Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is there a simple way to set Apache directives that would:

  1. Allow access without password from specified IP
  2. Ask for password from any other IP

I'm looking for a way to achieve this by editing the directives, not by advanced configuration such as setting up new handlers.

I've tried the configuration suggested by Apache documentation and another forum post but it just seems to allow all access regardless of IP. The configuration I've tried is this:

AuthType Basic
AuthName "Restricted"
AuthUserFile /etc/apache2/restricted_htpasswd
Require valid-user
Allow from [IP]
Satisfy Any

Should this work? (where [IP] is of course the actual IP)

share|improve this question

2 Answers 2

up vote 5 down vote accepted

I've done this before, and it took forever to figure out. Here's how I did it:

# Requires a valid user unless 
# logged in from a specific IP address
Order deny,allow
Deny from all
AuthName "Keep out"
AuthUserFile "/path/to/your/passwd/file"
AuthType Basic
Require valid-user
Allow from 192.0.32.10 
Satisfy Any

What this will do is allow access if the user provides authentication OR is from the specified IP. The key is "satisfy any", which tells it that it must meet any of those conditions, not all of them. You can also specify an IP range, for example, Allow from 192.0.0.0/16.

share|improve this answer
    
After re-reading your question, it looks like this is very similar to what you originally posted. Perhaps the order has some affect on it? –  nhinkle Aug 28 '10 at 7:09
    
Worked! Thanks! The key seems to have been the "Deny from all" directive. –  Ilari Kajaste Aug 28 '10 at 19:33
    
Glad you got it figured out! –  nhinkle Aug 29 '10 at 0:20

Update: Give this a try...

AuthType Basic
AuthName "Restricted"
AuthUserFile /etc/apache2/restricted_htpasswd
Require valid-user

Order deny,allow
Deny from all
Allow from [IP]

Satisfy any

(Strike prior comments, misread question)

share|improve this answer
    
(Prior comments striked.) Thanks, it was the "Deny from all" that was missing from me. –  Ilari Kajaste Aug 28 '10 at 19:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.