Providence htpasswd

kbecker

Hi,

the php/8 branch of providence with nginx on Ubuntu 24 with this config will not correctly redirect after a login:

 server {
        server_name backend.my-url.org;

    root /var/www/html/ca;
    index index.php;

    access_log /var/log/nginx/collectiveaccess_access.log calogformat;
    error_log /var/log/nginx/collectiveaccess_error.log notice;

    client_max_body_size 512M;
    fastcgi_read_timeout 300;

    keepalive_timeout 60;

    # Basic authentication
    auth_basic "Restricted Access";
    auth_basic_user_file /etc/nginx/.htpasswd;

    location / {
        try_files $uri /index.php?$query_string;
        satisfy any;
        allow 0.0.0.0/0;
        deny all;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/var/run/php/php8.2-fpm.sock;
    }

    location ~ /\.ht {
        deny all;
    }

    location ~ /setup.php {
      deny all;
    }

}

Does anybody know how I can use nginx and htpasswd together for providence correctly? Thanks!

The error is

2024-07-19 8:44:41 - INFO --> [LOGF] Failed login for '<htpasswd user>' (/index.php/); IP=11.11.11.1; user agent='Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15' (Auth)

monica

I don't know how to do what you are trying to do (with basic auth files), but I do know you will need to extend your denies on certain files and directories for security sake.

For instance, all the files in app/conf are readable and your /install/index.php will be accessible, which you should close down after you have done your install. There are others you'll want to block too.

I also note you have no listen directive or SSL Provisions.

kbecker

Hi, I omitted some general stuff from the config. For ca I now have nested location block like this:

location / {
    location ~ /\.ht {
        deny all;
    }
    location ~ /setup.php {
        deny all;
    }
    location ~ /.git/ {
        deny all;
    }
    location ~ /install {
        deny all;
    }
    location ~ /app/conf/ {
        deny all;
    }
    location ~ \.php$ {

        include snippets/fastcgi-php.conf;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param QUERY_STRING $query_string;
        fastcgi_pass unix:/run/php/php8.2-fpm.sock;
    }
    try_files $uri /index.php?$query_string;
}

robc

I'm having the exact same problem in Apache. The dev/php8 branch appears to be incompatible with HTTP server authentication. I filed a bug on GitHub to see if there's any more info about this.

seth

We've never tested it with basic auth. If someone wants to figure it out go for it.

robc

Here's a workaround specific to Apache and PHP-FPM. Sorry I don't know about Nginx.

https://webmasters.stackexchange.com/questions/145619/