apache virtualhost conf file and authorizations - apache

Question

Here is my conf file:
<VirtualHost *:80>
ServerAdmin r0dy#r0dy.net
ServerName mtc.r0dy.net
ServerAlias www.mtc.r0dy.net
DocumentRoot /var/www/mtc
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>
<Directory /var/www/mtc>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Order allow,deny
Allow from all
</Directory>
<Directory /var/www/mtc/bo>
AuthName "Restricted Area: BackOffice"
AuthType Basic
AuthUserFile /var/www/mtc/bo/.htpasswd
# AuthGroupFile /dev/null
require valid-user
</Directory>
ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
<Directory "/usr/lib/cgi-bin">
AllowOverride None
Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
Order allow,deny
Allow from all
</Directory>
ErrorLog ${APACHE_LOG_DIR}/error.log
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
LogLevel warn
CustomLog ${APACHE_LOG_DIR}/access.log combined
Alias /doc/ "/usr/share/doc/"
<Directory "/usr/share/doc/">
Options Indexes MultiViews FollowSymLinks
AllowOverride None
Order deny,allow
Deny from all
Allow from 127.0.0.0/255.0.0.0 ::1/128
</Directory>
</VirtualHost>
When i comment out the <Directory /var/www/mtc/bo> part, it doesnt ask for credentials.
When i uncomment it, if i browse to this directory, it asks for credentials and it works fine.
My problem is that is asks for credentials even if i don't go to the /bo/ directory, i just browse to http://mtc.r0dy.net/ and i'm blocked.
Any idea on what i did wrong ?

Answer 1

In case anyone has the same problem, i solved it by adding Allow directives in my directories :
<Directory />
Options FollowSymLinks
#AllowOverride None
Order allow,deny
Allow from all
</Directory>
<Directory /var/www/mtc>
Options Indexes FollowSymLinks MultiViews
#AllowOverride None
Order allow,deny
Allow from all
</Directory>
<Directory /var/www/mtc/bo>
Order allow,deny
Allow from all
AuthName "Restricted Area: BackOffice"
AuthType Basic
AuthUserFile /var/www/mtc/bo/.htpasswd
# AuthGroupFile /dev/null
require valid-user
</Directory>
I don't understand why it works with the allow directives and behaves strangely without, but it works fine now. If anyone has the explaination you're welcome.