Apache Request IP Based Security

I run an Apache server on my home system that I've made available over the internet as I'm not always at my home system.

Naturally I don't want all my home server files public, so until now I've simply had:

Order allow, deny
Deny from all
Allow from 127.0.0.1

in my core configuration and just Allow from all in the htaccess of any directories I wanted publicly viewable.

However I've decided a better system would be to centralise all the access control and just require authentication (HTTP basic) for requests not to 127.0.0.1/localhost.

Is this achievable with Apache/modules? If so how would I go about it?

Cheers.

From serverfault connec

• Set up another <VirtualHost> that uses auth instead.

  Or just set up a SSH tunnel to the system and connect to that.

  From Ignacio Vazquez-Abrams

• The basic password authentication will do what you want. However, the authentication tokens pass in clear text on an http connection. You probably should require https for remote connections. This is also available.

  Using an ssh tunnel will also do what you want.

  You may find that port 80 is blocked if you are outside your ISPs network.

  I generally configure access without a password from the LAN and add security as required outside the LAN.

  connec : Your last point sounds more like what I'm looking for, how have you implemented this?

  BillThor : The follow lines will do it. I only allow logins on https sessions. Allow from 192.168. /* lan address */ Require valid-user /* Otherwise if logged in */ AuthType Basic /* Enable authorization */ AuthName "My Login Window" /* Name for login */ AuthUserFile /etc/apsche2/userfile /* user database */
  From BillThor

• @BillThor

  I have added

  Order deny,allow
  Allow from 127.0.0.1
  
  Require valid-user
  AuthType Basic
  AuthName "The Name"
  AuthUserFile "/the_user_file"
  

  To my root htdocs folder, but I still need to login when visiting from my local machine, which is what I was hoping to avoid.

  Minty : By the way, this is 'connec' on my new account :)
  From Minty