Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There are many examples showing how to use .htaccess to restrict users by login or on their IP address (i.e they are ok from the ones given without authorisation). For some reason the following is never mentioned, yet it seems quite useful.

How do I restrict using groups and ip, e.g.

group1 can access the page from anywhere group2 can access the page only from certain IP addresses if you are not logged on, you cant see the page, regardless where you are

I would like to have all 3 of these working at the same time.

share|improve this question
What do you mean by a Group? – Kyle Brandt Nov 6 '09 at 18:06
AuthGroupFile ? – Kyle Brandt Nov 6 '09 at 18:08
Yes, "normal" AuthGroupFile which contains users and a password file for them. – Rob Nov 6 '09 at 18:12
i.e. I have a .htgroup file along the lines of group1: user1 user2 group2: user3 user4 Not overly concerned how it deals with overlaps, i.e. if you are in group1 and group2 in example above, then happy that you can see page from anywhere (slightly ambiguous wording above). – Rob Nov 6 '09 at 18:16

The thing you are looking for is Satisfy Any

share|improve this answer
As mentioned in my question, there are plenty of examples (using Satisfy Any), but I dont know (or whether) I can construct something for my purpose. – Rob Nov 6 '09 at 19:55

What you probably want (assuming you're running Apache) is something like mod_auth_pam (currently unmaintained) or mod_auth_ldap. Both of these provide functionality to use your standard authentication groups as criteria in .htaccess or other Apache config files. That way you're not maintaining an apache-only group config file somewhere, like AuthGroupFile forces you to do.

Plus, both of these options should be available as packages in all major distros.

share|improve this answer
I am using an external domain host (BT), so cant modify much. "Normal" .htaccess seems to work fine, not sure what I can do beyond though. Was hoping that .htaccess can do it on its own (or in conjunction with .htgroup and passwd files). – Rob Nov 6 '09 at 18:41
Oh, if you just want your own htgroup file, and to not use the system groups, then the normal AuthGroupFile usage is what you want. – Graeme Nov 6 '09 at 19:27
But how do I construct the .htaccess file to do what I want, i.e. some users from anywhere, others from a certain IP, but all users need to login? – Rob Nov 6 '09 at 20:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.