From a17754f641e52c883a150dcb5dc5416910398b09 Mon Sep 17 00:00:00 2001 From: tfasano1 Date: Wed, 30 Jun 2021 20:25:11 -0400 Subject: added basic auth tutorial (with svg haha) --- auth.html | 131 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 131 insertions(+) create mode 100644 auth.html (limited to 'auth.html') diff --git a/auth.html b/auth.html new file mode 100644 index 0000000..72ef15e --- /dev/null +++ b/auth.html @@ -0,0 +1,131 @@ + + + + HTTP Basic Authentication + + + + + + + +

Access Control with HTTP Basic Auth

+ +
+ access control with nginx +

HTTP basic authentication will allow you to secure parts (or all) of your website with a user name and password without the trouble of php or javascript.

+ +

Installation

+

We will be using the command htpasswd to make username and password pairs.

+ 
apt install apache2-utils
+ + +

+ Now think of a username and password and remember them. +

+ + 
htpasswd -c /etc/apache2/myusers username
+ +

+ Type out your password twice to confirm. You can do this as many times as you'd like. +

+

Check out user name password pairs:

+ 
cat /etc/apache2/myusers
+ +

Nginx Config and Auth Basic

+

+ From here, we are going to edit our websites config file in /etc/nginx/sites-enabled. + Have in mind which folder you'd like to secure. Add something like this: +

+ + 
server {
+    #...
+    location /secret-folder  {
+        auth_basic "What's the Password?" ;
+        auth_basic_user_file /etc/apache2/myusers ;
+    }
+    #...
+}
+ + +

If you'd like to do the opposite, such as making the entire site private except for a public section, do this:

+ 
server {
+    #...
+    auth_basic "What's the Password?" ;
+    auth_basic_user_file /etc/apache2/myusers ;
+    location /public/ {
+        #...
+        auth_basic off ;
+    }
+    #...
+}
+

IP Addresses

+

If passwords aren't enough we can ban an ip or accept one.

+ 
location /api {
+    #...
+    allow 192.168.1.23:8080 ;
+    deny 127.0.0.1 ;
+}
+

If you want to check both a username and password with an ip address, use the satisfy directive.

+ 
location /api {
+    #...
+    satify all ;
+
+    allow 192.168.1.23:8080 ;
+    deny 127.0.0.1 ;
+
+    auth_basic "What's the Password?" ;
+    auth_basic_user_file /etc/apache2/myusers ;
+}
+

Complete Example

+ 
http {
+    server {
+        listen 80;
+        root /var/www/website ;
+
+        #...
+        location /secret-folder {
+            satisfy all ;
+
+            allow 192.168.1.3/24;
+            deny 127.0.0.1 ;
+
+            auth_basic "What's the Password?" ;
+            auth_basic_user_file /etc/apache2/myusers ;
+        }
+    }
+}
+ +

+ Now check your configuration with nginx -t +

+ +

Reload nginx and you're good to go!

+ + + + + + + + + + + + Contributor - tomfasano.xyz + + +
+ + + -- cgit v1.2.3