Nginx How to properly password protect a directory or file?

Thanks, that was the problem. Now it works.

---

 

I've been using your vhost generator on the main centminmod site that provides directory pass protect and password/user generator, but this time when I try to log into my admin page, it asks me for my user and password like normal, but whenever I enter them (double checked for accuracy) it processes them and immediately asks for them again.

Any ideas on what's causing that?

 

Yes, that's the one.

This is for a individual site on a fresh centmin install.

I've only ran that command once.

 

Ah. So that was my problem. What I kept trying to do was remove the admin_php file from the conf directory and redo the command. This sorted out the issue.

As always, your guidance is much appreciated.

 

Great feature I never knew existed. The password.sh script is excellent. Added it to my personal Centmin Mod Setup Guide.

Code:

##################################################
#### PASSWORD SETUP FOR FILES AND DIRECTORIES
##################################################

Information must be entered into the vhost file which points to where the passwords are located.
Setup passwords for directories - opcache, admin directories... etc.  See SERVER - Password Protect

Centmin Mod Docs
https://community.centminmod.com/threads/how-to-properly-password-protect-a-directory-or-file.579/

Nginx Docs
http://nginx.org/en/docs/http/ngx_http_auth_basic_module.html

Use the provided script to setup protection.
/usr/local/nginx/conf/htpasswd.sh

Create password file and populate with password.
Add word or number after htpasswd for multiple password files.
Create = creates a new file, overwrites an existing file.
Append = appends an existing file - adds a new user:password line in file.
# /usr/local/nginx/conf/htpasswd.sh {create|append} /usr/local/nginx/conf/htpasswd user1 pass1

Add the location block to your vhost config file.
The example below also only permits certain IP addresses from access.
Remove two allow lines and one deny line to premit all IP access.

Example Root Directory
location ~ ^/ {
  auth_basic "Private";
  auth_basic_user_file /usr/local/nginx/conf/htpasswd;
  include /usr/local/nginx/conf/php.conf;
  allow 127.0.0.1;
  allow YOURIPADDRESS;
  deny all;
}

Example Specific file
location /admin.php {
  auth_basic "Private";
  auth_basic_user_file /usr/local/nginx/conf/htpasswd;
  include /usr/local/nginx/conf/php.conf;
  allow 127.0.0.1;
  allow YOURIPADDRESS;
  deny all;
}

Restart Nginx and PHP-FPM for changes to take effect.
# service nginx restart
# service php-fpm restart

 

I can't get this working on the local virtual.conf for the life of me. Trying to lock down the default.

I first created the password file.

Code:

# /usr/local/nginx/conf/htpasswd.sh {create|append} /usr/local/nginx/conf/htpasswd_local localserver1 pass1

The above gives me htpasswd_local = localserver1:sdlkhljkashdfjklhsadjfklhaskljdfh

I edited the /usr/local/nginx/conf/conf.d/virtual.conf below with the information. I also put it inside the location / and above the location / as a test.

Restarted nginx and php every time I made a change.

No matter what I do, what browser I use, it doesn't accept the password. I remove the password block, site works fine.

Code:

server {
#         listen   80;
            listen   80 default_server backlog=2048 reuseport;
            server_name server1.mydomain.com;
            root   html;

        access_log              /var/log/nginx/localhost.access.log     main_ext buffer=256k flush=5m;
        error_log               /var/log/nginx/localhost.error.log    error;

# ngx_pagespeed & ngx_pagespeed handler
#include /usr/local/nginx/conf/pagespeed.conf;
#include /usr/local/nginx/conf/pagespeedhandler.conf;
#include /usr/local/nginx/conf/pagespeedstatslog.conf;

# limit_conn limit_per_ip 16;
# ssi  on;

    location /nginx_status {
        stub_status on;
        access_log   off;
        allow 127.0.0.1;
        #allow youripaddress;
        deny all;
        }

            location / {

# block common exploits, sql injections etc
#include /usr/local/nginx/conf/block.conf;





#               Enables directory listings when index file not found
#               autoindex  on;

#               Shows file listing times as local time
#               autoindex_localtime on;

#               Enable for vBulletin usage WITHOUT vbSEO installed
#               try_files               $uri $uri/ /index.php;


}

location ~ ^/ {
  auth_basic "Private";
  auth_basic_user_file /usr/local/nginx/conf/htpasswd_local;
  include /usr/local/nginx/conf/php.conf;
}

        # example nginx-http-concat
        # /csstest/??one.css,two.css
        #location /csstest {
        #concat on;
        #concat_max_files 20;
        #}

include /usr/local/nginx/conf/staticfiles.conf;
include /usr/local/nginx/conf/include_opcache.conf;
include /usr/local/nginx/conf/php.conf;
#include /usr/local/nginx/conf/phpstatus.conf;
include /usr/local/nginx/conf/drop.conf;
#include /usr/local/nginx/conf/errorpage.conf;
include /usr/local/nginx/conf/vts_mainserver.conf;

       }

 

I did, I was trying it everywhere.

I just had the two lines in the location / ... above, below, with php.conf, without... it's own location... I figured this would be simple, instead I've been trying for about an hour.

 

I even tried it shorter passwords, usernames, different htpasswd files and the basic htpasswd file. Chmod the file to 777... I can't believe this is so hard.

Double, triple checked the password file so I wasn't making a copy paste error. Every time not accepting the password.

Different browsers, incog mode, privacy mode...

 

The memcached and opcache - working fine.

 

Every time.

 

This is what I have right now, less the default includes at the bottom. Also tried it wo/ the php.conf - just the two lines.

Code:

server {
#         listen   80;
            listen   80 default_server backlog=2048 reuseport;
            server_name server1.zeronug.com;
            root   html;

        access_log              /var/log/nginx/localhost.access.log     main_ext buffer=256k flush=5m;
        error_log               /var/log/nginx/localhost.error.log    error;


# ngx_pagespeed & ngx_pagespeed handler
#include /usr/local/nginx/conf/pagespeed.conf;
#include /usr/local/nginx/conf/pagespeedhandler.conf;
#include /usr/local/nginx/conf/pagespeedstatslog.conf;

# limit_conn limit_per_ip 16;
# ssi  on;

    location /nginx_status {
        stub_status on;
        access_log   off;
        allow 127.0.0.1;
        #allow youripaddress;
        deny all;
        }

            location / {

# block common exploits, sql injections etc
#include /usr/local/nginx/conf/block.conf;



#               Enables directory listings when index file not found
#               autoindex  on;

#               Shows file listing times as local time
#               autoindex_localtime on;

#               Enable for vBulletin usage WITHOUT vbSEO installed
#               try_files               $uri $uri/ /index.php;


auth_basic "Private";
  auth_basic_user_file /usr/local/nginx/conf/htpasswd;
  include /usr/local/nginx/conf/php.conf;

}



        # example nginx-http-concat
        # /csstest/??one.css,two.css
        #location /csstest {
        #concat on;
        #concat_max_files 20;
        #}

 

Everything matches and I get the same curl output as you. So, I know it's seeing the file.

He's some weirdness.

I take the username and password from the opcache password file and use it in the htpasswd_local file and have no issues. Switch it back to the one I generated with the htpasswd.sh file and it doesn't work.

Cleared out the browser completely and tested it a couple of times. I made sure to delete any passwords stored, etc.

Also tried to remove any special characters, etc. from the password, no luck.

 

Did the user / password combo work?

I don't have a problem with it's asking for the password, it's that the u/p combo doesn't work.