Skip to content

order-apache-vs-proftpd.txt

9KB · 329 lines

plaintext
[Apache-ProFTPd] Order, Allow, Deny ��

- �ۼ��� : ��ĥ�� <san2(at)linuxchannel.net>
- �ۼ��� : 2003-11-22
- ��  �� : ����ġ�� ProFTPd �� Order, Allow, Deny ��
- ��  �� : �ʺ���
- ���� : Apache, ProFTPd, Order Allow, Deny

*��)
�� ������ ���� �ֽ� ���� �Ʒ� URL���� Ȯ���� �� �ֽ��ϴ�.

http://www.linuxchannel.net/docs/order-apache-vs-proftpd.txt


------------------------------------------------------
1. Apache Order allow,deny
2. ProFTPd Order allow,deny
3. ��
4. ����
------------------------------------------------------

1. Apache Order allow,deny

Order directive

- Syntax  : Order ordering
- Default : Order Deny,Allow  <---- Deny �� ���� ��� ��� Allow ��
- Context : directory, .htaccess
- Override: Limit
- Status  : Base
- Module  : mod_access 

Allow directive

- Syntax  : Allow from all|host|env=variablename [host|env=variablename] ...
- Context : directory, .htaccess
- Override: Limit
- Status  : Base
- Module  : mod_access 
- List    : ���� ����(' ')
  A (partial) domain-name
	Example: Allow from apache.org
  A full IP address
	Example: Allow from 10.1.2.3
  A partial IP address
	Example: Allow from 10.1
  A network/netmask pair
	Example: Allow from 10.1.0.0/255.255.0.0
  A network/nnn CIDR specification
	Example: Allow from 10.1.0.0/16

  Allow from 10.1.2.3 env=foo   <-- Ʋ�� ���(X)
  Allow from env=foo 10.1.2.3   <-- �´� ���(O), env �� �տ� ��

�⺻��å�� Deny �� ���� ��� ��� Allow �ǰ�, Deny,Allow ��̴� �����
�޸�(,)�� �и�.

- Order Deny,Allow

  Allow �� ���ϱ� ���� ��� Deny �� ���ϰ�, �� ��� Allow ��
  override ��. �׸��� ���⿡ ��ġ��� �ʴ� ����� ȣ��Ʈ ���
  Allow ��. ���� �� Order �� �⺻��å�� ù��° Deny ����ڿ��� ����

  �� ������,

  1. Deny ��ġ �켱 ��(�⺻ ��å ��)
  2. �� ��� Allow ��ġ�� override ��
  3. ����� ��Ե�� ��� ȣ��Ʈ�� ��� Allow ��

- Order Allow,Deny

  Deny �� ���ϱ� ���� ��� Allow �� ���ϰ�, �� ��� Deny ��
  override ��. �׸��� ���⿡ ��ġ��� ��� ����� ȣ��Ʈ�� ���
  Deny ��. �� Order �� �⺻��å�� ù��° Allow ����ڿ��� ����.

(*** ����� ProFTPd �� ���� �ٸ� ***)


ex1) �⺻��å�� Allow �̰�, ���ܷ� bad.com hacker.com �� ���

  Order Allow,Deny              <-- Order Mutual-failure �� ����
  Allow from all
  Deny from bad.com hacker.com  <-- ����Ʈ ������ ����� ����

ex2) �⺻��å�� Deny �̰�, ���ܷ� myhost.com �� ����� �����

  Order Deny,Allow
  Deny from all
  Allow from myhost.com

ex3) �߿�

  Order Allow,Deny
  Allow from apache.org
  Deny from foo.apache.org

�̰�� foo.apache.org �� ������ *.apache.org �� ����ϰ�
����� ��� ȣ��Ʈ�� ����� �����(foo.apache.org �� �翬� ���)

����� Order ������ ���ؼ� Deny �� ���ϱ� ���� Allow �� ���ϰ�,
�� ����� Deny ��ġ�� override �ϱ� �����̸�, ����� ��ġ��� �ʴ� ���
ȣ��Ʈ�� Deny ��.

ex4) ���

  Order Deny,Allow
  Deny from all           <--- �⺻��å�� ��� Deny ��
  Allow from aaa.foo.com
  Allow from bbb.foo.com ccc.foo.com
  Allow from ddd.com.com
  Deny from ccc.foo.com   <--- *** �� ȣ��Ʈ�� Allow �� ****

Allow �� ���ϱ� ���� Deny �� ��� ���ϱ� ������ �� ������
����� ����.

  Order Deny,Allow
  Deny from all           <--- �⺻��å�� ��� Deny ��
  Deny from ccc.foo.com
  Allow from aaa.foo.com
  Allow from bbb.foo.com ccc.foo.com  <--- Allow ��
  Allow from ddd.com.com


2. ProFTPd Order allow,deny

Order directive

- Syntax: Order [ Order allow,deny|deny,allow]
- Default : Order allow,deny
- Context : <Limit>
- Module  : mod_core
- Compatibility : 0.99.0pl6 and later

Allow directive

- Syntax  : Allow [ ["from"] "all"|"none"|host|network[,host|network[,...]]]
- Default : Allow from all
- Context : <Limit>
- Module  : mod_core
- Compatibility : 0.99.0pl6 and later
- List    : ���� �ĸ�(,)
  A (partial) domain-name
	Example: Allow from .proftpd.org   <--- ����ġ�� �ٸ��� �տ� �� �߰�
  A full IP address
	Example: Allow from 10.1.2.3       <--- ����ġ�� ����
  A partial IP address
	Example: Allow from 10.1.          <--- ����ġ�� �ٸ��� �ڿ� �� �߰�          
  A network/netmask pair                   <--- ����
  A network/nnn CIDR specification
	Example: Allow from 10.1.0.0/16    <--- ����ġ�� ����


ProFTPd �� Order, Allow, Deny ����ڴ� Apache�� ���� ������ ������
�� ���� ��� �����.

- Order deny,allow   <-- �켱�� deny ��

  allow �� ���ϱ� ���� deny �� ��� ���ϰ� ���� ����(overrid ��� ���)
  �׸��� allow �� ���ϰ�(���� ��� ����� deny �� �켱), �����
  ��ġ��� ��� ��� ȣ��Ʈ�� deny ��(����ġ�� ���� �ݴ��)

- Order allow,deny   <-- �켱��� allow ��

  deny �� ���ϱ� ���� allow �� ��� ���ϰ� ���� ����(overrid ��� ���)
  �׸��� deny �� ���ϰ�(���� ��� ����� allow �� �켱), �����
  ��ġ��� ��� ��� ȣ��Ʈ�� allow ��(����ġ�� ���� �ݴ��)

�� ���� ȣ��Ʈ�� allow �� deny �� �Ѵ� ��� ��� �� �켱���
Order ����ڿ��� ������ �պκ�� keyword �� ����.

  Order deny,allow
  Deny from 192.168.0.1
  Allow from 192.168.0.

  deny �� �켱�̹Ƿ� 192.168.0.1 �� deny ��.(Override ��� ���)
  ���� ����� ���� Order ������ �״�� �ΰ�, ��ġ�� �ٲپ ������.

  Order deny,allow
  Allow from 192.168.0.
  Deny from 192.168.0.1

*�߿�)
ProFTPd �� Apache �� ���� Order �� ������� Override ��� �ʰ�,
Order ������ ���ؼ� ��� ����� ���� ����.

ex1) Ư�� ȣ��Ʈ�� �����

  <Limit LOGIN>
    Order allow,deny
    Allow from 192.168.0.100,192.168.1.
    Deny from all       <--- all �� ��ġ��� ��� ������� �ǹ���.
  </Limit>

  192.168.0.100 192.168.1.0/24 �� ����ϰ� ������� ��� ����� �����.
  �� Ư�� ȣ��Ʈ�� ���(Allow) �ϱ� ������ Order allow,deny ������
  �����Ͽ� �켱��� allow �� ��������.

ex2) Ư�� ȣ��Ʈ�� �����

  <Limit LOGIN>
    Order deny,allow
    Deny from 192.168.0.100,192.168.1.
    Allow from all       <--- all �� ��ġ��� ��� �ʸ���� �ǹ���.
  </Limit>

  ex1) �� ���� �ݴ��

ex3) �κа� ��ü

  <Limit LOGIN>
    Order allow,deny
    Allow from 128.44.26.,128.44.26.
    Allow from myhost.mydomain.edu,.trusted-domain.org
    Deny from all
  </Limit>

  ProFTPd �� Override ��� �ʱ� ������ ���� �������� Deny from all ������
  �´ٰ� �ϴ���� ��� ������ ȣ��Ʈ(ex 128.44.26.1)�� Allow �ǰ�,
  �� �������� ��Ե�� ��� ����� ȣ��Ʈ�� ���� �������� ��� Deny ��

ex3) �켱��

  <Limit LOGIN>
    Order deny,allow
    Allow from 192.168.0.
    Deny from 192.168.0.152
    Deny from all            <--- all �� ��ġ��� ��� �ʸ���� �ǹ���.
  </Limit>

  192.168.0.152 ȣ��Ʈ�� �պκ� 'Allow from 192.168.0.*'�� ��Ե����
  Order ������ deny �� �켱�̹Ƿ� �ᱹ �� ȣ��Ʈ�� deny ��.
  �� ���� ȣ��Ʈ�� allow �� deny �� �Ѵ� ��� ��� �� �켱���
  Order ����ڿ��� ������ �պκ�� keyword �� ����.

  <Limit LOGIN>
    Order deny,allow
    Deny from 192.168.0.152
    Allow from 192.168.0.    <--- override ��� ���
    Deny from all            <--- all �� ��ġ��� ��� �ʸ���� �ǹ���.
  </Limit>

  ���� ������ ���� ������ ������.


3. ��

1) ��������

 - Apache  : Order ������ ���ؼ� ��������� override ��.
             ��ġ��� ��� ����� ȣ��Ʈ�� Order �� ���� keyword �� ����
 - ProFTPd : Order ������ ���ؼ� ��������� ��� ����.
             ��ġ��� ��� ����� ȣ��Ʈ�� Order �� ���� keyword �� ����

2) override ��

 - Apache  : override ��(�ڿ� �� ��� �嶯)
 - ProFTPd : override ��� ���(��� �� ��(?)�� �嶯)

3) �⺻ �����å ��

 - Apache  : ��ü --> �κ���� override
 - ProFTPd : �κ� ��� ���� --> ����� ��

4) ����Ʈ ���� ��

 - Apache  : ���(' ')���� ����, ������ �� ��� `\'�� �ߺ� ����� ��� ����
	Allow from 1.2.3.4 1.2.3.5 \
		1.2.3.6 1.2.3.7
	Allow from 10.10.10.1

 - ProFTPd : �ĸ�(,)�� �����ϰ� ������� ���� �ߺ� ����ڸ� ����
	Allow from 1.2.3.4,1.2.3.5,1.2.3.6,1.2.3.7
	Allow from 10.10.10.1

5) Partial IP �ּ� ��

 - Apache  : 192.168.0 192.168.1    <-- �ڿ� ���� ����
 - ProFTPd : 192.168.0.,192.168.1.  <-- �ڿ� ���� ���

6) Partial domain-name ��

 - Apache  : foo.com bar.com        <-- �տ� ���� ����
 - ProFTPd : .foo.com,.bar.com      <-- �տ� ���� ���


4. ����

1) ���� ����

  - Apache
    Order ������ ���ؼ� ��ü�� ��� �����ϰ� ����� �κ�� Override ��

  - ProFTPd
    Order ������ ���ؼ� �κ�� ��� ���ϰ� ����� ��ü�� ������

  * ���� �ݴ��

2) Ư�� ȣ��Ʈ�� ����� ��� : �⺻ ��å�� deny ��

  - Apache

  Order Deny,Allow
  Deny from all
  Allow from 192.168.0 192.168.1.111

  - ProFTPd

  Order allow,deny
  Allow from 192.168.0.,192.168.1.111
  Deny from all  <-- ������� �ǹ���

3) Ư�� ȣ��Ʈ�� ���� ��� : �⺻ ��å�� allow ��

  - Apache

  Order Allow,Deny
  Allow from all
  Deny from 192.168.0 192.168.1.111

  - ProFTPd

  Order deny,allow
  Deny from 192.168.0.,192.168.1.111
  Allow from all  <-- ������� �ǹ���


EOF