Ygtjki

Why can Carol Danvers change her suit colours in the first place?

Using substitution ciphers to generate new alphabets in a novel

Multiplicative persistence

How much character growth crosses the line into breaking the character

The IT department bottlenecks progress. How should I handle this?

Do the primes contain an infinite almost arithmetic progression?

Recommended PCB layout understanding - ADM2572 datasheet

Does IPv6 have similar concept of network mask?

Mixing PEX brands

When were female captains banned from Starfleet?

Why is this estimator biased?

Is there a way to get `mathscr' with lower case letters in pdfLaTeX?

Can I say "fingers" when referring to toes?

I'm the sea and the sun

Can a Canadian Travel to the USA twice, less than 180 days each time?

Why Shazam when there is already Superman?

What should you do if you miss a job interview (deliberately)?

How does the math work for Perception checks?

What are the advantages of simplicial model categories over non-simplicial ones?

How to explain what's wrong with this application of the chain rule?

What should you do when eye contact makes your subordinate uncomfortable?

Why did the EU agree to delay the Brexit deadline?

What exact color does ozone gas have?

Can I still be respawned if I die by falling off the map?

Apache 2.4 wants me to decide: Require valid ip or require valid user

2

2

Apache 2.4 seems to mixed all : IP denying and user denying are not working independent anymore..

In older versions I am able to enable the two things, and work with it without one affecting the other, for example:

deny from all 
allow from ip1
allow from ip2 

In apache2.4 the equivalent is:

require ip1 
require ip2

Until this point, all is good.

But when you have htacess+htpasswd in your website, the behavior is not as you expected because it thinks that the required ips are trusted to enter without password, anulating the htacess, and even worst, ips out of the desired list are able thanks to htacess to try to login with a password and that is not what apache 2.2 do!

In the ancient apache the hosts on allow from are the only that can try to authenticate... and even if they are allowed, it still will need a password from htaccess to open the website.

UPDATE:

I am able to workaround the behavior using the mod_acess_compat for now... but i think this is not a solution, as i am using the ancient commands on the apache 2.4... and i am afraid about some unexpected behavior or the deprecation of this module...

apache-httpd

share|improve this question

edited Jan 4 at 14:30

Luciano Andress Martini

asked Dec 27 '17 at 18:29

Luciano Andress MartiniLuciano Andress Martini

4,0951136

add a comment | 

2

2

Apache 2.4 seems to mixed all : IP denying and user denying are not working independent anymore..

In older versions I am able to enable the two things, and work with it without one affecting the other, for example:

deny from all 
allow from ip1
allow from ip2 

In apache2.4 the equivalent is:

require ip1 
require ip2

Until this point, all is good.

But when you have htacess+htpasswd in your website, the behavior is not as you expected because it thinks that the required ips are trusted to enter without password, anulating the htacess, and even worst, ips out of the desired list are able thanks to htacess to try to login with a password and that is not what apache 2.2 do!

In the ancient apache the hosts on allow from are the only that can try to authenticate... and even if they are allowed, it still will need a password from htaccess to open the website.

UPDATE:

I am able to workaround the behavior using the mod_acess_compat for now... but i think this is not a solution, as i am using the ancient commands on the apache 2.4... and i am afraid about some unexpected behavior or the deprecation of this module...

apache-httpd

share|improve this question

edited Jan 4 at 14:30

Luciano Andress Martini

asked Dec 27 '17 at 18:29

Luciano Andress MartiniLuciano Andress Martini

4,0951136

add a comment | 

Apache 2.4 seems to mixed all : IP denying and user denying are not working independent anymore..

In older versions I am able to enable the two things, and work with it without one affecting the other, for example:

deny from all 
allow from ip1
allow from ip2 

In apache2.4 the equivalent is:

require ip1 
require ip2

Until this point, all is good.

But when you have htacess+htpasswd in your website, the behavior is not as you expected because it thinks that the required ips are trusted to enter without password, anulating the htacess, and even worst, ips out of the desired list are able thanks to htacess to try to login with a password and that is not what apache 2.2 do!

In the ancient apache the hosts on allow from are the only that can try to authenticate... and even if they are allowed, it still will need a password from htaccess to open the website.

UPDATE:

I am able to workaround the behavior using the mod_acess_compat for now... but i think this is not a solution, as i am using the ancient commands on the apache 2.4... and i am afraid about some unexpected behavior or the deprecation of this module...

apache-httpd

share|improve this question

edited Jan 4 at 14:30

Luciano Andress Martini

asked Dec 27 '17 at 18:29

Luciano Andress MartiniLuciano Andress Martini

4,0951136

deny from all 
allow from ip1
allow from ip2 

require ip1 
require ip2

share|improve this question

edited Jan 4 at 14:30

Luciano Andress Martini

asked Dec 27 '17 at 18:29

Luciano Andress MartiniLuciano Andress Martini

4,0951136

share|improve this question

edited Jan 4 at 14:30

Luciano Andress Martini

asked Dec 27 '17 at 18:29

Luciano Andress MartiniLuciano Andress Martini

4,0951136

asked Dec 27 '17 at 18:29

Luciano Andress MartiniLuciano Andress Martini

4,0951136

asked Dec 27 '17 at 18:29

Luciano Andress MartiniLuciano Andress Martini

4,0951136

1 Answer
1

active

oldest

votes

7

It sounds like what you want would be something like this:

<RequireAll>
 <RequireAny>
 Require ip1
 Require ip2
 </RequireAny>
 Require valid-user
</RequireAll>

share|improve this answer

edited yesterday

Luciano Andress Martini

4,0951136

answered Dec 27 '17 at 18:57

ShadurShadur

20k74658

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  ... In that case, please try to reword your question, because if this isn't the correct answer then I'm no longer sure if I've understood your question correctly. You can use any combination of RequireAll and RequireAny directives nested in order to get what you want, but I recommend not using more than once source for auth -- either in the virtualhost stanza, or in a .htaccess.
  
  – Shadur
  Dec 27 '17 at 20:18
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  In that case you'd want both. A RequireAny for the list of IPs, nested within a RequireAll together with a valid-user.
  
  – Shadur
  Dec 28 '17 at 11:21
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thank you very much, i will give a try, with that example, is more easy for me a not english speaker understand how require all and require any works, because for me any and all are very close words... when i try to translate it... using a dictionary for example.... but i think i understand the difference now, require any is very like to have a or condition beetween the requirements and require all a and condition beetween the requirements.
  
  – Luciano Andress Martini
  Dec 28 '17 at 11:24
  
  

  
  
  
  

add a comment | 

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f413309%2fapache-2-4-wants-me-to-decide-require-valid-ip-or-require-valid-user%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

7

It sounds like what you want would be something like this:

<RequireAll>
 <RequireAny>
 Require ip1
 Require ip2
 </RequireAny>
 Require valid-user
</RequireAll>

share|improve this answer

edited yesterday

Luciano Andress Martini

4,0951136

answered Dec 27 '17 at 18:57

ShadurShadur

20k74658

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  ... In that case, please try to reword your question, because if this isn't the correct answer then I'm no longer sure if I've understood your question correctly. You can use any combination of RequireAll and RequireAny directives nested in order to get what you want, but I recommend not using more than once source for auth -- either in the virtualhost stanza, or in a .htaccess.
  
  – Shadur
  Dec 27 '17 at 20:18
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  In that case you'd want both. A RequireAny for the list of IPs, nested within a RequireAll together with a valid-user.
  
  – Shadur
  Dec 28 '17 at 11:21
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thank you very much, i will give a try, with that example, is more easy for me a not english speaker understand how require all and require any works, because for me any and all are very close words... when i try to translate it... using a dictionary for example.... but i think i understand the difference now, require any is very like to have a or condition beetween the requirements and require all a and condition beetween the requirements.
  
  – Luciano Andress Martini
  Dec 28 '17 at 11:24
  
  

  
  
  
  

add a comment | 

7

It sounds like what you want would be something like this:

<RequireAll>
 <RequireAny>
 Require ip1
 Require ip2
 </RequireAny>
 Require valid-user
</RequireAll>

share|improve this answer

edited yesterday

Luciano Andress Martini

4,0951136

answered Dec 27 '17 at 18:57

ShadurShadur

20k74658

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  ... In that case, please try to reword your question, because if this isn't the correct answer then I'm no longer sure if I've understood your question correctly. You can use any combination of RequireAll and RequireAny directives nested in order to get what you want, but I recommend not using more than once source for auth -- either in the virtualhost stanza, or in a .htaccess.
  
  – Shadur
  Dec 27 '17 at 20:18
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  In that case you'd want both. A RequireAny for the list of IPs, nested within a RequireAll together with a valid-user.
  
  – Shadur
  Dec 28 '17 at 11:21
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thank you very much, i will give a try, with that example, is more easy for me a not english speaker understand how require all and require any works, because for me any and all are very close words... when i try to translate it... using a dictionary for example.... but i think i understand the difference now, require any is very like to have a or condition beetween the requirements and require all a and condition beetween the requirements.
  
  – Luciano Andress Martini
  Dec 28 '17 at 11:24
  
  

  
  
  
  

add a comment | 

It sounds like what you want would be something like this:

<RequireAll>
 <RequireAny>
 Require ip1
 Require ip2
 </RequireAny>
 Require valid-user
</RequireAll>

share|improve this answer

edited yesterday

Luciano Andress Martini

4,0951136

answered Dec 27 '17 at 18:57

ShadurShadur

20k74658

<RequireAll>
 <RequireAny>
 Require ip1
 Require ip2
 </RequireAny>
 Require valid-user
</RequireAll>

share|improve this answer

edited yesterday

Luciano Andress Martini

4,0951136

answered Dec 27 '17 at 18:57

ShadurShadur

20k74658

edited yesterday

Luciano Andress Martini

4,0951136

edited yesterday

Luciano Andress Martini

4,0951136

answered Dec 27 '17 at 18:57

ShadurShadur

20k74658

answered Dec 27 '17 at 18:57

ShadurShadur

20k74658