Article:		Apache Web Serving with Jaguar, Part 3
Subject:		User Directory Access
Date:		2003-04-23 13:08:59
From:		morbus
Response to: User Directory Access
Correct. Nor should they. The GatesMcFaddenCo intranet didn't like ugly ~username URLs, so they switched to Apache's DocumentRoot, which is what the Allow/Deny's are configured for.

Showing messages 1 through 1 of 1.

• User Directory Access
  2003-04-23 13:16:52  Kevin Hemenway | [Reply | View]
  
  
  In rereading your intent (instead of mine), yeah, if someone on the GatesMcFaddenCo machine launched their own user site, it'd be wide open to anyone. The fix to properly protect the entire site / machine (not just Apache's DocumentRoot) is:
  
  <Directory /Users>
  Deny from all
  </Directory>
  
  This is more in line with what the text suggests, but isn't conducive to per-user site directories. In a later part of the series, I talk about user configuration and directories (poor, poor Patti), and you'll see an example of Allow/Deny there.