0

I need bypass basic auth to some ip, Apache is 2.4 and is behind haproxy, i have inserti this into Document Root section:

<Directory /path/to/webroot>
    AuthUserFile /etc/apache2/.htpasswd
    AuthType Basic
    AuthName "Restricted Content"
    <Limit GET>
        Require valid-user
    </Limit>
    Require ip xxx.xxx.xxx.xxx
    Satisfy any
</Directory>

But don't work, apache is behind a proxy, it probably will not work because the ip which comes to apache is the proxy and not the client

1 Answer 1

2

Enable and configure mod_remoteip. You proxy would set the original remote IP address in the header like X-Forwarded-For in HTTP requests. Pass it to RemoteIpHeader directive placed outside <Directory>.

If mod_remoteip works correctly, original remote addresses passed by the proxy can be seen with %a in LogFormat. You should first check this.

On Apache 2.4 Satisfy directive is deprecated. And you'd better not complicate authz conditions by adding unnecessary <Limit>.

Try with the following configuration:

RemoteIPHeader X-Forwarded-For

<Directory /path/to/webroot>
    AuthUserFile /etc/apache2/.htpasswd
    AuthType Basic
    AuthName "Restricted Content"
    Require valid-user
    Require ip xxx.xxx.xxx.xxx
</Directory>
7
  • I have enabled mod_remoteip and add the line to apache2.conf but don't work, the proxy is set correctly, if i add %{X-Forwarded-For}iin the LogFormat section, i see the correct external ip on the logs
    – stecog
    Jul 30, 2015 at 12:48
  • Updated. Please check if %a in LogFormat also tells original remote addresses.
    – yaegashi
    Jul 30, 2015 at 13:41
  • Yes, if i place %a i have the right ip to logs, i have edit my apache exactly like you have type but don't ask password when access with another ip not trusted
    – stecog
    Jul 30, 2015 at 14:18
  • Well, just a guess, but have you restarted your browser? It might hold credentials you entered earlier in the session.
    – yaegashi
    Jul 30, 2015 at 14:32
  • Yes, isn't no problem of cache, i never enter with password, is not in cache
    – stecog
    Jul 30, 2015 at 14:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .