如何为外部查看者密码保护VHost？

Question

I have been struggling with this problem for some time now. Let me break it down:

We have an apache2 server which hosts most of our company's websites. Each website is a separate vhost. One of this vhosts is used by our internal UI Designer to present his latest drafts and projects to both internal users and 3rd party clients. At the moment, this VHost is password protected from the Vhost configuration file using this directive:

<Directory /var/www/>
   Options Indexes FollowSymLinks MultiViews
   AllowOverride all
   Order allow,deny
   Allow from all
   AuthUserFile /home/secure/passwords
   AuthName "Username and password required"
   AuthType Basic
   Require valid-user
</Directory>

What I need is to make this website available (so NO password prompt) to our internal users meaning a specific IP range. I have tried to use the Allow from 192.168.xxx.xxx option in the above instruction set. However this is not letting the internal IP through (still asking for a password). So I tried to use our company's external IP address (which you can find on any "what's my IP website"). No luck with that either.

So for my last attempt, I have created a second vhost which obviously uses a different ServerName. Also, in order not to have any conflicts in the configuration file, I have created a symlink to /var/www and called it www2. Therefore, the Directory directive in the second vhost file looks like this:

<Directory /var/www2/>
   Options Indexes FollowSymLinks MultiViews
   AllowOverride none
   Order allow,deny
   Allow from all
</Directory>

However the configuration files are clearly conflicting because with the current configuration I get password protection on both hosts. If I disable this in the first Vhost, I lose it on both.

There is no .htaccess file in any of the directories, so there is nothing there to overwrite the configuration. The apache2.conf file has nothing defined related to Auth.

I'm not sure if you require more details, but feel free to ask me anything.

I appreciate the help!

----edit---- I just want to specify that I can't say 100% that my method of doing it is the correct one. Maybe setting up 2 VHosts isn't the solution to my problem. If anyone thinks of a better way of doing it, I'm open to suggestions. Bottom line is that I need one website to be available to internal users and password protected for anyone else.

Cheers!

Answer 1

have you tried to solve this using Satisfy Directive of Apache? For example:

  <Directory /var/www/>
   Options Indexes FollowSymLinks MultiViews
   AllowOverride all
   Order allow,deny
   Allow from all
   AuthUserFile /home/secure/passwords
   AuthName "Username and password required"
   AuthType Basic
   Require valid-user

   Allow from 192.168.1
   Satisfy Any 
  </Directory>

More information can be found here