Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a VirtualHost in Apache which uses ServerAlias with a wildcard to match a lot of subdomains, like this:

    ServerAlias *

There are hundreds of subdomains which matches the alias, and now I want an authentication prompt for a specific subdomain:

How would one go about doing such a thing?

I have thought of creating a new VirtualHost for, but I would preferably like to avoid this, as it becomes a hassle once I want to add more domains like this.

share|improve this question

Depends how you have your directory structure (what's your VirtualDocumentRoot look like?), but this is probably a good situation for an .htaccess file in the site's directory looking something like this:

AuthType Basic
AuthName ""
AuthUserFile /var/www/
Require valid-user

Set up the .htpasswd file:

htpasswd -c /var/www/ username1
htpasswd /var/www/ username2

If possible, encrypt this traffic, too. Basic auth is sent through HTTP in cleartext, so it's a good idea to encrypt it with SSL.

share|improve this answer
Thanks for your reply! The DocumentRoot (i.e. /srv/www/htdocs/ is shared between all the subdomains. I am already familiar with how to configure the basic authentication, and I have tried the solution you propose. Unfortunately, it also requests authentication credentials when you try to access, and not just (which is what I want). Perhaps I didn't clarify this properly in my question. – paaleivind Mar 25 '11 at 15:02
@paaleivind Since you have a shared DocumentRoot, instead of using VirtualDocumentRoot (what's the point of having authentication on only one domain, when they all host the same files?), this won't work without reorganizing the directory structure; the only valid contexts for Require are .htaccess and <Directory>, both of which won't work with how you have things set up. More detail on what you're trying to accomplish with this setup would help. – Shane Madden Mar 25 '11 at 15:10
The sites and provide different content for the end-user, and are thus actually different sites, even though they share the same DocumentRoot and code. The client whose site is running on has now requested that we add basic authentication for their site, however we obviously do not want that for all of our other sites/clients. I've had suspicions that this might not be possible at all given the current directory structure, but I was hoping for a possible workaround, as these are the cards I've been dealt. – paaleivind Mar 25 '11 at 15:27
@paaleivind Ah, ok. Well, if it's possible, having the application do the authentication would probably be the best way to go. If that's not feasible, then setting up a separate VirtualHost is unfortunately probably your best option. – Shane Madden Mar 25 '11 at 15:33

I had the same Problem and solved it just by now.

Let's assume, you have two VirtualHosts "" and "" with shared Document Root "/path/to/your/web-root". You wan't people to be able to access without password but requiring a password for Then your configuration would be the following:

<Directory /path/to/your/web-root>

    Order Deny,Allow
    Deny From All

    SetEnvIf Host allowed
    Allow from env=allowed 

    AuthType Basic
    AuthName "Won't let you in, if you don't tell me your name and password"
    AuthUserFile /etc/apache2/htusers

    Require valid-user

    Satisfy Any
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.