My modest-sized web server was recently upgraded. There were problems
with access control, fairly well documented and fairly easily fixed.
Authentication, on the other hand, acts as if it's not there -- anyone
and everyone is let into the few parts that used to be controlled. So
I have them offline for now. I don't see any writeups of problems
with this, so perhaps the way I solved access control borked the
authentication.
I have everything in /var/www and /www, and the authenticated parts
are in /www, with a Directory stanza containing authentication info
for each of the two (but apache is apparently ignoring them). I don't
have /srv. Authentication is by a simple text file with less than 100
entries.
Does anyone have a similar setup in apache 2.4 that works? Care to share how?