> WebRSH: Help: Options: Access Control:
WebRSH implements an independent access control mechanism, which is intended to integrate with the server's access control. It includes:
  1. The ability to restrict access by location (IP address of the accessing client).
  2. The ability to check that some user authorization transaction took place, by checking for the existence of the environment variable 'AUTH_TYPE'.
  3. The ability to restrict access only to some specified users. (However, WebRSH does not authenticate users by itself. It counts on the server to authenticate users and supply properly authenticated usernames.)

These built-in security features of WebRSH can be used to:

Before setting access control, it is recommended that you check for the existence of certain environment variables. To do that enter the command 'set' in the command field, and click 'Execute' (or click '[MORE]' from the Main Menu and then click 'set'). You should look for the following variables:

Location-Based Access Control
Location-based access control is completely disabled unless the 'Restrict Access by Location' box is checked. Once checked, WebRSH will be accessible only to hosts that match one of the masks in the 'Allowed Hosts' list and do not match any of the masks in the 'Denied Hosts' list. Masks are IP addresses (of the form x.x.x.x) which may contain the following wild card symbols: '*' stands for zero or more digits. '?' stands for one digit. In order for all this to work properly, the accessing host's IP address must be supplied by the server in the environment variable 'REMOTE_ADDR'.

Authorization Transaction Check
If the 'Check for User Authentication' box is checked, WebRSH will be accessible only if the environment variable 'AUTH_TYPE' exists and has a non-null value. If your server properly supplies this variable, it is recommended that you check this box. Otherwise, you should leave it unchecked. Note that this check doesn't provide much protection by itself, and a malicious client should be able to fool many servers into creating this variable. The main purpose of this check is to verify that the server indeed requires user authentication (under normal operation) and to alert you in case it does not.

User-Based Access Control
If the 'Allow Access Only to these Users' box is checked, then only users with usernames that appear in the proceeding list will be able to access WebRSH. You should check that your server properly supplies the username in the environment variable 'REMOTE_USER' (or 'AUTH_USER' if the server is WebSite) before checking this box.