It seems that you can’t configure Apache to support the anonymous-clone authenticated-push scenario over the http-backend.

http://git.661346.n2.nabble.com/git-http-backend-and-Authenticated-Pushes-tp4703506p4703506.html

Fortunately the situations where I need anonymous access are rather limited (TeamCity does not support authentication over http for git). I was able to solve it by serving repositories without authentication under a different url like so:

ScriptAlias /git/ “C:/Progra~1/Git/libexec/git-core/git-http-backend.exe/”
ScriptAlias /_git/ “C:/Progra~1/Git/libexec/git-core/git-http-backend.exe/”

This after figuring out how to make TeamCity accept our selfsigned certificate.