I have a Debian 9 server with two static IPv4 addresses. One of them is public and the other one is in the server's VPN subnet (the machine is running an OpenVPN server).
There is a DNS server in the VPN subnet that handles internal name resolution with an own TLD. So both of these IPs have a domain name associated to them (let's call them public.domain
and private.domain
).
My Apache2 server has two VirtualHosts, one for each domain. There is a non-indexed subdirectory inside the document root that contains private data. What I want to do is password-protect this subdirectory when called from the public, but not require any authentication when accessed over the VPN address.
This is my public VirtualHost configuration:
<VirtualHost public.domain:443>
[...]
<Directory /path/to/private/directory>
AuthType Basic
AuthName "Private Data"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user
</Directory>
</VirtualHost>
And this is my private VirtualHost configuration:
<VirtualHost private.domain:443>
[...]
<Directory /path/to/private/directory>
AuthType None
</Directory>
</VirtualHost>
As it turns out, this configuration is not working properly:
- When I call the protected directory over
public.domain
, everything still works fine and I can authenticate normally. - When I call it from
private.domain
I don't get asked for login credentials (which is what I wanted), but get aHTTP 403 Forbidden
response (Which is obviously not what I wanted).
It seems like the <Directory>
options in the two config files are interfering with each other. What am I doing wrong here? Or is this possible at all?
Many thanks in advance!