4

NB: This is not a duplicate, as the flagged post deals with older versions of apache. I've tried the solutions in that thread, also the one supposed to work on later versions, without success.

There are several questions and answers that deals with parts of this, but I haven't found exactly this type of situation.

I have a web site which I want to be openly accessible from my 10.0.0.0 network. But when accessing it from via the external address forwarded in the router - I want .htaccess to require a login.

I know how to require password for all connections, and I have an idea about allowing/disallowing a specific address or IP. But I want ALL IPs that are not on the LAN to need a login/password.

Update: Apache2 version 2.2.22

Here's what happens when I try the solution from the answer that someone claims this is a duplicate of:

AuthName "Authenticate"
AuthType Basic
AuthUserFile "/home/frank/.htpassword"
Require valid-user
Order allow,deny
Allow from 10.0.0.44
Satisfy All

With the above .htaccess file, access through the external address is denied, period. No login prompt. From the specific local IP (.44), I get the login prompt.

AuthName "Authenticate"
AuthType Basic
AuthUserFile "/home/frank/.htpassword"
Require valid-user
Order allow,deny
Allow from 10.0.0.0/8
Satisfy All

With the above, both external and internal connections are prompted with login.

Trying to narrow the problem down:

This does not work: (both the external an LAN addresses are allowed)

Order Deny,Allow
Deny from all
Allow from 10.0.0.0/8

Thi works: (the exernal address gets access denied, while the LAN does not)

Order Deny,Allow
Deny from all
Allow from 10.0.0.44

UPDATE: Am I missing something fundamental here?

When I try this:

Order Deny,Allow
Deny from all

Everything is denied, both from the LAN and the external address.

However, when I try this:

Order Deny,Allow
Allow from 127.0.0.1

Everything is allowed, both from the LAN and the external address.

Is the problem in the way I'm trying to access from the eternal address? The nameserver of the domain "mydomain.no" points to the router. I have forwarded the domain "mydomain.no" in the router's virtual servers. Traffic on port 80 is routed to the server running the apache2 installation. What I want is all traffic coming via the address "mydomain.no" (and any other domains forwarded to the same server) to required a password. Traffic from inside the LAN should not require a password.

2
4

I'm assuming you are using Apache 2.4, for Apache 2.2 the syntax is different.

You can add multiple Require directives:

AuthName "Authenticate"
AuthType Basic
AuthUserFile "/var/www/html/.htpasswd"
<RequireAny>
   Require valid-user
   Require ip 10.0.0
</RequireAny>

Technically you don't even need the <RequireAny>, apache will use it implicitly when it is not there, but I find it is easier to read that way.

The equivalent for apache 2.2:

AuthName "Authenticate"
AuthType Basic
AuthUserFile "/var/www/html/.htpasswd"
Require valid-user
Order allow,deny
Allow from 10.0.0
Satisfy any
1
  • Ups. My bad. My Apache2 version is actually 2.2.22, not 2.4. Strange, then, that the old answer doesn't work. I've updated with the tests from the post that someone claims this is a duplicate of. – knoten Mar 9 '17 at 9:21
1

Removed my own answer as it was incorrect and possibly confusing for others asking the same question.

6
  • Your "solution" allows access from anywhere except the given ip address, where it prompts for a password. That's not what you asked. – Gerald Schneider Mar 9 '17 at 10:17
  • I just now read your addition about your setup. Yes, your setup is unusual, that's why the "normal" configurations don't work for you. It would have been a lot easier if you had described that from the start. – Gerald Schneider Mar 9 '17 at 10:24
  • Out of curiosity: What's unusual about the setup? – knoten Mar 9 '17 at 11:03
  • 1
    Usually such servers are in a DMZ. – Gerald Schneider Mar 9 '17 at 11:08
  • Good point. But as long as the server has a local address, won't it still get all traffic via the first router in the network (the one before the DMZ)? – knoten Mar 9 '17 at 11:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.