0

I need bypass basic auth to some ip, Apache is 2.4 and is behind haproxy, i have inserti this into Document Root section:

<Directory /path/to/webroot>
    AuthUserFile /etc/apache2/.htpasswd
    AuthType Basic
    AuthName "Restricted Content"
    <Limit GET>
        Require valid-user
    </Limit>
    Require ip xxx.xxx.xxx.xxx
    Satisfy any
</Directory>

But don't work, apache is behind a proxy, it probably will not work because the ip which comes to apache is the proxy and not the client

1

Enable and configure mod_remoteip. You proxy would set the original remote IP address in the header like X-Forwarded-For in HTTP requests. Pass it to RemoteIpHeader directive placed outside <Directory>.

If mod_remoteip works correctly, original remote addresses passed by the proxy can be seen with %a in LogFormat. You should first check this.

On Apache 2.4 Satisfy directive is deprecated. And you'd better not complicate authz conditions by adding unnecessary <Limit>.

Try with the following configuration:

RemoteIPHeader X-Forwarded-For

<Directory /path/to/webroot>
    AuthUserFile /etc/apache2/.htpasswd
    AuthType Basic
    AuthName "Restricted Content"
    Require valid-user
    Require ip xxx.xxx.xxx.xxx
</Directory>
  • I have enabled mod_remoteip and add the line to apache2.conf but don't work, the proxy is set correctly, if i add %{X-Forwarded-For}iin the LogFormat section, i see the correct external ip on the logs – hellb0y77 Jul 30 '15 at 12:48
  • Updated. Please check if %a in LogFormat also tells original remote addresses. – yaegashi Jul 30 '15 at 13:41
  • Yes, if i place %a i have the right ip to logs, i have edit my apache exactly like you have type but don't ask password when access with another ip not trusted – hellb0y77 Jul 30 '15 at 14:18
  • Well, just a guess, but have you restarted your browser? It might hold credentials you entered earlier in the session. – yaegashi Jul 30 '15 at 14:32
  • Yes, isn't no problem of cache, i never enter with password, is not in cache – hellb0y77 Jul 30 '15 at 14:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.