Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We have a list of "internal" IP-addresses and only allow access to the server (Location /) from that list:

<Location />
    Require ip x.x.x.x
    Require ip y.y.y.y

I need to further restrict access to a sub-directory (Location /foo) to authenticated users (Require valid-user).

Whatever I do, I never get prompted for login to access /foo -- Apache simply grants me access, because my IP-address is on the list (for Location /).

I cycled through all three different values of AuthMerging (off, and, or) to no avail... Must be something really stupid :-/ Using httpd-2.4.6. Thank you!

share|improve this question
Sounds like you need to set up this: httpd.apache.org/docs/2.2/howto/auth.html –  Vasili Syrakis May 29 '14 at 4:43
For one, Vasili, the link you gave is for Apache-2.2, where auth mechanisms are quite different from 2.4. And then, of course, I've already read the 2.4 page on the subject -- to no avail. It is too basic and does not cover my case. –  Mikhail T. May 30 '14 at 23:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.