Apache configuration

[Bob Bell]

I'd like to restrict access to on Apache so that:

1) Access to the immediate contents of the directory "photo" are
   restricted to non-local IPs, except
2) Access is granted to "index.cgi", to use as the default, and
3) Access is granted to subdirectories of "photo"

I would have thought the following would have gotten me there:

<Directory "/var/www/html/photo/">
    order deny,allow
    deny from all
    allow from 10.0.0.
</Directory>

<Files "/var/www/html/photo/index.cgi">
    order allow,deny
    allow from all
</Files>

<Directory "/var/www/html/photo/*">
    order allow,deny
    allow from all
</Directory>


The preceding configuration does indeed deny access to the photo
directory itself, while permitting access to subdirectories.  However,
it fails to allow access to index.cgi.  The site works fine if I remove
the "deny" on photo, but then I've allowed access to some contents in
photo that I'd rather not.

Advice?  TIA.

-- 
Bob Bell <bobbell at zk3.dec.com>
-------------------------------------------------------------------------
 "Who is General Failure and why is he reading my hard disk?"
   -- Anonymous