Site Authentication by IP Address

[YorkshireSteve]

Hi All,

Can I add Apache authentication to a website but so it's only required if the user isn't on the local network?

We don't want the website(s) to be visible to the outside world unless the user logs in, but we don't want to keep logging in when accessing them on the internal network.

Is there a way in which this can be done? We have full access to all Apache's config files and the server. Apache is v1.3, running on Windows 2000 (running as a testing server).

Thanks,

Steve.

[gergoe]

You could use the Satisfy directive [httpd.apache.org] together with mod_access and mod_auth. The scenario is simple; you'll restrict the access by ip address for the root directory, so only the local ip addresses are allowed to see the website:

Order Allow,Deny
Allow 192.168.0.0/24

...when you're done with this, you'll setup the user authentication so *all* users must have authenticate themselves. And finally you specify with the Satisfy directive that anyone matching one of these conditions are eligible to view the page (Satisfy any). People from your local network can see the pages because of their ip address, and people from outside of your network can see it because they can authenticate themselves.

[YorkshireSteve]

Fantastic - Works a treat!

I did try

Satisfy any

earlier, but entered the IP as 10.10.1.* instead of just 10.10.1

Cheers matey!