Make Apache Require Both a Client IP and a Proxy Login

Combine Apache 2.4 proxy authentication and client-address restrictions without accidentally letting either requirement grant access on its own.

Use <RequireAll> when an Apache 2.4 forward proxy should require both the approved source address and a valid login:

<Proxy "*">
    AuthType Basic
    AuthName "Private proxy"
    AuthBasicProvider file
    AuthUserFile /etc/apache2/private-proxy-users
    <RequireAll>
        Require ip 192.0.2.25
        Require valid-user
    </RequireAll>
</Proxy>

Merge this authorization fragment into the existing restricted proxy. Replace the client address and account-file path; the authentication/authorization modules must be available and the file must already contain the intended users. It is not a complete listener deployment.

Two details determine the policy. The container expresses AND; placing positive requirements beside one another does not necessarily require all of them. Require valid-user accepts an authenticated account, while Require user alice names one account. A bare Require user expresses neither. See Apache's user authorization reference.

SourceLoginRequired result
AllowedValidThe intended authorized request is permitted.
AllowedMissing or invalidNo authorized forwarding.
Outside the allowed sourceValidNo authorized forwarding.

Review the enclosing virtual host and other matching authorization sections before relying on the fragment, then test the authorization boundary; more-specific configuration can change the effective result. Basic login also needs a protected client-to-proxy transport. Destination HTTPS begins later and cannot protect that earlier cleartext credential exchange.

Tënë sô zo