Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using nginx and when password protecting a directory and entering login detail, i'm 403'ed (:O)

        location ~ ^/documents {
        auth_basic            "Access restricted.";
#Old line.
#       auth_basic_user_file   /private/pass;
#New line.
       auth_basic_user_file   /var/www/;

pass file is like

thisID:thisPass: Hello comment!

Any tip?

share|improve this question
What does the error log show? – Dave Drager Aug 28 '09 at 17:37
2009/09/02 17:25:20 [error] 6471#0: *1 open() "/var/www/" failed (2: No such file or directory), client:, server:, request: "GET /documents/ HTTP/1.1", host: "" The file pass is there! Fack! – Gabriel A. Zorrilla Sep 2 '09 at 17:32
up vote 1 down vote accepted

Though it does not match you error you get...

pass file is like

thisID:thisPass: Hello comment!

Is assume that the password is actually encrypted? I think it should be; I doubt you can simply put a human-readable password in that password file.

If nginx expects encoded/encrypted passwords in that file, then it will never find a good match if the stored password is using another format. (To find a match, it will encode the password as typed in by the user, and compare that encoded input to the encoded password as known from the file.) And indeed, according to the documentation, Passwords must be encoded by function crypt(3). You can create the password file with the htpasswd program from Apache.

This still does not explain the actual error message, but when the password file holds the human-readable passwords, then this will surely yield a 402 Unauthorized or 403 Forbidden.

One can also create such encoded password online, on various websites.

share|improve this answer
No need to be encrypted. – Gabriel A. Zorrilla Sep 21 '09 at 13:49
I assume you're saying that nginx does not need an encrypted password? Or do you imply that encryption is not a requirement for you? (If nginx expects encrypted passwords in that file, then it will never find a good match if the password is not encrypted. And that surely seems to be the case, according to the documentation. See my updated answer.) – Arjan Sep 21 '09 at 17:50
WORD. Indeed, the password required must be encrypted, i used just plain text BUT, heh, now i cant encrypt it, do you know any tool (without installing Apache) to encrypt(3) the word? I'm generating under windows and with online tools and it's not working. "2009/10/13 20:12:42 [error] 4114#0: *5 user "USER": password mismatch..." – Gabriel A. Zorrilla Oct 13 '09 at 20:25

My experience struggling with this sort of thing is that when the computer tells you the file or directory is not there .... it's not there! :-)

Try looking for the file relative to the server root i.e.

auth_basic_user_file   /private/pass;
share|improve this answer
True: Since version 0.6.7 the filename path is relative to directory of nginx configuration file nginx.conf, but not to nginx prefix directory. -- – Arjan Sep 21 '09 at 20:59

I would imagine the location/file paths do not match up as intended. Are you sure the syntax is definitely correct with regards to file paths?

Also, does the server have read access to the password file in question?

share|improve this answer
1. Changed ownership to www-data:www-data, no luck. 2. Chmoed to 777, no luck. – Gabriel A. Zorrilla Aug 31 '09 at 17:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .