order-apache-vs-proftpd.txt
9KB · 329 lines
[Apache-ProFTPd] Order, Allow, Deny ��
- �ۼ��� : ��ĥ�� <san2(at)linuxchannel.net>
- �ۼ��� : 2003-11-22
- �� �� : ����ġ�� ProFTPd �� Order, Allow, Deny ��
- �� �� : �ʺ���
- ���� : Apache, ProFTPd, Order Allow, Deny
*��)
�� ������ ���� �ֽ� ���� �Ʒ� URL���� Ȯ���� �� �ֽ��ϴ�.
http://www.linuxchannel.net/docs/order-apache-vs-proftpd.txt
------------------------------------------------------
1. Apache Order allow,deny
2. ProFTPd Order allow,deny
3. ��
4. ����
------------------------------------------------------
1. Apache Order allow,deny
Order directive
- Syntax : Order ordering
- Default : Order Deny,Allow <---- Deny �� ���� ��� ��� Allow ��
- Context : directory, .htaccess
- Override: Limit
- Status : Base
- Module : mod_access
Allow directive
- Syntax : Allow from all|host|env=variablename [host|env=variablename] ...
- Context : directory, .htaccess
- Override: Limit
- Status : Base
- Module : mod_access
- List : ���� ����(' ')
A (partial) domain-name
Example: Allow from apache.org
A full IP address
Example: Allow from 10.1.2.3
A partial IP address
Example: Allow from 10.1
A network/netmask pair
Example: Allow from 10.1.0.0/255.255.0.0
A network/nnn CIDR specification
Example: Allow from 10.1.0.0/16
Allow from 10.1.2.3 env=foo <-- Ʋ�� ���(X)
Allow from env=foo 10.1.2.3 <-- �´� ���(O), env �� �տ� ��
�⺻��å�� Deny �� ���� ��� ��� Allow �ǰ�, Deny,Allow ��̴� �����
��(,)�� �и�.
- Order Deny,Allow
Allow �� ���ϱ� ���� ��� Deny �� ���ϰ�, �� ��� Allow ��
override ��. ���� ��� ��ġ��� �ʴ� ����� ȣ��Ʈ ���
Allow ��. ���� �� Order �� �⺻��å�� ù��° Deny ����ڿ��� ����
�� ������,
1. Deny ��ġ �켱 ��(�⺻ ��å ��)
2. �� ��� Allow ��ġ�� override ��
3. ����� ��Ե�� ��� ȣ��Ʈ�� ��� Allow ��
- Order Allow,Deny
Deny �� ���ϱ� ���� ��� Allow �� ���ϰ�, �� ��� Deny ��
override ��. ���� ��� ��ġ��� ��� ����� ȣ��Ʈ�� ���
Deny ��. �� Order �� �⺻��å�� ù��° Allow ����ڿ��� ����.
(*** ����� ProFTPd �� ���� �ٸ� ***)
ex1) �⺻��å�� Allow �̰�, ���ܷ� bad.com hacker.com �� ���
Order Allow,Deny <-- Order Mutual-failure �� ����
Allow from all
Deny from bad.com hacker.com <-- ����Ʈ ������ ����� ����
ex2) �⺻��å�� Deny �̰�, ���ܷ� myhost.com �� ����� �����
Order Deny,Allow
Deny from all
Allow from myhost.com
ex3) �߿�
Order Allow,Deny
Allow from apache.org
Deny from foo.apache.org
�̰�� foo.apache.org �� ������ *.apache.org �� ����ϰ�
����� ��� ȣ��Ʈ�� ����� �����(foo.apache.org �� �翬� ���)
����� Order ������ ���ؼ� Deny �� ���ϱ� ���� Allow �� ���ϰ�,
�� ����� Deny ��ġ�� override �ϱ� �����̸�, ����� ��ġ��� �ʴ� ���
ȣ��Ʈ�� Deny ��.
ex4) ���
Order Deny,Allow
Deny from all <--- �⺻��å�� ��� Deny ��
Allow from aaa.foo.com
Allow from bbb.foo.com ccc.foo.com
Allow from ddd.com.com
Deny from ccc.foo.com <--- *** �� ȣ��Ʈ�� Allow �� ****
Allow �� ���ϱ� ���� Deny �� ��� ���ϱ� ������ �� ������
����� ����.
Order Deny,Allow
Deny from all <--- �⺻��å�� ��� Deny ��
Deny from ccc.foo.com
Allow from aaa.foo.com
Allow from bbb.foo.com ccc.foo.com <--- Allow ��
Allow from ddd.com.com
2. ProFTPd Order allow,deny
Order directive
- Syntax: Order [ Order allow,deny|deny,allow]
- Default : Order allow,deny
- Context : <Limit>
- Module : mod_core
- Compatibility : 0.99.0pl6 and later
Allow directive
- Syntax : Allow [ ["from"] "all"|"none"|host|network[,host|network[,...]]]
- Default : Allow from all
- Context : <Limit>
- Module : mod_core
- Compatibility : 0.99.0pl6 and later
- List : ���� �ĸ�(,)
A (partial) domain-name
Example: Allow from .proftpd.org <--- ����ġ�� �ٸ��� �տ� �� �߰�
A full IP address
Example: Allow from 10.1.2.3 <--- ����ġ�� ����
A partial IP address
Example: Allow from 10.1. <--- ����ġ�� �ٸ��� �ڿ� �� �߰�
A network/netmask pair <--- ����
A network/nnn CIDR specification
Example: Allow from 10.1.0.0/16 <--- ����ġ�� ����
ProFTPd �� Order, Allow, Deny ����ڴ� Apache�� ���� ������ ������
�� ���� ��� �����.
- Order deny,allow <-- �켱�� deny ��
allow �� ���ϱ� ���� deny �� ��� ���ϰ� ���� ����(overrid ��� ���)
���� allow �� ���ϰ�(���� ��� ����� deny �� �켱), �����
��ġ��� ��� ��� ȣ��Ʈ�� deny ��(����ġ�� ���� �ݴ��)
- Order allow,deny <-- �켱��� allow ��
deny �� ���ϱ� ���� allow �� ��� ���ϰ� ���� ����(overrid ��� ���)
���� deny �� ���ϰ�(���� ��� ����� allow �� �켱), �����
��ġ��� ��� ��� ȣ��Ʈ�� allow ��(����ġ�� ���� �ݴ��)
�� ���� ȣ��Ʈ�� allow �� deny �� �Ѵ� ��� ��� �� �켱���
Order ����ڿ��� ������ �պκ�� keyword �� ����.
Order deny,allow
Deny from 192.168.0.1
Allow from 192.168.0.
deny �� �켱�̹Ƿ� 192.168.0.1 �� deny ��.(Override ��� ���)
���� ����� ���� Order ������ �״�� �ΰ�, ��ġ�� �ٲپ ������.
Order deny,allow
Allow from 192.168.0.
Deny from 192.168.0.1
*�߿�)
ProFTPd �� Apache �� ���� Order �� ������� Override ��� �ʰ�,
Order ������ ���ؼ� ��� ����� ���� ����.
ex1) Ư�� ȣ��Ʈ�� �����
<Limit LOGIN>
Order allow,deny
Allow from 192.168.0.100,192.168.1.
Deny from all <--- all �� ��ġ��� ��� ������� �ǹ���.
</Limit>
192.168.0.100 192.168.1.0/24 �� ����ϰ� ������� ��� ����� �����.
�� Ư�� ȣ��Ʈ�� ���(Allow) �ϱ� ������ Order allow,deny ������
�����Ͽ� �켱��� allow �� ��������.
ex2) Ư�� ȣ��Ʈ�� �����
<Limit LOGIN>
Order deny,allow
Deny from 192.168.0.100,192.168.1.
Allow from all <--- all �� ��ġ��� ��� �ʸ���� �ǹ���.
</Limit>
ex1) �� ���� �ݴ��
ex3) �κа� ��ü
<Limit LOGIN>
Order allow,deny
Allow from 128.44.26.,128.44.26.
Allow from myhost.mydomain.edu,.trusted-domain.org
Deny from all
</Limit>
ProFTPd �� Override ��� �ʱ� ������ ���� �������� Deny from all ������
�´ٰ� �ϴ���� ��� ������ ȣ��Ʈ(ex 128.44.26.1)�� Allow �ǰ�,
�� �������� ��Ե�� ��� ����� ȣ��Ʈ�� ���� �������� ��� Deny ��
ex3) �켱��
<Limit LOGIN>
Order deny,allow
Allow from 192.168.0.
Deny from 192.168.0.152
Deny from all <--- all �� ��ġ��� ��� �ʸ���� �ǹ���.
</Limit>
192.168.0.152 ȣ��Ʈ�� �պκ� 'Allow from 192.168.0.*'�� ��Ե����
Order ������ deny �� �켱�̹Ƿ� �ᱹ �� ȣ��Ʈ�� deny ��.
�� ���� ȣ��Ʈ�� allow �� deny �� �Ѵ� ��� ��� �� �켱���
Order ����ڿ��� ������ �պκ�� keyword �� ����.
<Limit LOGIN>
Order deny,allow
Deny from 192.168.0.152
Allow from 192.168.0. <--- override ��� ���
Deny from all <--- all �� ��ġ��� ��� �ʸ���� �ǹ���.
</Limit>
���� ������ ���� ������ ������.
3. ��
1) ��������
- Apache : Order ������ ���ؼ� ��������� override ��.
��ġ��� ��� ����� ȣ��Ʈ�� Order �� ���� keyword �� ����
- ProFTPd : Order ������ ���ؼ� ��������� ��� ����.
��ġ��� ��� ����� ȣ��Ʈ�� Order �� ���� keyword �� ����
2) override ��
- Apache : override ��(�ڿ� �� ��� �嶯)
- ProFTPd : override ��� ���(��� �� ��(?)�� �嶯)
3) �⺻ �����å ��
- Apache : ��ü --> �κ���� override
- ProFTPd : �κ� ��� ���� --> ����� ��
4) ����Ʈ ���� ��
- Apache : ���(' ')���� ����, ������ �� ��� `\'�� �ߺ� ����� ��� ����
Allow from 1.2.3.4 1.2.3.5 \
1.2.3.6 1.2.3.7
Allow from 10.10.10.1
- ProFTPd : �ĸ�(,)�� �����ϰ� ������� ���� �ߺ� ����ڸ� ����
Allow from 1.2.3.4,1.2.3.5,1.2.3.6,1.2.3.7
Allow from 10.10.10.1
5) Partial IP �ּ� ��
- Apache : 192.168.0 192.168.1 <-- �ڿ� ���� ����
- ProFTPd : 192.168.0.,192.168.1. <-- �ڿ� ���� ���
6) Partial domain-name ��
- Apache : foo.com bar.com <-- �տ� ���� ����
- ProFTPd : .foo.com,.bar.com <-- �տ� ���� ���
4. ����
1) ���� ����
- Apache
Order ������ ���ؼ� ��ü�� ��� �����ϰ� ����� �κ�� Override ��
- ProFTPd
Order ������ ���ؼ� �κ�� ��� ���ϰ� ����� ��ü�� ������
* ���� �ݴ��
2) Ư�� ȣ��Ʈ�� ����� ��� : �⺻ ��å�� deny ��
- Apache
Order Deny,Allow
Deny from all
Allow from 192.168.0 192.168.1.111
- ProFTPd
Order allow,deny
Allow from 192.168.0.,192.168.1.111
Deny from all <-- ������� �ǹ���
3) Ư�� ȣ��Ʈ�� ���� ��� : �⺻ ��å�� allow ��
- Apache
Order Allow,Deny
Allow from all
Deny from 192.168.0 192.168.1.111
- ProFTPd
Order deny,allow
Deny from 192.168.0.,192.168.1.111
Allow from all <-- ������� �ǹ���
EOF