Nginx配置HTTP认证

Introduction

You can restrict access to your website or some parts of it by implementing a username/password authentication. Usernames and passwords are taken from a file created and populated by a password file creation tool, for example, apache2-utils.

HTTP Basic authentication can also be combined with other access restriction methods, for example restricting access by IP address or geographical location.

Prerequisites

• NGINX Plus or NGINX Open Source
• Password file creation utility such as apache2-utils (Debian, Ubuntu) or httpd-tools (RHEL/CentOS/Oracle Linux).

Creating a Password File

To create username-password pairs, use a password file creation utility, for example, apache2-utils or httpd-tools

1. Verify that apache2-utils (Debian, Ubuntu) or httpd-tools (RHEL/CentOS/Oracle Linux) is installed.

2. Create a password file and a first user. Run the htpasswd utility with the -c flag (to create a new file), the file pathname as the first argument, and the username as the second argument:

   $ sudo htpasswd -c /etc/apache2/.htpasswd user1
   

   Press Enter and type the password for user1 at the prompts.

3. Create additional user-password pairs. Omit the -c flag because the file already exists:

   $ sudo htpasswd /etc/apache2/.htpasswd user2
   

4. You can confirm that the file contains paired usernames and encrypted passwords:

   $ cat /etc/apache2/.htpasswd
   user1:$apr1$/woC1jnP$KAh0SsVn5qeSMjTtn0E9Q0
   user2:$apr1$QdR8fNLT$vbCEEzDj7LyqCMyNpSoBh/
   user3:$apr1$Mr5A0e.U$0j39Hp5FfxRkneklXaMrr/
   

Configuring NGINX and NGINX Plus for HTTP Basic Authentication

1. Inside a location that you are going to protect, specify the auth_basic directive and give a name to the password-protected area. The name of the area will be shown in the username/password dialog window when asking for credentials:

   location /api {
       auth_basic “Administrator’s Area”;
       #...
   }
   

2. Specify the auth_basic_user_file directive with a path to the .htpasswd file that contain user/password pairs:

   location /api {
       auth_basic           “Administrator’s Area”;
       auth_basic_user_file /etc/apache2/.htpasswd; 
   }
   

Alternatively, you you can limit access to the whole website with basic authentication but still make some website areas public. In this case, specify the off parameter of the auth_basic directive that cancels inheritance from upper configuration levels:

server {
    ...
    auth_basic           "Administrator’s Area";
    auth_basic_user_file conf/htpasswd;

    location /public/ {
        auth_basic off;
    }
}

Combining Basic Authentication with Access Restriction by IP Address

HTTP basic authentication can be effectively combined with access restriction by IP address. You can implement at least two scenarios:

• a user must be both authenticated and have a valid IP address
• a user must be either authenticated, or have a valid IP address

1. Allow or deny access from particular IP addresses with the allow and deny directives:

   location /api {
       #...
       deny  192.168.1.2;
       allow 192.168.1.1/24;
       allow 127.0.0.1;
       deny  all;
   }
   

   Access will be granted only for the 192.168.1.1/24 network excluding the 192.168.1.2 address. Note that the allow and deny directives will be applied in the order they are defined.

2. Combine restriction by IP and HTTP authentication with the satisfy directive. If you set the directive to to all, access is granted if a client satisfies both conditions. If you set the directive to any, access is granted if if a client satisfies at least one condition:

   location /api {
       #...
       satisfy all;    
   
       deny  192.168.1.2;
       allow 192.168.1.1/24;
       allow 127.0.0.1;
       deny  all;
   
       auth_basic           "Administrator’s Area";
       auth_basic_user_file conf/htpasswd;
   }
   

Complete Example

The example shows how to protect your status area with simple authentication combined with access restriction by IP address:

http {
    server {
        listen 192.168.1.23:8080;
        root   /usr/share/nginx/html;

        location /api {
            api;
            satisfy all;

            deny  192.168.1.2;
            allow 192.168.1.1/24;
            allow 127.0.0.1;
            deny  all;

            auth_basic           “Administrator’s area;
            auth_basic_user_file /etc/apache2/.htpasswd; 
        }
    }
}

When you access your status page, you are prompted to log in:

If the provided name and password do not match the password file, you get the 401 (Authorization Required) error.

取消HTTP验证则把auth_basic和auth_basic_user_file注销掉，运行命令nginx -s reload重启nginx服务即可。

官方文档：https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-http-basic-authentication/

春节概记

• 和小玲的第一个春节在深圳过，我很喜欢这种空城的感觉，平时都是人山人海，难得清静一下。
• 年前先是逛花市，接着找到了一个中意的房子，三房两厅，房东夫妻不错，指望着明年惠州的房子装修好来说不定地铁通了就可以住那里就不用租房了。
• 年饭简单，白切鸡和波士顿龙虾为主。
• 年初二和小玲各回各家，各找各妈。
• 年初三我们姐弟几个和外甥女们庆祝妈妈的六一大寿。
• 年初四汽车到广州，然后动车到遂溪，一路不晕车还不错。
• 接着在遂溪过了几天慵懒饭来张口的日子，参加了小玲的家族聚会，又开车兜风，摘草莓和黄色圣女果，接着公司又通知推迟一天上班，可以和小玲一起回深圳。
• 前天晚上烧烤，楼顶风大，昨天回广州时开始感冒。动车到广州南站，不应该出站，应该中转站溜进去到候车区，说不定可以硬上到深圳北的车，结果后面挪到广州东站，又只有几个小时后的站票了。
• 好几年没有感冒了，很久没有出现的感冒就流泪的情况这次又碰上了，左眼流泪不止，很是难受。小玲也腰酸背痛吃烧烤喉咙痛的，很是幸苦。
• 还好上了和谐号，一个乘务小姐让小玲坐到了保暖箱上面，旁边一个女人还叫我拿我的箱子给她坐，什么鬼，你自己有箱子干嘛不坐？我的箱子能坐我自己都坐了，身体不舒服懒得和她说那么多，不然我会多说几句。
• 仔细想想才发现为什么以前我还有点喜欢乡下，但是真要长住却又不敢，现在才明白，是因为乡下的人太闲，闲话太多，话语如剑乱杀人，让我觉得很可怕。还是喜欢城市里，大隐隐于市，各自安好做好自己家的事情，不用去操心别人。
• 今年的计划，考驾照，构思我一直想写的一本小说，带宝宝。