Nginx How to properly password protect a directory or file?

Update FAQ item 43 outlines how to password protect directories and files.


Same as outlined at Nginx and vBulletin Connect 5 Vhost and PHP-FPM - PHP Warning: require(): Unable to allocate memory for pool. Also official documentation Module ngx_http_auth_basic_module

Use htpasswd.py script at /usr/local/nginx/conf/htpasswd.py to setup username and password using following command:

Code:

python /usr/local/nginx/conf/htpasswd.py -b /usr/local/nginx/conf/htpasswd yourusername yourpassword

change /usr/local/nginx/conf/htpasswd filename and path for your unique filename and yourusername and yourpassword to unique values of your own

or use the htpasswd.sh script i wrote in post 28 in this thread

Code:

wget -O /usr/local/nginx/conf/htpasswd.sh https://gist.githubusercontent.com/centminmod/3068afbed67d5fe5e2dd/raw
chmod +x /usr/local/nginx/conf/htpasswd.sh

Code:

/usr/local/nginx/conf/htpasswd.sh

/usr/local/nginx/conf/htpasswd.sh {create|append} /usr/local/nginx/conf/htpasswd user1 pass1

 

yeah can run the command anywhere and if you want separate user/pass files need to have different filenames from /usr/local/nginx/conf/htpasswd

i.e.

/usr/local/nginx/conf/htpasswd_install
/usr/local/nginx/conf/htpasswd_admin

 

Code:

  location ~ ^/(admin.php) {
     include /usr/local/nginx/conf/php.conf;
     auth_basic "Private";
     auth_basic_user_file /usr/local/nginx/conf/htpasswd_admin_php;
        }

 

because locations usually match directories not files with the way you had it before

 

No idea, that shouldn't really happen .. try it in private browser session with no session cookies etc

 

I tried with the htpasswd as well as htpasswd_admin_php file both do not accept incomplete missing characters for usernames but do for passwords !

Code:

  location ~ ^/(admin.php) {
     include /usr/local/nginx/conf/php.conf;
     auth_basic "Private";
     auth_basic_user_file /usr/local/nginx/conf/htpasswd;
        }

Code:

  location ~ ^/(admin.php) {
     include /usr/local/nginx/conf/php.conf;
     auth_basic "Private";
     auth_basic_user_file /usr/local/nginx/conf/htpasswd_admin_php;
        }

 

only solution is ensure proper randomised passwords http://strongpasswordgenerator.com

i.e.

Code:

L[waQKjFkycI*G7b