CONTROLLING ACCESSES
In order to control the access to a file, you must add the security in
the directory you would like to protect. The security file itself is a
XML file but in order to be used by MyServer it should not have any
extension specified (the file name has to be simply
"security").
The syntax of the file is:
<?xml version="1.0"?>
<SECURITY>
<HTTP TRACE="ON" />
<AUTH TYPE="Basic" />
<ACTION name="Host" value="localhost">ALLOW</ACTION>
<USER NAME="God" PASS="godpassword" READ="TRUE" WRITE="TRUE" BROWSE="TRUE"
EXECUTE="TRUE" />
<!--This is the setting for the user-->
<USER NAME="Guest" PASS="" READ="TRUE" BROWSE="TRUE"/>
<!--The guest user-->
<USER NAME="Tim" PASS="Tom" READ="TRUE" EXECUTE="TRUE" BROWSE="TRUE"/>
<!--Another user-->
<ITEM FILE="file1" READ="TRUE" WRITE="FALSE" EXECUTE="FALSE">
<ACTION name="Host" value="remote">DENY</ACTION>
<!--Define a file and its permissions-->
<USER NAME="Jim" PASS="Morrison" READ="TRUE" WRITE="FALSE" EXECUTE="FALSE"
/>
<!--Define the user permissions for the file-->
<USER NAME="Bob" PASS="Marley" READ="TRUE" WRITE="FALSE" EXECUTE="TRUE"
/>
<ACTION name="Host" value="localhost">DENY</ACTION>
<!--Another user permissions for the file-->
</ITEM>
<--End of the file block-->
</SECURITY>
The line <HTTP TRACE="ON" /> is optional,
and is described in the Virtual Hosts section
of this guide. Please, go to that link if you want to understand about
that line.
The line <AUTH TYPE="Basic" />, optional,
selects the authentication scheme to be used for your site. Its default
value is "Basic", but you can also use "Digest", so it will look like
this:
<AUTH TYPE="Digest" />
if the line isn't in the file, the default "Basic" will be used.
The "Digest" schema is safer, as the passwords aren't transferred open
through the net.
The engine first checks to see if the user has permissions in the file
block:
<USER NAME="Bob" PASS="Marley" READ="TRUE" WRITE="FALSE"
EXECUTE="TRUE" />
If there are no permissions defined, the engine tries to use the permissions
that are defined for the file:
<ITEM FILE="file1" READ="TRUE" WRITE="FALSE" EXECUTE="FALSE">
If the engine cannot find any file permissions, it then uses the general
settings for the user:
<USER NAME="Guest" PASS="" READ="TRUE" BROWSE="TRUE"/>
If the user is not defined, the engine will send an error to the user.
The <ACTION> lines above define if a resource
will be allowed to be accessed or not, depending on the conditions. For
example, the line
<ACTION name="Host" value="remote">DENY</ACTION>
means the file "file1" will be denied if the Host used to access
the file is "remote" as hostname. But if there were others maps
to the file in other hostnames, for example "localhost", it
can be accessed, execpt by user Bob, as specified by the line below:
<ACTION name="Host" value="localhost">DENY</ACTION>
If the security file is not present, the directory tree will be upper
visited until a security file is not found, if the host directory is
reached a default security file will be used. The default security file
is located in the system directory.