#!/bin/rc cat<<-eof- private room

Private Room

Who should control the access to web pages

I think access control to web pages should be managed by the person who is contructing web page. Generally speaking, manager of web page is not same as the manager of server. Therefore Pegasus allows access control to the person who manages his/her own web page.

A user alice of Pegasus has two files to control the access:

  1. /usr/~alice/web/etc/passwd
  2. /usr/~alice/web/etc/allow
and they will be seen in "/etc/ in httpd name space.

A virtual host likewise has own access control files.

Control by password

The access control by password is done by basic authentication scheme defined HTTP/1.0.
Although this scheme is not secure, the implementaion is easy and therefore widely used.

Pegasus support two methods to verify the password from clients.

  1. consults with local password file: "/etc/passwd"
  2. consults with authentication server
I will show you my password file.
-eof-
cat /etc/passwd

cat<<-eof-
The password field is hashed using md5. If the field is `*' then authentication server will be consulted.

Control by IP address

The next room is provided for access control test by IP address.
Our control file is "/etc/allow" and the current content is:
-eof-
cat /etc/allow

cat<<-eof-
This means that IP ending with odd number can enter room1, and even number to room2
Good luck! Please confirm your GET requests follow "/etc/allow".
You will be able to get index.html only one of the followings.


peep this code -eof-