Understanding the Need for Access Control

Access control is a requirement for many websites. This means that certain content or areas of the website are only accessible to clients that come from a particular range of IP addresses or provide a valid username and password, for example. Access control can be implemented at a variety of levels, including at the operating-system level with packet filtering rules and at the web application level with forms, sessions, and cookies. This chapter deals exclusively with implementing access control, authentication, and authorization using the bundled Apache modules. This chapter also explains how different configuration settings can affect the security of your server and details a number of steps that you can take to improve it.

Apache provides a number of modules that allow you to control access to your content. The two main ones are mod_access, which allows controlling access based on the origin IP address and other characteristics of the request, and mod_auth, which authenticates users based on a username and password.

There are a number of other modules that will be mentioned in this chapter but will not be covered in detail because they are not used as often.