2

I'm using nginx and when password protecting a directory and entering login detail, i'm 403'ed (:O)

        location ~ ^/documents {
        auth_basic            "Access restricted.";
#Old line.
#       auth_basic_user_file   /private/pass;
#New line.
       auth_basic_user_file   /var/www/site.com/private/pass;
}

pass file is like

thisID:thisPass: Hello comment!

Any tip?

2
  • What does the error log show? Aug 28, 2009 at 17:37
  • 2009/09/02 17:25:20 [error] 6471#0: *1 open() "/var/www/site.com/private/pass" failed (2: No such file or directory), client: 64.76.31.155, server: www.site.com, request: "GET /documents/ HTTP/1.1", host: "www.site.com" The file pass is there! Fack!
    – Gabriel
    Sep 2, 2009 at 17:32

3 Answers 3

1

Though it does not match you error you get...

pass file is like

thisID:thisPass: Hello comment!

Is assume that the password is actually encrypted? I think it should be; I doubt you can simply put a human-readable password in that password file.

If nginx expects encoded/encrypted passwords in that file, then it will never find a good match if the stored password is using another format. (To find a match, it will encode the password as typed in by the user, and compare that encoded input to the encoded password as known from the file.) And indeed, according to the documentation, Passwords must be encoded by function crypt(3). You can create the password file with the htpasswd program from Apache.

This still does not explain the actual error message, but when the password file holds the human-readable passwords, then this will surely yield a 402 Unauthorized or 403 Forbidden.

One can also create such encoded password online, on various websites.

3
  • No need to be encrypted.
    – Gabriel
    Sep 21, 2009 at 13:49
  • 1
    I assume you're saying that nginx does not need an encrypted password? Or do you imply that encryption is not a requirement for you? (If nginx expects encrypted passwords in that file, then it will never find a good match if the password is not encrypted. And that surely seems to be the case, according to the documentation. See my updated answer.)
    – Arjan
    Sep 21, 2009 at 17:50
  • WORD. Indeed, the password required must be encrypted, i used just plain text BUT, heh, now i cant encrypt it, do you know any tool (without installing Apache) to encrypt(3) the word? I'm generating under windows and with online tools and it's not working. "2009/10/13 20:12:42 [error] 4114#0: *5 user "USER": password mismatch..."
    – Gabriel
    Oct 13, 2009 at 20:25
1

My experience struggling with this sort of thing is that when the computer tells you the file or directory is not there .... it's not there! :-)

Try looking for the file relative to the server root i.e.

auth_basic_user_file   /private/pass;
1
  • True: Since version 0.6.7 the filename path is relative to directory of nginx configuration file nginx.conf, but not to nginx prefix directory. -- wiki.nginx.org/NginxHttpAuthBasicModule
    – Arjan
    Sep 21, 2009 at 20:59
0

I would imagine the location/file paths do not match up as intended. Are you sure the syntax is definitely correct with regards to file paths?

Also, does the server have read access to the password file in question?

1
  • 1. Changed ownership to www-data:www-data, no luck. 2. Chmoed to 777, no luck.
    – Gabriel
    Aug 31, 2009 at 17:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .