Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm using nginx and when password protecting a directory and entering login detail, i'm 403'ed (:O)

        location ~ ^/documents {
        auth_basic            "Access restricted.";
#Old line.
#       auth_basic_user_file   /private/pass;
#New line.
       auth_basic_user_file   /var/www/site.com/private/pass;
}

pass file is like

thisID:thisPass: Hello comment!

Any tip?

share|improve this question
    
What does the error log show? –  Dave Drager Aug 28 '09 at 17:37
    
2009/09/02 17:25:20 [error] 6471#0: *1 open() "/var/www/site.com/private/pass" failed (2: No such file or directory), client: 64.76.31.155, server: www.site.com, request: "GET /documents/ HTTP/1.1", host: "www.site.com" The file pass is there! Fack! –  Gabriel A. Zorrilla Sep 2 '09 at 17:32

3 Answers 3

up vote 1 down vote accepted

Though it does not match you error you get...

pass file is like

thisID:thisPass: Hello comment!

Is assume that the password is actually encrypted? I think it should be; I doubt you can simply put a human-readable password in that password file.

If nginx expects encoded/encrypted passwords in that file, then it will never find a good match if the stored password is using another format. (To find a match, it will encode the password as typed in by the user, and compare that encoded input to the encoded password as known from the file.) And indeed, according to the documentation, Passwords must be encoded by function crypt(3). You can create the password file with the htpasswd program from Apache.

This still does not explain the actual error message, but when the password file holds the human-readable passwords, then this will surely yield a 402 Unauthorized or 403 Forbidden.

One can also create such encoded password online, on various websites.

share|improve this answer
    
No need to be encrypted. –  Gabriel A. Zorrilla Sep 21 '09 at 13:49
1  
I assume you're saying that nginx does not need an encrypted password? Or do you imply that encryption is not a requirement for you? (If nginx expects encrypted passwords in that file, then it will never find a good match if the password is not encrypted. And that surely seems to be the case, according to the documentation. See my updated answer.) –  Arjan Sep 21 '09 at 17:50
    
WORD. Indeed, the password required must be encrypted, i used just plain text BUT, heh, now i cant encrypt it, do you know any tool (without installing Apache) to encrypt(3) the word? I'm generating under windows and with online tools and it's not working. "2009/10/13 20:12:42 [error] 4114#0: *5 user "USER": password mismatch..." –  Gabriel A. Zorrilla Oct 13 '09 at 20:25

My experience struggling with this sort of thing is that when the computer tells you the file or directory is not there .... it's not there! :-)

Try looking for the file relative to the server root i.e.

auth_basic_user_file   /private/pass;
share|improve this answer
    
True: Since version 0.6.7 the filename path is relative to directory of nginx configuration file nginx.conf, but not to nginx prefix directory. -- wiki.nginx.org/NginxHttpAuthBasicModule –  Arjan Sep 21 '09 at 20:59

I would imagine the location/file paths do not match up as intended. Are you sure the syntax is definitely correct with regards to file paths?

Also, does the server have read access to the password file in question?

share|improve this answer
    
1. Changed ownership to www-data:www-data, no luck. 2. Chmoed to 777, no luck. –  Gabriel A. Zorrilla Aug 31 '09 at 17:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.