How can I use our webserver to run our intranet privatley??

[chrisjako]

Hi guys,

 

Wondering if anyone can advise how you combat this problem:

 

I'm running within school a webserver on apache for our joomla school website and moodle, these can be accessed outside school to the public, I now want to re-do our staff intranet using joomla and run it on the same webserver, the setup i want is if someone was to browse to the intranet folder from outside the school I want an authentication box to appear to protect private information but not when the staff access it from within school.

 

Does anyone have a same setup & how do you combat this issue?

[powdarrmonkey]

What webserver platform and OS?

[chrisjako]

The webserver is running Windows server 2003 SP2 Enterprise

 

Apache version 2.2.0

MySQL version 5.0.18

PostgreSQL version 8.1.2

Openssl version 0.9.8a

Slimftpd version 3.18

Xmail version 1.22

Perl version 5.8.

PHP version 5.1.2

Python version 2.3.5

[powdarrmonkey]

In apache's configuration:

 

Order deny,allow

Deny from all

Allow from (e.g. 10.0.0.0/8)

 

Adding 'authentication if not in school' makes it much more complex.

[ricki]

HI

 

I would advice you to build a server and put in inside your firewall and keep the public and the private apart. I run several linux lamp servers on old pcs and they work great.

 

Richard

[srochford]

HI

 

I would advice you to build a server and put in inside your firewall and keep the public and the private apart. I run several linux lamp servers on old pcs and they work great.

 

Richard

 

That makes sense but I think the OP wants a single website which can be accessed from anywhere but, if it's accessed from inside school doesn't prompt for authentication.

 

I think you can add to the allow/deny stuff so that it starts like the one above but then has a section to specify which users/passwords are allowed. The process exits as soon as it finds something which matches so if it's internal there'll be no password prompt but if it's external then it does prompt.

 

I'd guess the other way would be to have 2 servers; one internal with no authentication and the other "external" and using authentication. Make the external one mirror the internal so that they stay in sync. This would work but obviously adds the cost of another Windows license (unless you do it as VMs!)

[powdarrmonkey]

That makes sense but I think the OP wants a single website which can be accessed from anywhere but, if it's accessed from inside school doesn't prompt for authentication.

 

I think you can add to the allow/deny stuff so that it starts like the one above but then has a section to specify which users/passwords are allowed. The process exits as soon as it finds something which matches so if it's internal there'll be no password prompt but if it's external then it does prompt.

 

Ah, yes, I forgot that. This would be the best way.

 

I'd guess the other way would be to have 2 servers; one internal with no authentication and the other "external" and using authentication. Make the external one mirror the internal so that they stay in sync. This would work but obviously adds the cost of another Windows license (unless you do it as VMs!)

 

Or two IPs on one server and two VirtualHosts, or one IP and name-based virtual hosts.

[chrisjako]

Thanks guys, so am i correct in thinking if I put this anywhere in my httpd.conf it will allow only staff machines from my admin network to access the intranet? (My staff ip range is 10.11.224.x -10.11.231.x)

i.e:

 

Order deny,allow

Deny from all

Allow from 10.11.224.1/21

 

the schools website directory is in another folder in the root of htdocs so that shouldn't ask for authentication from anyone as it has to stay public, which is what I want.

 

whats the coding for specifing passwords for the ? is there anyway I can authenticate using LDAP?

[CyberNerd]

[can you setup a bunch of virtualhosts, using aspecific (internal) IP for the internal sites

 

 

   
   ServerName randominternalwebsite.internal.domain
   ServerAlias randominternalwebsite.internal.domain
   DocumentRoot /var/www/vhosts/randominternalwebsite.internal.domain/html
   ErrorLog /var/www/vhosts/randominternalwebsite.internal.domain/logs/error_log
   CustomLog /var/www/vhosts/randominternalwebsite.internal.domain/logs/access_log combined
   
       AllowOverride All
   

[powdarrmonkey]

Thanks guys, so am i correct in thinking if I put this anywhere in my httpd.conf it will allow only staff machines from my admin network to access the intranet? (My staff ip range is 10.11.224.x -10.11.231.x)

i.e:

 

Order deny,allow

Deny from all

Allow from 10.11.224.1/21

 

the schools website directory is in another folder in the root of htdocs so that shouldn't ask for authentication from anyone as it has to stay public, which is what I want.

 

From memory, that looks about right.

 

whats the coding for specifing passwords for the ? is there anyway I can authenticate using LDAP?

 

Investigate Apache's mod_auth_ntlm and mod_auth_ldap, neither of which I have much experience with, sorry