Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am looking at running an external service for clients to use here in my office while clients are working remotely at their office.

Assumptions: Both my office IP and clients office IP are static.

I wish to allow access to a service, for example an HTTP Basic Auth secured administration application, to my clients.

Is there a way in Apache Basic Auth or otherwise to create User @ IP based restrictions?

I would like:

  • me @ my_office
  • me @ my_home
  • client1 @ their_office1
  • client2 @ their_office2

For testing, I have attempted this code:

<Location />
    Satisfy All

    AuthType Basic
    AuthName "Authorisation"
    AuthUserFile /etc/apache2/passwd

    Order deny,allow
    Deny from all
    Allow from 10.0.0.1/32
    Require user me

    Order deny,allow
    Deny from all
    Allow from 10.0.0.2/32
    Require user client1
</Location>
  • Testing with [me@10.0.0.1] allowed access, success.
  • Testing with [client1@10.0.0.1] allowed access, fail.
  • Testing with [client2@10.0.0.1] dis-allowed access, success (client2 is in htpasswd file, but not specified in Require User).

Is there a known way of doing this using Apache Basic Auth?

Also, instead of receiving a "Forbidden" for a successful user/password from an unknown IP, is it possible to ask Apache to request the user details again?

share|improve this question
    
If this cannot be achieved, there is another solution: Run multiple virtualhosts, one per client, each with their own IP and Basic Auth restrictions. Maybe this would be cleaner? This would look like: client1.service.example.com, client2.service.example.com. –  Drew Anderson Oct 16 '12 at 11:17
add comment

1 Answer

If you're using Apache httpd 2.4, you can use the new , syntax to accomplish this.

<RequireAny>

<RequireAll>
  Require IP 10.0.0.1/32
  Require user me
</RequireAll>

<RequireAll>
  Require IP 10.0.0.2/32
  Require user client1
</RequireAll>

</RequireAny>

This kind of thing would be very difficult pre-2.4 without a custom auth handler.

share|improve this answer
    
I will have to try this when I can get my hands on Apache 2.4.x - thanks! –  Drew Anderson Jun 18 '13 at 10:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.