Putting ACLs into MyWeb

At the moment this blog is restricted to on-campus access only. I figured I would explain how I did that in case any of you who read this want to know the trick as well. The trick is the use of what apache calls "htaccess" files. The Apache docs on the critters are here, but this is how I set this up for WWU.

The problem is that ".htaccess" is the standard name of the files, and that's a very unixy name. Windows doesn't like creating files named with a preceeding dot. So I configured myweb to use a second file-name the same way, "ht.acl". MyWeb will use both, so if you manage to actually create an .htaccess file it'll honor it.

This is the "ht.acl" file in my blog directory:

Redirect permanent /~riedesg/sysadmin1138/rss.xml http://feeds.feedburner.com/Sysadmin1138
deny from all
ErrorDocument 403 /~riedesg/noblogfornow.html
allow from 140.160.0.0/16
allow from 66.165.0.0/19


Explained:
  1. Redirect permanent This directive redirects attempts to get the non-existant "rss.xml" file in the blog-directory to the feedburner feed. This has been around for some time.
  2. deny from all This says that all access is denied unless specifically allowed.
  3. ErrorDocument 403 This specifies the HTML page to serve when 403 errors are thrown, such as when off-campus users attempt to hit this blog. This page contains the explanation for the temporary outage.
  4. allow from 140.160.0.0/16 This specifies that the WWU academic sub-net is to be permitted in.
  5. allow from 66.165.0.0/19 This specifies that the WWU ResTek sub-net is to be permitted in. I THINK I have all of it.
When I return access to normal, everything from the "deny from all" line down will be removed. Since this is placed in the /~riedesg/sysadmin1138/ directory, anything in the archives, such as /~riedesg/sysadmin1138/2006/02/anything.html will also apply, since htaccess files are cumulative per-directory in the tree.