2

I have a Debian 9 server with two static IPv4 addresses. One of them is public and the other one is in the server's VPN subnet (the machine is running an OpenVPN server).

There is a DNS server in the VPN subnet that handles internal name resolution with an own TLD. So both of these IPs have a domain name associated to them (let's call them public.domain and private.domain).

My Apache2 server has two VirtualHosts, one for each domain. There is a non-indexed subdirectory inside the document root that contains private data. What I want to do is password-protect this subdirectory when called from the public, but not require any authentication when accessed over the VPN address.

This is my public VirtualHost configuration:

<VirtualHost public.domain:443>

    [...]

    <Directory /path/to/private/directory>
        AuthType Basic
        AuthName "Private Data"
        AuthUserFile /etc/apache2/.htpasswd
        Require valid-user
    </Directory>

</VirtualHost>

And this is my private VirtualHost configuration:

<VirtualHost private.domain:443>

    [...]

    <Directory /path/to/private/directory>
        AuthType None
    </Directory>

</VirtualHost>

As it turns out, this configuration is not working properly:

  • When I call the protected directory over public.domain, everything still works fine and I can authenticate normally.
  • When I call it from private.domain I don't get asked for login credentials (which is what I wanted), but get a HTTP 403 Forbidden response (Which is obviously not what I wanted).

It seems like the <Directory> options in the two config files are interfering with each other. What am I doing wrong here? Or is this possible at all?

Many thanks in advance!

Improve this question
1
  • 1
    At first blush, I would think Apache would read just the first or last directory directive, however, wrapping them in different virtual hosts is a new twist. I am not sure if what you want can be done this way. It may be you need to use another method, one wrapped in PHP. Cheers!! – closetnoc May 26 '18 at 18:01
1

I just found a solution on my own.

I created two symlinks, both pointing to the desired folder. Then, I used one of them for the public VirtualHost and the other one for the private one. Works perfectly fine, just make sure to add Options FollowSymLinks in the <Directory> directives.

Improve this answer
4
  • 1
    Funny! I thought about symlinks then said Naaahhhhh... that won't work! I guess I should have spoken up anyway. Sorry. Thanks for sharing a solution. Cheers!! – closetnoc May 26 '18 at 21:02
  • To be honest, I didn't think it was going to work either. I probably just tried it because my main PC runs Windows - the OS where the most stupid solutions you could possibly think of turn out to work best ;) – Sandtler May 27 '18 at 23:02
  • 1
    Freaking Windows! Sometimes you have to run it, but I prefer Linux. I used to maintain windows years ago. It was okay. Just hacky and sometimes the simplest thing they make complicated. Cheers mate!! – closetnoc May 28 '18 at 1:14
  • I would have switches to Linux entirely many years ago if the major games and stuff like Adobe Creative Cloud were supported, just because I find it way more convenient. But that's an entirely different story and would require an own discussion. Cheers! ;) – Sandtler May 28 '18 at 18:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.