Something like below works for me with apache 2.2. I took it from http://httpd.apache.org/docs/2.2/mod/core.html#require
<Directory /www/docs>
AuthType Basic
AuthName Documents
AuthBasicProvider file
AuthUserFile /usr/local/apache/passwd/passwords
Require valid-user
</Directory>
<Directory /www/docs/public>
# All access controls and authentication are disabled
# in this directory
Satisfy Any
Allow from all
</Directory>
与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…