Apache Authentication by IP and Password at the Same Time

Linux / By /

If you like to restrict access to a directory on your Apache web server to users from a fixed IP range without password, and the rest of the world with password authentication the httpd.conf section can look like this for Apache-2.2:

<Directory "/var/www/htdocs/protected">
  AuthType Basic
  AuthName "Protected Area"
  AuthUserFile /etc/apache/passwd
  Require valid-user

  Order deny,allow
  Allow from 80.80.80.0/24
  Deny from all

  Satisfy any
</Directory>

For apache-2.4 the syntax has changed to:

<Directory "/var/www/htdocs/protected">
  AuthType Basic
  AuthName "Protected Area"
  AuthUserFile /etc/apache/passwd
  
  <RequireAny>
     Require valid-user
     Require ip 80.80.80.0/24
  </RequireAny>
</Directory>