I've the next htaccess, directory listing is enabled, however, if visit the directory the .htaccess file is within, there is no access control. wrong?

AuthName "Restricted Area"

AuthType Fundamental

AuthUserFile /home/xxx/.htpasswd

AuthGroupFile /dev/null

require valid-user

You have to type to the peak: RewriteEngine On

If that doesn't work, which means you might not have RewriteEngine whatsoever

Try getting rid of AuthGroupFile after that, possibly it's leading to trouble.

Anything else looks absolutely correct. One possibility is your copy of Apache does not possess the AuthConfig AllowOverrides enabled for the files. This could disable Auth* records in .htaccess.

The answer is the fact that I have to have AllowOverride All to permit .htaccess in the directory levels.

         <Directory /var/www/vhosts/localhost>

                Options Indexes FollowSymLinks

                 AllowOverride All