password and ip restriction in htaccess

Question

I am learning how to use htaccess.

1. First I want to try how to set up username and password for the following directory ~/public_html/55/m:

   ~/public_html/55/m$ ls -la
   total 24
   drwxr-xr-x 2 tim Domain^Users 4096 2011-12-16 21:39 .
   drwxr-xr-x 3 tim Domain^Users 4096 2011-12-16 21:42 ..
   -rwxr-xr-x 1 tim Domain^Users  271 2011-12-16 21:26 .htaccess
   -rwxr-xr-x 1 tim Domain^Users    8 2011-12-16 21:39 .htpasswd
   -rwxr-xr-x 1 tim Domain^Users  884 2011-12-16 20:02 index.html 
   

   I manually created two text files: .htaccess and .htpasswd. Their contents are

   ~/public_html/55/m$ cat .htaccess
   AuthUserFile /home/WIN/local/WIN/tim/public_html/55/m/.htpasswd
   AuthGroupFile /dev/null
   AuthName EnterPassword
   AuthType Basic
   
   Require valid-user
   
   ~/public_html/55/m$ cat .htpasswd
   tim:123
   

   But I can access the webpage without being asked to provide username and password. I wonder why?

2. Second I want to try how to restrict the ip range to access ~/public_html/55/n

   ~/public_html/55/n$ ls -la
   total 16
   drwxr-xr-x 2 tim Domain^Users 4096 2011-12-16 21:54 .
   drwxr-xr-x 4 tim Domain^Users 4096 2011-12-16 21:53 ..
   -rwxr-xr-x 1 tim Domain^Users  292 2011-12-16 21:53 .htaccess
   -rwxr-xr-x 1 tim Domain^Users  884 2011-12-16 21:53 index.html
   

   where I created manually the text file .htaccess whose content is:

   ~/public_html/55/n$ cat .htaccess 
   AuthUserFile /dev/null
   AuthGroupFile /dev/null
   AuthName AllowFromBlah
   AuthType Basic
   
   <limit GET>
   order  deny,allow
   deny from all
   allow from xxx.edu
   </Limit>
   

   But I can access the webpage from outside the specified ip range xxx.edu. I wonder why?

Thanks and regards!

Answer 1

Maybe .htaccess files for those directories are simply ignored using the AllowOverride directive in the virtual host configuration. From http://httpd.apache.org/docs/2.2/mod/core.html#allowoverride:

When this directive is set to None, then .htaccess files are completely ignored. In this case, the server will not even attempt to read .htaccess files in the filesystem.

EDIT: On Ubuntu configuration is based in /etc/apache2, other systems have their configuration based in /etc/httpd or another directory. The Ubuntu configuration for user home directories is handled by mods-available/userdir.conf which is enabled when linked into /etc/apache2/mods-enabled. It specifies home directories as /home/*/public_html. The php4.conf also references the same directories.