Hack The Sec-Leading Resource Of Linux Tutorial: HTTP

<div dir="ltr" style="text-align: left;" trbidi="on">
<h1 class="entry-title" itemprop="headline" style="background-color: #fdfdfd; box-sizing: border-box; font-family: proxima-nova, 'Helvetica Neue', Helvetica, Arial, sans-serif; line-height: 1.1; margin: 21px 0px 0px;">
<span style="color: #660000; font-size: x-large;"><u><i>HTTP authentication with Nginx on Ubuntu</i></u></span></h1>
<div>
<span style="font-family: "georgia" , "times new roman" , serif;"><span style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px;">HTTP supports the use of several authentication mechanisms to control access to pages and other resources. These mechanisms are all based around the use of the 401 status code and the <b>WWW-Authenticate</b> response header.</span><span style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px;"> HTTP authentication is the simplest technique for enforcing access controls to web resources because it does not require session identifiers, login pages and cookies. It uses a static HTTP header which means that no handshakes have to be done in anticipation.</span></span></div>
<div>
<h2 style="background-color: #fdfdfd; box-sizing: border-box; font-family: proxima-nova, 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 32px; font-weight: 500; line-height: 1.1; margin-bottom: 10.5px; margin-top: 21px;">
<span style="box-sizing: border-box;"><span style="color: #0b5394;"><u>Basic Requirements</u></span></span></h2>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="box-sizing: border-box;"><span style="font-family: "georgia" , "times new roman" , serif;">In order to setup <b>HTTP authentication</b> with Nginx, you must have an installed operating system with Ubuntu and <b>Nginx </b>web server setup.</span></span></div>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="box-sizing: border-box;"><span style="font-family: "georgia" , "times new roman" , serif;">Here is the status of our base operating system and Nginx version where we are going to configure HTTP authentication in the next steps.</span></span></div>
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCVyLS8xJvGBONNb7N96SVE9vyTFl5UabBb6oYBQCYStZMPhVRtj7rvLpGqGmQUff_KfH2q7LDGQy_QBe86CwUnu7GAYFWcMpykr6-bHcThQwBuGOdwtJuRN_-eJejb0xKGAlWxLLqA2Qe/s1600/Basic+Requirements_www.hackthesec.co.in.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCVyLS8xJvGBONNb7N96SVE9vyTFl5UabBb6oYBQCYStZMPhVRtj7rvLpGqGmQUff_KfH2q7LDGQy_QBe86CwUnu7GAYFWcMpykr6-bHcThQwBuGOdwtJuRN_-eJejb0xKGAlWxLLqA2Qe/s1600/Basic+Requirements_www.hackthesec.co.in.png" /></a></div>
<div>
<h2 style="background-color: #fdfdfd; box-sizing: border-box; font-family: proxima-nova, 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 32px; font-weight: 500; line-height: 1.1; margin-bottom: 10.5px; margin-top: 21px;">
<span style="box-sizing: border-box;"><span style="color: #0b5394;"><u>Installing Required Packages</u></span></span></h2>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="box-sizing: border-box;"><span style="font-family: "georgia" , "times new roman" , serif;">To set up HTTP Authentication for a directory, we will use the `htpasswd`command to create an encrypted user and password. So to make this command available, we have to install the following package for Ubuntu.</span></span></div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; line-height: 1.42857; margin-bottom: 10.5px; overflow: auto; padding: 10px; word-break: break-all; word-wrap: break-word;"><span style="box-sizing: border-box;"><span style="font-size: large;">root@ubuntu-14:~# apt-get install apache2-utils</span></span></pre>
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-j_xi-Hhe5yW5tHhD8oN7QeGDkLRr-Tc3TzzC7IICtN9al8GcKjf8o-vsU_ILeEj7ksCJ2hcZxS2MYVMXp6cV8jDznI8a7ZrByquLWfvsRUNgsZ3T7nlKt7pox2sdsemUoL9m0XaI0wxk/s1600/packges_installation_www.hackthesec.co.in.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-j_xi-Hhe5yW5tHhD8oN7QeGDkLRr-Tc3TzzC7IICtN9al8GcKjf8o-vsU_ILeEj7ksCJ2hcZxS2MYVMXp6cV8jDznI8a7ZrByquLWfvsRUNgsZ3T7nlKt7pox2sdsemUoL9m0XaI0wxk/s1600/packges_installation_www.hackthesec.co.in.png" /></a></div>
<div>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="box-sizing: border-box;"><span style="font-family: "georgia" , "times new roman" , serif;">Once we have the package installed, we can confirm if it exists in the system or not with the help of `which` command as shown below.</span></span></div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; line-height: 1.42857; margin-bottom: 10.5px; overflow: auto; padding: 10px; word-break: break-all; word-wrap: break-word;"><span style="font-size: large;"><span style="box-sizing: border-box;">root@ubuntu-14:~# which htpasswd</span>

<span style="box-sizing: border-box;">/usr/bin/htpasswd</span></span></pre>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="box-sizing: border-box;"><span style="font-family: "georgia" , "times new roman" , serif;">Now, we can proceed with the creation of our `<b>.htpasswd</b>` file which will contain the information about the username and the password.</span></span></div>
<h2 style="background-color: #fdfdfd; box-sizing: border-box; font-family: proxima-nova, 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 32px; font-weight: 500; line-height: 1.1; margin-bottom: 10.5px; margin-top: 21px;">
<span style="box-sizing: border-box;"><span style="color: #0b5394;"><u>Creating User and Password</u></span></span></h2>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="box-sizing: border-box;"><span style="font-family: "georgia" , "times new roman" , serif;">Here we will create a `<b>.htpasswd</b>` file under the document root directory of our virtual host or website being served by Nginx. Let’s run the following command that will create the file and add the user with an encrypted password.</span></span></div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; line-height: 1.42857; margin-bottom: 10.5px; overflow: auto; padding: 10px; word-break: break-all; word-wrap: break-word;"><span style="box-sizing: border-box;"><span style="font-size: large;">root@ubuntu-14:~# htpasswd -c /etc/nginx/.htpasswd testuser</span></span></pre>
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiVW17xmzge_IJln7Rlctu5l5kT3iFkzkj5WhD2SoDbs7uWGnQaK2PAc1MgVNKgxtE5eWCDNDDiKMQo66q4t5yx2X2pAhe9nHPSS1vi6xHfEp6KE-IPnKMiG_gN9JZFYH5DV7xBxXSdnkSN/s1600/htpasswd_creation_www.hackthesec.co.in.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiVW17xmzge_IJln7Rlctu5l5kT3iFkzkj5WhD2SoDbs7uWGnQaK2PAc1MgVNKgxtE5eWCDNDDiKMQo66q4t5yx2X2pAhe9nHPSS1vi6xHfEp6KE-IPnKMiG_gN9JZFYH5DV7xBxXSdnkSN/s1600/htpasswd_creation_www.hackthesec.co.in.png" /></a></div>
<div>
<span style="font-family: "georgia" , "times new roman" , serif;"><span style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px;"><br /></span></span></div>
<div>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="box-sizing: border-box;"><span style="font-family: "georgia" , "times new roman" , serif;">In the above command we can describe the used parameters where `<b>/etc/nginx/</b>` is the directory that we want to set for the authentication while `testuser` is the new user name that will be used for authentication purposes. So after executing the command, it will ask for the new password to set for the new user and that’s it! We’re done with the new user setup for our web directory.</span></span></div>
<h2 style="background-color: #fdfdfd; box-sizing: border-box; font-family: proxima-nova, 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 32px; font-weight: 500; line-height: 1.1; margin-bottom: 10.5px; margin-top: 21px;">
<span style="box-sizing: border-box;"><span style="color: #0b5394;"><u>Nginx Configurations Update</u></span></span></h2>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="box-sizing: border-box;"><span style="font-family: "georgia" , "times new roman" , serif;">Now we will modify the Nginx configuration file to use the .htpasswd file. In our case, we will be using our virtual host’s Nginx configuration file located in `<b>/etc/nginx/sites-available/</b>` directory. Make sure that you are using the right configuration file as your domain config may have a different name.</span></span></div>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="box-sizing: border-box;"><span style="font-family: "georgia" , "times new roman" , serif;">Let’s open the virtual host conf file using any editor you are comfortable with.</span></span></div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; line-height: 1.42857; margin-bottom: 10.5px; overflow: auto; padding: 10px; word-break: break-all; word-wrap: break-word;"><span style="box-sizing: border-box;"><span style="font-size: large;">root@ubuntu-14:~# vim /etc/nginx/sites-available/test.com</span></span></pre>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="box-sizing: border-box;"><span style="font-family: "georgia" , "times new roman" , serif;">Press `i` for insertion mode and add the following two lines as required under the servers section.</span></span></div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; line-height: 1.42857; margin-bottom: 10.5px; overflow: auto; padding: 10px; word-break: break-all; word-wrap: break-word;"><span style="font-size: large;"><span style="box-sizing: border-box;">auth_basic "Username and Password required";</span>

<span style="box-sizing: border-box;">auth_basic_user_file /etc/nginx/.htpasswd;</span></span></pre>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="box-sizing: border-box;"><span style="font-family: "georgia" , "times new roman" , serif;">Press `<b>Esc</b>` key and type `<b>:wq!</b>` to save the changes in the configuration file of your virtual hosts file.</span></span></div>
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh4PHxeW48OBrfVbBBKGiuBjj9PDz_Fp_wS5iY5d5nRAtwmZqpzLTGDWz55hzt9Ar1qI7ZLKcG_oNIK-Zksu0M809U0IPOnyREdkXiUl34VwgczgI983sR2gA2op-jqv4DQtgoRUliELO9x/s1600/htpasswd_setup-www.hackthesec.co.in.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh4PHxeW48OBrfVbBBKGiuBjj9PDz_Fp_wS5iY5d5nRAtwmZqpzLTGDWz55hzt9Ar1qI7ZLKcG_oNIK-Zksu0M809U0IPOnyREdkXiUl34VwgczgI983sR2gA2op-jqv4DQtgoRUliELO9x/s1600/htpasswd_setup-www.hackthesec.co.in.png" /></a></div>
<div>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="box-sizing: border-box;"><span style="font-family: "georgia" , "times new roman" , serif;">The first line defines the text that we will see in the login box when we access the folder using a web browser and the second one contains the path to our `.htpasswd` file where the username and the password is stored.</span></span></div>
<h2 style="background-color: #fdfdfd; box-sizing: border-box; font-family: proxima-nova, 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 32px; font-weight: 500; line-height: 1.1; margin-bottom: 10.5px; margin-top: 21px;">
<span style="box-sizing: border-box;"><span style="color: #0b5394;"><u>Restart Nginx</u></span></span></h2>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="box-sizing: border-box;"><span style="font-family: "georgia" , "times new roman" , serif;">Now, to implement the changes on our test virtual host, reload or restart the nginx services and access the domain that has been secured using Basic HTTP Authentication.</span></span></div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; line-height: 1.42857; margin-bottom: 10.5px; overflow: auto; padding: 10px; word-break: break-all; word-wrap: break-word;"><span style="font-size: large;"><span style="box-sizing: border-box;">root@ubuntu-14:~# service nginx restart</span>

<span style="box-sizing: border-box;">* Restarting nginx nginx</span></span></pre>
<h2 style="background-color: #fdfdfd; box-sizing: border-box; font-family: proxima-nova, 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 32px; font-weight: 500; line-height: 1.1; margin-bottom: 10.5px; margin-top: 21px;">
<span style="box-sizing: border-box;"><span style="color: #0b5394;"><u>Secure Web Access</u></span></span></h2>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="box-sizing: border-box;"><span style="font-family: "georgia" , "times new roman" , serif;">Access your website by providing your configured domain name or IP address or the domain path that you have secured and you will notice a browser prompt to enter the login and password as shown below. After providing the preconfigured username and password you will be able to see your web page.</span></span></div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; line-height: 1.42857; margin-bottom: 10.5px; overflow: auto; padding: 10px; word-break: break-all; word-wrap: break-word;"><span style="box-sizing: border-box;"><span style="font-size: large;">http://your_domain_name/</span></span></pre>
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnw_iB7zYNdR3MadSQPQwagLL1-35s8mRghIO4TTMaFI24FGHgOaCKiVcHrxoLM5QHX4JmiZ_N2p-0qDsq4vCdcmsFn3kPkY1qj8zouYkOGrORj2dAkf3xpsGXgAdt3d5BY1IMyPX62Yxd/s1600/login_www.hackthesec.co.in.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnw_iB7zYNdR3MadSQPQwagLL1-35s8mRghIO4TTMaFI24FGHgOaCKiVcHrxoLM5QHX4JmiZ_N2p-0qDsq4vCdcmsFn3kPkY1qj8zouYkOGrORj2dAkf3xpsGXgAdt3d5BY1IMyPX62Yxd/s1600/login_www.hackthesec.co.in.png" /></a></div>
<div>
<span style="font-family: "georgia" , "times new roman" , serif;"><span style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px;"><br /></span></span></div>
<div>
<a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></div>
</div>