file that is used to -store passwords
Syntax: -	`AuthDBMType default\|SDBM\|GDBM\|NDBM\|DB`
Default: -	`AuthDBMType default`
Context: -	directory, .htaccess
Override: -	AuthConfig
Status: -	Obsolete
Module: -	mod_auth_dbm
Compatibility: -	Available in version 2.0.30 and later.

- -

Sets the type of database file that is used to store the passwords. -The default database type is determined at compile time. The -availability of other types of database files also depends on -compile-time settings.

- -

It is crucial that whatever program you use to create your password -files is configured to use the same type of database.

AuthDBMUserFile Directive

Description: -	Sets thename of a database file containing the list of users and -passwords for authentication
Syntax: -	`AuthDBMUserFile file-path`
Context: -	directory, .htaccess
Override: -	AuthConfig
Status: -	Obsolete
Module: -	mod_auth_dbm

The AuthDBMUserFile directive sets the - name of a DBM file containing the list of users and passwords for - user authentication. File-path is the absolute path to - the user file.

- -

The user file is keyed on the username. The value for a user is - the crypt() encrypted password, optionally followed - by a colon and arbitrary data. The colon and the data following it - will be ignored by the server.

- -

Security: make sure that the - AuthDBMUserFile is stored outside the - document tree of the web-server; do not put it in the - directory that it protects. Otherwise, clients will be able to - download the AuthDBMUserFile.

- -

Important compatibility note: The implementation of - "dbmopen" in the apache modules reads the string length of the - hashed values from the DBM data structures, rather than relying - upon the string being NULL-appended. Some applications, such as - the Netscape web server, rely upon the string being - NULL-appended, so if you are having trouble using DBM files - interchangeably between applications this may be a part of the - problem.

- -

A perl script called - dbmmanage is included with - Apache. This program can be used to create and update DBM - format password files for use with this module.

\ No newline at end of file diff --git a/docs/manual/mod/obs_mod_auth_dbm.xml b/docs/manual/mod/obs_mod_auth_dbm.xml deleted file mode 100644 index 6f0703bd6a..0000000000 --- a/docs/manual/mod/obs_mod_auth_dbm.xml +++ /dev/null @@ -1,214 +0,0 @@ - - - - - -mod_auth_dbm -Provides for user authentication using DBM - files -Obsolete -obsolete since 2.0.44 -mod_auth_dbm.c -auth_dbm_module -Available only in versions up to 2.0.43 - -

- This module is obsolete! -

Note, that this module has been marked as obsolete. A bunch - of modules was introduced in Apache version 2.0.44 that - support the new Authentication/Authorization provider mechnism.

- -

In order to get the ability of HTTP Basic Authentication, you have - to use the mod_auth_basic module that implements - the HTTP part. mod_authn_dbm provides for user - authentication based on DBM-files. DBM-File based group - authorization is now done by the mod_authz_dbm - module.

- -

This document is kept only for historical reasons and no - longer maintained.

- - -

- -AuthName -AuthType -Require -Satisfy - - -AuthDBMGroupFile -Sets the name of the database file containing the list -of user groups for authentication -AuthDBMGroupFile file-path -directory.htaccess - -AuthConfig - - -

The AuthDBMGroupFile directive sets the - name of a DBM file containing the list of user groups for user - authentication. File-path is the absolute path to the - group file.

- -

Security: make sure that the - AuthDBMGroupFile is stored outside the - document tree of the web-server; do not put it in the - directory that it protects. Otherwise, clients will be able to - download the AuthDBMGroupFile unless - otherwise protected.

- -

- - - AuthDBMGroupFile /www/userbase
- AuthDBMUserFile /www/userbase - - -

The key for the single DBM is the username. The value consists - of

- - - Unix Crypt-ed Password:List of Groups[:(ignored)] - - -

- - - - -AuthDBMUserFile -Sets thename of a database file containing the list of users and -passwords for authentication -AuthDBMUserFile file-path -directory.htaccess - -AuthConfig - - -

The AuthDBMUserFile directive sets the - name of a DBM file containing the list of users and passwords for - user authentication. File-path is the absolute path to - the user file.

- -

Security: make sure that the - AuthDBMUserFile is stored outside the - document tree of the web-server; do not put it in the - directory that it protects. Otherwise, clients will be able to - download the AuthDBMUserFile.

- -

A perl script called - dbmmanage is included with - Apache. This program can be used to create and update DBM - format password files for use with this module.

- - - - -AuthDBMType -Sets the type of database file that is used to -store passwords -AuthDBMType default|SDBM|GDBM|NDBM|DB -AuthDBMType default -directory.htaccess - -AuthConfig -Available in version 2.0.30 and later. - - - -

- -

It is crucial that whatever program you use to create your password -files is configured to use the same type of database.

- - - - -AuthDBMAuthoritative -Sets whether authentication and authorization will be -passwed on to lower level modules -AuthDBMAuthoritative on|off -AuthDBMAuthoritative on -directory.htaccess - -AuthConfig - - - -This information has not been updated to take into account the -new module ordering techniques in Apache 2.0 - -

Setting the AuthDBMAuthoritative - directive explicitly to 'off' allows for both - authentication and authorization to be passed on to lower level - modules (as defined in the Configuration and - modules.c file if there is no userID - or rule matching the supplied userID. If there is - a userID and/or rule specified; the usual password and access - checks will be applied and a failure will give an Authorization - Required reply.

- -

A common use for this is in conjunction with one of the - basic auth modules; such as mod_auth. Whereas this - DBM module supplies the bulk of the user credential checking; a - few (administrator) related accesses fall through to a lower - level with a well protected .htpasswd file.

- -

- - - - \ No newline at end of file diff --git a/docs/manual/mod/obs_mod_auth_digest.html.en b/docs/manual/mod/obs_mod_auth_digest.html.en deleted file mode 100644 index be2c1e0da7..0000000000 --- a/docs/manual/mod/obs_mod_auth_digest.html.en +++ /dev/null @@ -1,222 +0,0 @@ - - -mod_auth_digest - Apache HTTP Server

Apache > HTTP Server > Documentation > Version 2.0 > Modules

Obsolete Apache Module mod_auth_digest

Description: -	User authentication using MD5 - Digest Authentication.
Status: -	Obsolete (obsolete since 2.0.44)
Module Identifier: -	auth_digest_module
Source File: -	mod_auth_digest.c
Compatibility: -	Available only in versions up to 2.0.43. The new module -that unfortunately is also named `mod_auth_digest` -includes support for the auth provider mechanism introduced -in 2.0.44.

Summary

This module is obsolete!

Note, that this module has been marked as obsolete. A bunch - of modules was introduced in Apache version 2.0.44 that - support the new Authentication/Authorization provider mechnism.

- -

In order to get the ability of HTTP Digest Authentication, you have - to use the new mod_auth_digest module that implements - the HTTP part. The user and group data management is provided by the - mod_authn_* and mod_authz_* modules. If you - want to use your existing user files, have a look at mod_authn_file.

- -

This document is kept only for historical reasons and no - longer maintained.

- -

This module implements HTTP Digest Authentication. However, it - has not been extensively tested and is therefore marked - experimental.

Directives

AuthDigestAlgorithm
AuthDigestDomain
AuthDigestFile
AuthDigestGroupFile
AuthDigestNcCheck
AuthDigestNonceFormat
AuthDigestNonceLifetime
AuthDigestQop

Topics

Using Digest Authentication

Using Digest Authentication

- -

Using MD5 Digest authentication is very simple. Simply set - up authentication normally, using "AuthType Digest" and - "AuthDigestFile" instead of the normal "AuthType Basic" and - "AuthUserFile"; also, replace any "AuthGroupFile" with - "AuthDigestGroupFile". Then add a "AuthDigestDomain" directive - containing at least the root URI(s) for this protection space. - Example:

- -

- <Location /private/> - - AuthType Digest - AuthName "private area" - AuthDigestDomain /private/ http://mirror.my.dom/private2/ - AuthDigestFile /web/auth/.digest_pw - Require valid-user - - </Location> -

- -

Note

Digest authentication provides a more secure password system - than Basic authentication, but only works with supporting - browsers. As of July 2002, the major browsers that support digest - authentication are Opera, MS Internet - Explorer (fails when used with a query string), Amaya and Mozilla. Since digest - authentication is not as widely implemented as basic - authentication, you should use it only in controlled settings.

AuthDigestAlgorithm Directive

Description: -	Selects the algorithm used to calculate the challenge and -response hases in digest authentication
Syntax: -	`AuthDigestAlgorithm MD5\|MD5-sess`
Default: -	`AuthDigestAlgorithm MD5`
Context: -	directory, .htaccess
Override: -	AuthConfig
Status: -	Obsolete
Module: -	mod_auth_digest

The AuthDigestAlgorithm directive - selects the algorithm used to calculate the challenge and response - hashes.

- -

- MD5-sess is not correctly implemented yet. -

- -

AuthDigestDomain Directive

Description: -	URIs that are in the same protection space for digest -authentication
Syntax: -	`AuthDigestDomain URI [URI] ...`
Context: -	directory, .htaccess
Override: -	AuthConfig
Status: -	Obsolete
Module: -	mod_auth_digest

The AuthDigestDomain directive allows - you to specify one or more URIs which are in the same protection - space (i.e. use the same realm and username/password info). The - specified URIs are prefixes, i.e. the client will assume that all - URIs "below" these are also protected by the same - username/password. The URIs may be either absolute URIs - (i.e. inluding a scheme, host, port, etc) or relative URIs.

- -

This directive should always be specified and - contain at least the (set of) root URI(s) for this space. - Omitting to do so will cause the client to send the - Authorization header for every request sent to this - server. Apart from increasing the size of the request, it may - also have a detrimental effect on performance if - "AuthDigestNcCheck" is on.

- -

The URIs specified can also point to different servers, in - which case clients (which understand this) will then share - username/password info across multiple servers without - prompting the user each time.

AuthDigestFile Directive

Description: -	Location of the text file containing the list -of users and encoded passwords for digest authentication
Syntax: -	`AuthDigestFile file-path`
Context: -	directory, .htaccess
Override: -	AuthConfig
Status: -	Obsolete
Module: -	mod_auth_digest

The AuthDigestFile directive sets the - name of a textual file containing the list of users and encoded - passwords for digest authentication. File-path is the - absolute path to the user file.

- -

The digest file uses a special format. Files in this format - can be created using the htdigest utility found in - the support/ subdirectory of the Apache distribution.

AuthDigestGroupFile Directive

Description: -	Name of the text file containing the list of groups -for digest authentication
Syntax: -	`AuthDigestGroupFile file-path`
Context: -	directory, .htaccess
Override: -	AuthConfig
Status: -	Obsolete
Module: -	mod_auth_digest

The AuthDigestGroupFile directive sets - the name of a textual file containing the list of groups and their - members (user names). File-path is the absolute path to - the group file.

- -

Each line of the group file contains a groupname followed by - a colon, followed by the member usernames separated by spaces. - Example:

- -

mygroup: bob joe anne

- -

Note that searching large text files is very - inefficient.

- -

Security: make sure that the AuthGroupFile is stored outside - the document tree of the web-server; do not put it in - the directory that it protects. Otherwise, clients will be able - to download the AuthGroupFile.

AuthDigestNcCheck Directive

Description: -	Enables or disables checking of the nonce-count sent by the -server
Syntax: -	`AuthDigestNcCheck On\|Off`
Default: -	`AuthDigestNcCheck Off`
Context: -	server config
Status: -	Obsolete
Module: -	mod_auth_digest

- Not implemented yet. -

- -

AuthDigestNonceFormat Directive

Description: -	Determines how the nonce is generated
Syntax: -	`AuthDigestNonceFormat format`
Context: -	directory, .htaccess
Override: -	AuthConfig
Status: -	Obsolete
Module: -	mod_auth_digest

Not implemented yet. -

AuthDigestNonceLifetime Directive

Description: -	How long the server nonce is valid
Syntax: -	`AuthDigestNonceLifetime seconds`
Default: -	`AuthDigestNonceLifetime 300`
Context: -	directory, .htaccess
Override: -	AuthConfig
Status: -	Obsolete
Module: -	mod_auth_digest

The AuthDigestNonceLifetime directive - controls how long the server nonce is valid. When the client - contacts the server using an expired nonce the server will send - back a 401 with stale=true. If seconds is - greater than 0 then it specifies the amount of time for which the - nonce is valid; this should probably never be set to less than 10 - seconds. If seconds is less than 0 then the nonce never - expires. -

AuthDigestQop Directive

Description: -	Determines the quality-of-protection to use in digest -authentication
Syntax: -	`AuthDigestQop none\|auth\|auth-int [auth\|auth-int]`
Default: -	`AuthDigestQop auth`
Context: -	directory, .htaccess
Override: -	AuthConfig
Status: -	Obsolete
Module: -	mod_auth_digest

The AuthDigestQop directive determines - the quality-of-protection to use. auth will only do - authentication (username/password); auth-int is - authentication plus integrity checking (an MD5 hash of the entity - is also computed and checked); none will cause the module - to use the old RFC-2069 digest algorithm (which does not include - integrity checking). Both auth and auth-int may - be specified, in which the case the browser will choose which of - these to use. none should only be used if the browser for - some reason does not like the challenge it receives otherwise.

- -

- auth-int is not implemented yet. -

\ No newline at end of file diff --git a/docs/manual/mod/obs_mod_auth_digest.xml b/docs/manual/mod/obs_mod_auth_digest.xml deleted file mode 100644 index ad4b82ef77..0000000000 --- a/docs/manual/mod/obs_mod_auth_digest.xml +++ /dev/null @@ -1,300 +0,0 @@ - - - - -mod_auth_digest -User authentication using MD5 - Digest Authentication. -Obsolete -obsolete since 2.0.44 -mod_auth_digest.c -auth_digest_module -Available only in versions up to 2.0.43. The new module -that unfortunately is also named mod_auth_digest -includes support for the auth provider mechanism introduced -in 2.0.44. - -

- This module is obsolete! -

Note, that this module has been marked as obsolete. A bunch - of modules was introduced in Apache version 2.0.44 that - support the new Authentication/Authorization provider mechnism.

- -

In order to get the ability of HTTP Digest Authentication, you have - to use the new mod_auth_digest module that implements - the HTTP part. The user and group data management is provided by the - mod_authn_* and mod_authz_* modules. If you - want to use your existing user files, have a look at mod_authn_file.

- -

This document is kept only for historical reasons and no - longer maintained.

- - -

This module implements HTTP Digest Authentication. However, it - has not been extensively tested and is therefore marked - experimental.

- -AuthName -AuthType -Require -Satisfy - -

Using Digest Authentication - -

- - - <Location /private/>
- - AuthType Digest
- AuthName "private area"
- AuthDigestDomain /private/ http://mirror.my.dom/private2/
- AuthDigestFile /web/auth/.digest_pw
- Require valid-user
- - </Location> - - - Note -

- -

- - -AuthDigestFile -Location of the text file containing the list -of users and encoded passwords for digest authentication -AuthDigestFile file-path -directory.htaccess - -AuthConfig - - -

The AuthDigestFile directive sets the - name of a textual file containing the list of users and encoded - passwords for digest authentication. File-path is the - absolute path to the user file.

- -

The digest file uses a special format. Files in this format - can be created using the htdigest utility found in - the support/ subdirectory of the Apache distribution.

- - - - -AuthDigestGroupFile -Name of the text file containing the list of groups -for digest authentication -AuthDigestGroupFile file-path -directory.htaccess - -AuthConfig - - -

The AuthDigestGroupFile directive sets - the name of a textual file containing the list of groups and their - members (user names). File-path is the absolute path to - the group file.

- -

Each line of the group file contains a groupname followed by - a colon, followed by the member usernames separated by spaces. - Example:

- - mygroup: bob joe anne - -

Note that searching large text files is very - inefficient.

- -

- - - - -AuthDigestQop -Determines the quality-of-protection to use in digest -authentication -AuthDigestQop none|auth|auth-int [auth|auth-int] -AuthDigestQop auth -directory.htaccess - -AuthConfig - - -

The AuthDigestQop directive determines - the quality-of-protection to use. auth will only do - authentication (username/password); auth-int is - authentication plus integrity checking (an MD5 hash of the entity - is also computed and checked); none will cause the module - to use the old RFC-2069 digest algorithm (which does not include - integrity checking). Both auth and auth-int may - be specified, in which the case the browser will choose which of - these to use. none should only be used if the browser for - some reason does not like the challenge it receives otherwise.

- - - auth-int is not implemented yet. - - - - - -AuthDigestNonceLifetime -How long the server nonce is valid -AuthDigestNonceLifetime seconds -AuthDigestNonceLifetime 300 -directory.htaccess - -AuthConfig - - -

The AuthDigestNonceLifetime directive - controls how long the server nonce is valid. When the client - contacts the server using an expired nonce the server will send - back a 401 with stale=true. If seconds is - greater than 0 then it specifies the amount of time for which the - nonce is valid; this should probably never be set to less than 10 - seconds. If seconds is less than 0 then the nonce never - expires. -

- - - - -AuthDigestNonceFormat -Determines how the nonce is generated -AuthDigestNonceFormat format -directory.htaccess - -AuthConfig - - -

Not implemented yet. -

- - - - -AuthDigestNcCheck -Enables or disables checking of the nonce-count sent by the -server -AuthDigestNcCheck On|Off -AuthDigestNcCheck Off -server config - - - - Not implemented yet. - - - - - - -AuthDigestAlgorithm -Selects the algorithm used to calculate the challenge and -response hases in digest authentication -AuthDigestAlgorithm MD5|MD5-sess -AuthDigestAlgorithm MD5 -directory.htaccess - -AuthConfig - - -

The AuthDigestAlgorithm directive - selects the algorithm used to calculate the challenge and response - hashes.

- - - MD5-sess is not correctly implemented yet. - - - - - - -AuthDigestDomain -URIs that are in the same protection space for digest -authentication -AuthDigestDomain URI [URI] ... -directory.htaccess - -AuthConfig - - -

The AuthDigestDomain directive allows - you to specify one or more URIs which are in the same protection - space (i.e. use the same realm and username/password info). The - specified URIs are prefixes, i.e. the client will assume that all - URIs "below" these are also protected by the same - username/password. The URIs may be either absolute URIs - (i.e. inluding a scheme, host, port, etc) or relative URIs.

- -

- - - - - - - diff --git a/docs/manual/mod/quickreference.html.en b/docs/manual/mod/quickreference.html.en index d2574e3d3f..21622dd7a2 100644 --- a/docs/manual/mod/quickreference.html.en +++ b/docs/manual/mod/quickreference.html.en @@ -121,16 +121,16 @@ store passwords

AuthDigestAlgorithm MD5|MD5-sess MD5 dh X

Selects the algorithm used to calculate the challenge and response hases in digest authentication

AuthDigestDomain URI [URI] ... dh X

URIs that are in the same protection space for digest +

AuthDigestDomain URI [URI] ... dh X

URIs that are in the same protection space for digest authentication

AuthDigestFile file-path dh X

Location of the text file containing the list +

AuthDigestFile file-path dh X

Location of the text file containing the list of users and encoded passwords for digest authentication

AuthDigestGroupFile file-path dh X

Name of the text file containing the list of groups +

AuthDigestGroupFile file-path dh X

Name of the text file containing the list of groups for digest authentication

AuthDigestNcCheck On|Off Off s X

Enables or disables checking of the nonce-count sent by the server

AuthDigestNonceFormat format dh X

Determines how the nonce is generated

AuthDigestNonceLifetime seconds 300 dh X

How long the server nonce is valid

AuthDigestNonceFormat format dh X

Determines how the nonce is generated

AuthDigestNonceLifetime seconds 300 dh X

How long the server nonce is valid

AuthDigestQop none|auth|auth-int [auth|auth-int] auth dh X

Determines the quality-of-protection to use in digest authentication

AuthGroupFile file-path dh E

Sets the name of a text file containing the list diff --git a/docs/manual/programs/rotatelogs.html b/docs/manual/programs/rotatelogs.html index 45f233b9b9..7bf88d17b7 100644 --- a/docs/manual/programs/rotatelogs.html +++ b/docs/manual/programs/rotatelogs.html @@ -7,20 +7,23 @@ vlink="#000080" alink="#ff0000">

Manual Page: rotatelogs

-NAME
+NAME
      rotatelogs - rotate Apache logs without having to  kill  the
      server
 
 SYNOPSIS
-     rotatelogs logfile rotationtime [offset]
+     rotatelogs logfile [rotationtime [offset]] | [filesizeM]
 
 DESCRIPTION
      rotatelogs is a simple program for use in  conjunction  with
      Apache's piped logfile feature, which can be used like this:
 
      CustomLog "|bin/rotatelogs /var/logs/logfile 86400" common
-
+	 
+     or
+	 
+     CustomLog "|bin/rotatelogs /var/logs/logfile 5M" common
+	 
      This creates the files /var/logs/logfile.nnnn where nnnn  is
      the system time at which the log nominally starts (this time
      will always be a multiple of the rotation time, so  you  can
@@ -43,6 +46,13 @@ vlink="#000080" alink="#ff0000">
           zero  is  assumed and UTC is used.  For example, to use
           local time in the zone UTC -5 hours, specify a value of
           -300 for this argument.
+		  
+          or
+          
+     filesizeM
+          The maximum file size  in  megabytes followed  by  the 
+          letter 'M' to specify size rather than time.  Use this 
+          parameter in place of both rotationtime and offset.
 
 PORTABILITY
      The following logfile format string substitutions should  be
diff --git a/docs/manual/sitemap.html.en b/docs/manual/sitemap.html.en
index 1c77101289..d30bd6f22f 100644
--- a/docs/manual/sitemap.html.en
+++ b/docs/manual/sitemap.html.en
@@ -44,13 +44,15 @@
 SSL/TLS Encryption: Compatibility
 SSL/TLS Encryption: How-To
 SSL/TLS Encryption: FAQ
-
Guides, Tutorials, and HowTos
Authentication
+
Guides, Tutorials, and HowTos
Overview
+Authentication
 Dynamic Content with CGI
 Introduction to Server Side Includes
 .htaccess files
 Per-user web directories
 Apache Tutorials
-
Platform-specific Notes
Using Apache with Microsoft
+
Platform-specific Notes
Overview
+Using Apache with Microsoft
 Windows
 Compiling Apache for
 Microsoft Windows
@@ -141,11 +143,6 @@ Server on HPUX
 Apache Module mod_userdir
 Apache Module mod_usertrack
 Apache Module mod_vhost_alias
-
Obsolete Apache Module mod_access
-Obsolete Apache Module mod_auth
-Obsolete Apache Module mod_auth_anon
-Obsolete Apache Module mod_auth_dbm
-Obsolete Apache Module mod_auth_digest
 
Developer Documentation
Overview
 Apache API notes
 Debugging Memory Allocation in APR
diff --git a/docs/manual/sitemap.xml b/docs/manual/sitemap.xml
index c8d88eb3ea..2691d72b2c 100644
--- a/docs/manual/sitemap.xml
+++ b/docs/manual/sitemap.xml
@@ -186,12 +186,6 @@ Server on HPUX
   perchild.xml
   prefork.xml
   worker.xml
-
-  obs_mod_access.xml
-  obs_mod_auth.xml
-  obs_mod_auth_anon.xml
-  obs_mod_auth_dbm.xml
-  obs_mod_auth_digest.xml
 
 
 
diff --git a/docs/manual/style/css/manual.css b/docs/manual/style/css/manual.css
index 75d9ea0260..17c728742d 100644
--- a/docs/manual/style/css/manual.css
+++ b/docs/manual/style/css/manual.css
@@ -537,7 +537,7 @@ div#quickview ul#toc {
     padding: 0;
 }
 
-#module-index div#quickview ul#toc,
+/* #module-index div#quickview ul#toc, */
 #manual-page div#quickview ul#toc {
     margin-left: 0;
 }
@@ -552,14 +552,14 @@ div#quickview li img {
     display: none;
 }
 
-#module-index div#quickview ul#toc,
+/* #module-index div#quickview ul#toc, */
 #manual-page div#quickview ul#toc,
 div#quickview #topics,
 div#quickview .seealso {
     padding-left: 15px;
 }
 
-#module-index div#quickview ul#toc li,
+/* #module-index div#quickview ul#toc li, */
 #manual-page div#quickview ul#toc li,
 div#quickview #topics li,
 div#quickview .seealso li {
diff --git a/docs/manual/style/xsl/moduleindex.xsl b/docs/manual/style/xsl/moduleindex.xsl
index 26944b0ff9..1f67c35f6d 100644
--- a/docs/manual/style/xsl/moduleindex.xsl
+++ b/docs/manual/style/xsl/moduleindex.xsl
@@ -14,7 +14,7 @@
       
           
 
-        
+
         
           
             
@@ -23,6 +23,7 @@
           
         
           
+
+        
+-->
+        
 
         
 
@@ -115,6 +118,7 @@
         
         
 
+
+
 
               
             
           
         
+-->
         
 
-         
+
 
         
 
diff --git a/docs/manual/style/xsl/sitemap.xsl b/docs/manual/style/xsl/sitemap.xsl
index 12a7cfe9fb..a7cdd99bd2 100644
--- a/docs/manual/style/xsl/sitemap.xsl
+++ b/docs/manual/style/xsl/sitemap.xsl
@@ -209,6 +209,7 @@
     
 
     
+
+
 
         
       
-      
      
+-->
+     
 
   
   
-- 
2.40.0

Module Index

Module Index

Topics

See also

Using Digest Authentication

Topics

See also

Note

Note

Obsolete Apache Module mod_access

Summary

This module is obsolete!

Directives

See also

Example:

Obsolete Apache Module mod_auth

Summary

This module is obsolete!

Directives

See also

Security

Security

Security

Obsolete Apache Module mod_auth_anon

Summary

This module is obsolete!

Directives

Topics

Example:

Obsolete Apache Module mod_auth_dbm

Summary

This module is obsolete!

Directives

See also

Obsolete Apache Module mod_auth_digest

Summary

This module is obsolete!

Directives

Topics

See also

Note

Manual Page: rotatelogs

@@ -23,6 +23,7 @@