I have a Debian 9 server with two static IPv4 addresses. One of them is public and the other one is in the server's VPN subnet (the machine is running an OpenVPN server).
There is a DNS server in the VPN subnet that handles internal name resolution with an own TLD. So both of these IPs have a domain name associated to them (let's call them
My Apache2 server has two VirtualHosts, one for each domain. There is a non-indexed subdirectory inside the document root that contains private data. What I want to do is password-protect this subdirectory when called from the public, but not require any authentication when accessed over the VPN address.
This is my public VirtualHost configuration:
<VirtualHost public.domain:443> [...] <Directory /path/to/private/directory> AuthType Basic AuthName "Private Data" AuthUserFile /etc/apache2/.htpasswd Require valid-user </Directory> </VirtualHost>
And this is my private VirtualHost configuration:
<VirtualHost private.domain:443> [...] <Directory /path/to/private/directory> AuthType None </Directory> </VirtualHost>
As it turns out, this configuration is not working properly:
- When I call the protected directory over
public.domain, everything still works fine and I can authenticate normally.
- When I call it from
private.domainI don't get asked for login credentials (which is what I wanted), but get a
HTTP 403 Forbiddenresponse (Which is obviously not what I wanted).
It seems like the
<Directory> options in the two config files are interfering with each other. What am I doing wrong here? Or is this possible at all?
Many thanks in advance!