Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a list of "internal" IP-addresses and only allow access to the server (Location /) from that list:

<Location />
    Require ip x.x.x.x
    Require ip y.y.y.y

I need to further restrict access to a sub-directory (Location /foo) to authenticated users (Require valid-user).

Whatever I do, I never get prompted for login to access /foo -- Apache simply grants me access, because my IP-address is on the list (for Location /).

I cycled through all three different values of AuthMerging (off, and, or) to no avail... Must be something really stupid :-/ Using httpd-2.4.6. Thank you!

share|improve this question
Sounds like you need to set up this: – Vasili Syrakis May 29 '14 at 4:43
For one, Vasili, the link you gave is for Apache-2.2, where auth mechanisms are quite different from 2.4. And then, of course, I've already read the 2.4 page on the subject -- to no avail. It is too basic and does not cover my case. – Mikhail T. May 30 '14 at 23:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.