Apache basic authentication except for those Allowed

Question

Problem: I have some files under /var/www/files/ that I want them to be accessed from specific IP addresses WITHOUT requiring user/password. However, I would like that any other IP address SHOULD require login to gain access.

This is in my httpd.conf:

<Directory /var/www/files/>
        Order deny,allow
        Deny from all
        Allow from 192.168 
        AuthUserFile /etc/apache2/basic.pwd 
        AuthName "Please enter username and password" 
        AuthType Basic 
        Require user valid-user 
</Directory>

But, if I understood correctly, this means that any client coming from 192.168.* will have access to that directory BUT will require a valid-user to view its content. And any other IP address will be denied. right?

Thank you in advance.

Answer 1

This is how it's done for Apache 2.4+ (since Satisfy Any is no longer supported).

<Directory /var/www/files/>

    AuthType Basic
    AuthName "Please enter your username and password"
    AuthUserFile /var/www/files/.htpasswd

    <RequireAny>
      Require ip 22.33.44.55
      Require valid-user
    </RequireAny>

</Directory>

If you want to require both IP address -and- Login/Password, change <RequireAny> to <RequireAll>

I hope this helps someone - as it took me a while to figure it out.