Apache access control -- from allow/deny to require

Question

I'm trying to move my Apache access control directives from the older Order, Allow, and Deny to the newer Require. Unfortunately, I'm unable to think a new way after having used the old way for so long.

Basically, I'd like to deny access to everyone except a few IP addresses. Using the old format, I had:

Order Deny,Allow Deny from all Allow from 192.168.123.123 Allow from 123.123.123.123 

I think it should be something like:

Require all denied Require ip 192.168.123.123 Require ip 123.123.123.123 

This appears to work.

But I'm uncertain if I should be not think like the "old way". Perhaps I should be using RequireAll or RequireAny some how, or even if I should nest them.

Answer 1

You need to use Authorization Containers and Configuration Sections to set a default restriction and then provide access, for example:

<Directory "/"> Require all denied </Directory> <Directory "/path_to_document_root"> <RequireAny> Require ip 192.168.123.123 Require ip 123.123.123.123 </RequireAny> </Directory> 

For more information, read at least all of the Apache documentation for the authz_core module, and then also perhaps review the Apache documentation for configuration sections.