docs/manual/mod/mod_auth_dbm.html.en - httpd - Git at Google

 <?xml version="1.0" encoding="ISO-8859-1"?>
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head>
 <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type" />
 <meta content="noindex, nofollow" name="robots" />
 <!--
         XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
               This file is generated from xml source: DO NOT EDIT
         XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
       -->
 <title>mod_auth_dbm - Apache HTTP Server</title>
 <link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
 <link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
 <link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" />
 <link href="../images/favicon.ico" rel="shortcut icon" /><link href="http://httpd.apache.org/docs/current/mod/mod_auth_dbm.html" rel="canonical" /></head>
 <body>
 <div id="page-header">
 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p>
 <p class="apache">Apache HTTP Server Version 2.0</p>
 <img alt="" src="../images/feather.gif" /></div>
 <div class="up"><a href="./"><img title="&lt;-" alt="&lt;-" src="../images/left.gif" /></a></div>
 <div id="path">
 <a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">HTTP Server</a> &gt; <a href="http://httpd.apache.org/docs/">Documentation</a> &gt; <a href="../">Version 2.0</a> &gt; <a href="./">Modules</a></div>
 <div id="page-content">
 <div class="retired"><h4>Please note</h4>
             <p>This document refers to the <strong>2.0</strong> version of Apache httpd, which <strong>is no longer maintained</strong>. Upgrade, and refer to the current version of httpd instead, documented at:</p>
         <ul><li><a href="http://httpd.apache.org/docs/current/">Current release version of Apache HTTP Server documentation</a></li></ul><p>You may follow <a href="http://httpd.apache.org/docs/current/mod/mod_auth_dbm.html">this link</a> to go to the current version of this document.</p></div><div id="preamble"><h1>Apache Module mod_auth_dbm</h1>
 <div class="toplang">
 <p><span>Available Languages: </span><a href="../en/mod/mod_auth_dbm.html" title="English">&nbsp;en&nbsp;</a></p>
 </div>
 <table class="module"><tr><th><a href="module-dict.html#Description">Description:</a></th><td>Provides for user authentication using DBM
     files</td></tr>
 <tr><th><a href="module-dict.html#Status">Status:</a></th><td>Extension</td></tr>
 <tr><th><a href="module-dict.html#ModuleIdentifier">Module&#160;Identifier:</a></th><td>auth_dbm_module</td></tr>
 <tr><th><a href="module-dict.html#SourceFile">Source&#160;File:</a></th><td>mod_auth_dbm.c</td></tr>
 <tr><th><a href="module-dict.html#Compatibility">Compatibility:</a></th><td>Available only in versions prior to 2.1</td></tr></table>
 <h3>Summary</h3>

     <p>This module provides for HTTP Basic Authentication, where
     the usernames and passwords are stored in DBM type database
     files. It is an alternative to the plain text password files
     provided by <code class="module"><a href="../mod/mod_auth.html">mod_auth</a></code>.</p>
 </div>
 <div id="quickview"><h3 class="directives">Directives</h3>
 <ul id="toc">
 <li><img alt="" src="../images/down.gif" /> <a href="#authdbmauthoritative">AuthDBMAuthoritative</a></li>
 <li><img alt="" src="../images/down.gif" /> <a href="#authdbmgroupfile">AuthDBMGroupFile</a></li>
 <li><img alt="" src="../images/down.gif" /> <a href="#authdbmtype">AuthDBMType</a></li>
 <li><img alt="" src="../images/down.gif" /> <a href="#authdbmuserfile">AuthDBMUserFile</a></li>
 </ul>
 <h3>See also</h3>
 <ul class="seealso">
 <li><code class="directive"><a href="../mod/core.html#authname">AuthName</a></code></li>
 <li><code class="directive"><a href="../mod/core.html#authtype">AuthType</a></code></li>
 <li><code class="directive"><a href="../mod/core.html#require">Require</a></code></li>
 <li><code class="directive"><a href="../mod/core.html#satisfy">Satisfy</a></code></li>
 </ul></div>

 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 <div class="directive-section"><h2><a name="AuthDBMAuthoritative" id="AuthDBMAuthoritative">AuthDBMAuthoritative</a> <a name="authdbmauthoritative" id="authdbmauthoritative">Directive</a></h2>
 <table class="directive">
 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets whether authentication and authorization will be
 passed on to lower level modules</td></tr>
 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthDBMAuthoritative On|Off</code></td></tr>
 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthDBMAuthoritative On</code></td></tr>
 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_dbm</td></tr>
 </table>
     <p>Setting the <code class="directive">AuthDBMAuthoritative</code>
     directive explicitly to <code>Off</code> allows for both
     authentication and authorization to be passed on to lower level
     modules (as defined in the <code>modules.c</code> files) if there
     is <strong>no userID</strong> or <strong>rule</strong> matching the
     supplied userID. If there is a userID and/or rule specified; the
     usual password and access checks will be applied and a failure will
     give an "Authentication Required" reply.</p>

     <p>So if a userID appears in the database of more than one module;
     or if a valid <code class="directive"><a href="../mod/core.html#require">Require</a></code>
     directive applies to more than one module; then the first module
     will verify the credentials; and no access is passed on;
     regardless of the <code class="directive">AuthDBMAuthoritative</code>
     setting.</p>

     <p>A common use for this is in conjunction with one of the
     basic auth modules; such as <code class="module"><a href="../mod/mod_auth.html">mod_auth</a></code>. Whereas this
     DBM module supplies the bulk of the user credential checking; a
     few (administrator) related accesses fall through to a lower
     level with a well protected <code>.htpasswd</code> file.</p>

     <p>By default, control is not passed on and an unknown userID
     or rule will result in an "Authentication Required" reply. Not
     setting it thus keeps the system secure and forces an NCSA
     compliant behaviour.</p>

     <div class="warning"><h3>Security:</h3>
       <p>Do consider the implications of allowing a user to allow
       fall-through in his <code>.htaccess</code> file; and verify that this
       is really what you want; Generally it is easier to just secure
       a single <code>.htpasswd</code> file, than it is to secure a
       database which might have more access interfaces.</p>
     </div>

 </div>
 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 <div class="directive-section"><h2><a name="AuthDBMGroupFile" id="AuthDBMGroupFile">AuthDBMGroupFile</a> <a name="authdbmgroupfile" id="authdbmgroupfile">Directive</a></h2>
 <table class="directive">
 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets the name of the database file containing the list
 of user groups for authentication</td></tr>
 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthDBMGroupFile <var>file-path</var></code></td></tr>
 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_dbm</td></tr>
 </table>
     <p>The <code class="directive">AuthDBMGroupFile</code> directive sets the
     name of a DBM file containing the list of user groups for user
     authentication. <var>File-path</var> is the absolute path to the
     group file.</p>

     <p>The group file is keyed on the username. The value for a
     user is a comma-separated list of the groups to which the users
     belongs. There must be no whitespace within the value, and it
     must never contain any colons.</p>

     <p>Security: make sure that the
     <code class="directive">AuthDBMGroupFile</code> is stored outside the
     document tree of the web-server; do <em>not</em> put it in the
     directory that it protects. Otherwise, clients will be able to
     download the <code class="directive">AuthDBMGroupFile</code> unless
     otherwise protected.</p>

     <p>Combining Group and Password DBM files: In some cases it is
     easier to manage a single database which contains both the
     password and group details for each user. This simplifies any
     support programs that need to be written: they now only have to
     deal with writing to and locking a single DBM file. This can be
     accomplished by first setting the group and password files to
     point to the same DBM:</p>

     <div class="example"><p><code>
       AuthDBMGroupFile /www/userbase<br />
       AuthDBMUserFile /www/userbase
     </code></p></div>

     <p>The key for the single DBM is the username. The value consists
     of</p>

     <div class="example"><p><code>
       <var>Unix Crypt-ed Password</var>:<var>List of Groups</var>[:(ignored)]
     </code></p></div>

     <p>The password section contains the encrypted password as before.
     This is followed by a colon and the comma separated list of groups.
     Other data may optionally be left in the DBM file after another colon;
     it is ignored by the authentication module. This is what
     www.telescope.org uses for its combined password and group database.</p>

 </div>
 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 <div class="directive-section"><h2><a name="AuthDBMType" id="AuthDBMType">AuthDBMType</a> <a name="authdbmtype" id="authdbmtype">Directive</a></h2>
 <table class="directive">
 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets the type of database file that is used to
 store passwords</td></tr>
 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthDBMType default|SDBM|GDBM|NDBM|DB</code></td></tr>
 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthDBMType default</code></td></tr>
 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_dbm</td></tr>
 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in version 2.0.30 and later.</td></tr>
 </table>
     <p>Sets the type of database file that is used to store the passwords.
     The default database type is determined at compile time.  The
     availability of other types of database files also depends on
     <a href="../install.html#dbm">compile-time settings</a>.</p>

     <p>It is crucial that whatever program you use to create your password
     files is configured to use the same type of database.</p>

 </div>
 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 <div class="directive-section"><h2><a name="AuthDBMUserFile" id="AuthDBMUserFile">AuthDBMUserFile</a> <a name="authdbmuserfile" id="authdbmuserfile">Directive</a></h2>
 <table class="directive">
 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets thename of a database file containing the list of users and
 passwords for authentication</td></tr>
 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthDBMUserFile <var>file-path</var></code></td></tr>
 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_dbm</td></tr>
 </table>
     <p>The <code class="directive">AuthDBMUserFile</code> directive sets the
     name of a DBM file containing the list of users and passwords for
     user authentication. <var>File-path</var> is the absolute path to
     the user file.</p>

     <p>The user file is keyed on the username. The value for a user is
     the encrypted password, optionally followed by a colon and arbitrary
     data. The colon and the data following it will be ignored by the
     server.</p>

     <div class="warning"><h3>Security:</h3>
       <p>Make sure that the <code class="directive">AuthDBMUserFile</code> is stored
       outside the document tree of the web-server; do <em>not</em> put it in
       the directory that it protects. Otherwise, clients will be able to
       download the <code class="directive">AuthDBMUserFile</code>.</p>
     </div>

     <p>Important compatibility note: The implementation of
     "dbmopen" in the apache modules reads the string length of the
     hashed values from the DBM data structures, rather than relying
     upon the string being NULL-appended. Some applications, such as
     the Netscape web server, rely upon the string being
     NULL-appended, so if you are having trouble using DBM files
     interchangeably between applications this may be a part of the
     problem.</p>

     <p>A perl script called
     <code class="program"><a href="../programs/dbmmanage.html">dbmmanage</a></code> is included with
     Apache. This program can be used to create and update DBM
     format password files for use with this module.</p>

 </div>
 </div>
 <div class="bottomlang">
 <p><span>Available Languages: </span><a href="../en/mod/mod_auth_dbm.html" title="English">&nbsp;en&nbsp;</a></p>
 </div><div id="footer">
 <p class="apache">Copyright 2013 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div>
 </body></html>
	<?xml version="1.0" encoding="ISO-8859-1"?>
	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
	<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head>
	<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type" />
	<meta content="noindex, nofollow" name="robots" />
	<!--
	XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
	This file is generated from xml source: DO NOT EDIT
	XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
	-->
	<title>mod_auth_dbm - Apache HTTP Server</title>
	<link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
	<link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
	<link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" />
	<link href="../images/favicon.ico" rel="shortcut icon" /><link href="http://httpd.apache.org/docs/current/mod/mod_auth_dbm.html" rel="canonical" /></head>
	<body>
	<div id="page-header">
	<p class="menu"><a href="../mod/">Modules</a> \| <a href="../mod/directives.html">Directives</a> \| <a href="../faq/">FAQ</a> \| <a href="../glossary.html">Glossary</a> \| <a href="../sitemap.html">Sitemap</a></p>
	<p class="apache">Apache HTTP Server Version 2.0</p>
	<img alt="" src="../images/feather.gif" /></div>
	<div class="up"><a href="./"><img title="<-" alt="<-" src="../images/left.gif" /></a></div>
	<div id="path">
	<a href="http://www.apache.org/">Apache</a> > <a href="http://httpd.apache.org/">HTTP Server</a> > <a href="http://httpd.apache.org/docs/">Documentation</a> > <a href="../">Version 2.0</a> > <a href="./">Modules</a></div>
	<div id="page-content">
	<div class="retired"><h4>Please note</h4>
	<p>This document refers to the <strong>2.0</strong> version of Apache httpd, which <strong>is no longer maintained</strong>. Upgrade, and refer to the current version of httpd instead, documented at:</p>
	<ul><li><a href="http://httpd.apache.org/docs/current/">Current release version of Apache HTTP Server documentation</a></li></ul><p>You may follow <a href="http://httpd.apache.org/docs/current/mod/mod_auth_dbm.html">this link</a> to go to the current version of this document.</p></div><div id="preamble"><h1>Apache Module mod_auth_dbm</h1>
	<div class="toplang">
	<p><span>Available Languages: </span><a href="../en/mod/mod_auth_dbm.html" title="English"> en </a></p>
	</div>
	<table class="module"><tr><th><a href="module-dict.html#Description">Description:</a></th><td>Provides for user authentication using DBM
	files</td></tr>
	<tr><th><a href="module-dict.html#Status">Status:</a></th><td>Extension</td></tr>
	<tr><th><a href="module-dict.html#ModuleIdentifier">Module Identifier:</a></th><td>auth_dbm_module</td></tr>
	<tr><th><a href="module-dict.html#SourceFile">Source File:</a></th><td>mod_auth_dbm.c</td></tr>
	<tr><th><a href="module-dict.html#Compatibility">Compatibility:</a></th><td>Available only in versions prior to 2.1</td></tr></table>
	<h3>Summary</h3>

	<p>This module provides for HTTP Basic Authentication, where
	the usernames and passwords are stored in DBM type database
	files. It is an alternative to the plain text password files
	provided by <code class="module"><a href="../mod/mod_auth.html">mod_auth</a></code>.</p>
	</div>
	<div id="quickview"><h3 class="directives">Directives</h3>
	<ul id="toc">
	<li><img alt="" src="../images/down.gif" /> <a href="#authdbmauthoritative">AuthDBMAuthoritative</a></li>
	<li><img alt="" src="../images/down.gif" /> <a href="#authdbmgroupfile">AuthDBMGroupFile</a></li>
	<li><img alt="" src="../images/down.gif" /> <a href="#authdbmtype">AuthDBMType</a></li>
	<li><img alt="" src="../images/down.gif" /> <a href="#authdbmuserfile">AuthDBMUserFile</a></li>
	</ul>
	<h3>See also</h3>
	<ul class="seealso">
	<li><code class="directive"><a href="../mod/core.html#authname">AuthName</a></code></li>
	<li><code class="directive"><a href="../mod/core.html#authtype">AuthType</a></code></li>
	<li><code class="directive"><a href="../mod/core.html#require">Require</a></code></li>
	<li><code class="directive"><a href="../mod/core.html#satisfy">Satisfy</a></code></li>
	</ul></div>

	<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
	<div class="directive-section"><h2><a name="AuthDBMAuthoritative" id="AuthDBMAuthoritative">AuthDBMAuthoritative</a> <a name="authdbmauthoritative" id="authdbmauthoritative">Directive</a></h2>
	<table class="directive">
	<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets whether authentication and authorization will be
	passed on to lower level modules</td></tr>
	<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthDBMAuthoritative On\|Off</code></td></tr>
	<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthDBMAuthoritative On</code></td></tr>
	<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
	<tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
	<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
	<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_dbm</td></tr>
	</table>
	<p>Setting the <code class="directive">AuthDBMAuthoritative</code>
	directive explicitly to <code>Off</code> allows for both
	authentication and authorization to be passed on to lower level
	modules (as defined in the <code>modules.c</code> files) if there
	is <strong>no userID</strong> or <strong>rule</strong> matching the
	supplied userID. If there is a userID and/or rule specified; the
	usual password and access checks will be applied and a failure will
	give an "Authentication Required" reply.</p>

	<p>So if a userID appears in the database of more than one module;
	or if a valid <code class="directive"><a href="../mod/core.html#require">Require</a></code>
	directive applies to more than one module; then the first module
	will verify the credentials; and no access is passed on;
	regardless of the <code class="directive">AuthDBMAuthoritative</code>
	setting.</p>

	<p>A common use for this is in conjunction with one of the
	basic auth modules; such as <code class="module"><a href="../mod/mod_auth.html">mod_auth</a></code>. Whereas this
	DBM module supplies the bulk of the user credential checking; a
	few (administrator) related accesses fall through to a lower
	level with a well protected <code>.htpasswd</code> file.</p>

	<p>By default, control is not passed on and an unknown userID
	or rule will result in an "Authentication Required" reply. Not
	setting it thus keeps the system secure and forces an NCSA
	compliant behaviour.</p>

	<div class="warning"><h3>Security:</h3>
	<p>Do consider the implications of allowing a user to allow
	fall-through in his <code>.htaccess</code> file; and verify that this
	is really what you want; Generally it is easier to just secure
	a single <code>.htpasswd</code> file, than it is to secure a
	database which might have more access interfaces.</p>
	</div>

	</div>
	<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
	<div class="directive-section"><h2><a name="AuthDBMGroupFile" id="AuthDBMGroupFile">AuthDBMGroupFile</a> <a name="authdbmgroupfile" id="authdbmgroupfile">Directive</a></h2>
	<table class="directive">
	<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets the name of the database file containing the list
	of user groups for authentication</td></tr>
	<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthDBMGroupFile <var>file-path</var></code></td></tr>
	<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
	<tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
	<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
	<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_dbm</td></tr>
	</table>
	<p>The <code class="directive">AuthDBMGroupFile</code> directive sets the
	name of a DBM file containing the list of user groups for user
	authentication. <var>File-path</var> is the absolute path to the
	group file.</p>

	<p>The group file is keyed on the username. The value for a
	user is a comma-separated list of the groups to which the users
	belongs. There must be no whitespace within the value, and it
	must never contain any colons.</p>

	<p>Security: make sure that the
	<code class="directive">AuthDBMGroupFile</code> is stored outside the
	document tree of the web-server; do <em>not</em> put it in the
	directory that it protects. Otherwise, clients will be able to
	download the <code class="directive">AuthDBMGroupFile</code> unless
	otherwise protected.</p>

	<p>Combining Group and Password DBM files: In some cases it is
	easier to manage a single database which contains both the
	password and group details for each user. This simplifies any
	support programs that need to be written: they now only have to
	deal with writing to and locking a single DBM file. This can be
	accomplished by first setting the group and password files to
	point to the same DBM:</p>

	<div class="example"><p><code>
	AuthDBMGroupFile /www/userbase<br />
	AuthDBMUserFile /www/userbase
	</code></p></div>

	<p>The key for the single DBM is the username. The value consists
	of</p>

	<div class="example"><p><code>
	<var>Unix Crypt-ed Password</var>:<var>List of Groups</var>[:(ignored)]
	</code></p></div>

	<p>The password section contains the encrypted password as before.
	This is followed by a colon and the comma separated list of groups.
	Other data may optionally be left in the DBM file after another colon;
	it is ignored by the authentication module. This is what
	www.telescope.org uses for its combined password and group database.</p>

	</div>
	<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
	<div class="directive-section"><h2><a name="AuthDBMType" id="AuthDBMType">AuthDBMType</a> <a name="authdbmtype" id="authdbmtype">Directive</a></h2>
	<table class="directive">
	<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets the type of database file that is used to
	store passwords</td></tr>
	<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthDBMType default\|SDBM\|GDBM\|NDBM\|DB</code></td></tr>
	<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthDBMType default</code></td></tr>
	<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
	<tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
	<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
	<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_dbm</td></tr>
	<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in version 2.0.30 and later.</td></tr>
	</table>
	<p>Sets the type of database file that is used to store the passwords.
	The default database type is determined at compile time. The
	availability of other types of database files also depends on
	<a href="../install.html#dbm">compile-time settings</a>.</p>

	<p>It is crucial that whatever program you use to create your password
	files is configured to use the same type of database.</p>

	</div>
	<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
	<div class="directive-section"><h2><a name="AuthDBMUserFile" id="AuthDBMUserFile">AuthDBMUserFile</a> <a name="authdbmuserfile" id="authdbmuserfile">Directive</a></h2>
	<table class="directive">
	<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets thename of a database file containing the list of users and
	passwords for authentication</td></tr>
	<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthDBMUserFile <var>file-path</var></code></td></tr>
	<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
	<tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
	<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
	<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_dbm</td></tr>
	</table>
	<p>The <code class="directive">AuthDBMUserFile</code> directive sets the
	name of a DBM file containing the list of users and passwords for
	user authentication. <var>File-path</var> is the absolute path to
	the user file.</p>

	<p>The user file is keyed on the username. The value for a user is
	the encrypted password, optionally followed by a colon and arbitrary
	data. The colon and the data following it will be ignored by the
	server.</p>

	<div class="warning"><h3>Security:</h3>
	<p>Make sure that the <code class="directive">AuthDBMUserFile</code> is stored
	outside the document tree of the web-server; do <em>not</em> put it in
	the directory that it protects. Otherwise, clients will be able to
	download the <code class="directive">AuthDBMUserFile</code>.</p>
	</div>

	<p>Important compatibility note: The implementation of
	"dbmopen" in the apache modules reads the string length of the
	hashed values from the DBM data structures, rather than relying
	upon the string being NULL-appended. Some applications, such as
	the Netscape web server, rely upon the string being
	NULL-appended, so if you are having trouble using DBM files
	interchangeably between applications this may be a part of the
	problem.</p>

	<p>A perl script called
	<code class="program"><a href="../programs/dbmmanage.html">dbmmanage</a></code> is included with
	Apache. This program can be used to create and update DBM
	format password files for use with this module.</p>

	</div>
	</div>
	<div class="bottomlang">
	<p><span>Available Languages: </span><a href="../en/mod/mod_auth_dbm.html" title="English"> en </a></p>
	</div><div id="footer">
	<p class="apache">Copyright 2013 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
	<p class="menu"><a href="../mod/">Modules</a> \| <a href="../mod/directives.html">Directives</a> \| <a href="../faq/">FAQ</a> \| <a href="../glossary.html">Glossary</a> \| <a href="../sitemap.html">Sitemap</a></p></div>
	</body></html>