Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking at running an external service for clients to use here in my office while clients are working remotely at their office.

Assumptions: Both my office IP and clients office IP are static.

I wish to allow access to a service, for example an HTTP Basic Auth secured administration application, to my clients.

Is there a way in Apache Basic Auth or otherwise to create User @ IP based restrictions?

I would like:

  • me @ my_office
  • me @ my_home
  • client1 @ their_office1
  • client2 @ their_office2

For testing, I have attempted this code:

<Location />
    Satisfy All

    AuthType Basic
    AuthName "Authorisation"
    AuthUserFile /etc/apache2/passwd

    Order deny,allow
    Deny from all
    Allow from
    Require user me

    Order deny,allow
    Deny from all
    Allow from
    Require user client1
  • Testing with [me@] allowed access, success.
  • Testing with [client1@] allowed access, fail.
  • Testing with [client2@] dis-allowed access, success (client2 is in htpasswd file, but not specified in Require User).

Is there a known way of doing this using Apache Basic Auth?

Also, instead of receiving a "Forbidden" for a successful user/password from an unknown IP, is it possible to ask Apache to request the user details again?

share|improve this question
If this cannot be achieved, there is another solution: Run multiple virtualhosts, one per client, each with their own IP and Basic Auth restrictions. Maybe this would be cleaner? This would look like:, – Drew Anderson Oct 16 '12 at 11:17

If you're using Apache httpd 2.4, you can use the new , syntax to accomplish this.


  Require IP
  Require user me

  Require IP
  Require user client1


This kind of thing would be very difficult pre-2.4 without a custom auth handler.

share|improve this answer
I will have to try this when I can get my hands on Apache 2.4.x - thanks! – Drew Anderson Jun 18 '13 at 10:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.