Basic認証とアクセス制御
Basic認証とIPベースのアクセス制御を設定し、Nginxのリソースを保護します。
「Basic認証とアクセス制御」はCoddyKit上の無料API Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway)レッスンです。 これはレッスン3/4です。 下記で完全なレッスンを無料で読むことができます。その後、ブラウザ内の組み込みコードエディタと24時間対応のAIチューターでハンズオン演習できます。 これはAPI Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway)学習パスの一部であり、ウェブとCoddyKitアプリ全体で進捗が同期されます。 API Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway)コースには全4レッスンが含まれています。
このレッスンの一部はまだ翻訳されておらず、英語で表示されています。
Protecting Nginx Resources
When Nginx serves content or acts as a proxy, it's crucial to control who can access your resources. This helps prevent unauthorized access and keeps your applications secure.
In this lesson, we'll explore two fundamental ways to secure Nginx: Basic HTTP Authentication and IP-based Access Control.
Basic HTTP Authentication
Basic HTTP Authentication is a simple way to protect web resources using a username and password. When a user tries to access a protected resource, their browser will prompt them to enter credentials.
- The browser sends credentials with each request.
- Nginx verifies these against a stored file.
- It's straightforward but sends credentials as base64 encoded text (not encrypted), so always use it with HTTPS!
Creating a Password File
To use basic authentication, Nginx needs a file containing usernames and encrypted passwords. We use the htpasswd utility, which is typically part of the Apache utilities package.
Here's how to create or add users to a password file:
sudo apt install apache2-utils # On Debian/Ubuntu
sudo yum install httpd-tools # On CentOS/RHEL
sudo htpasswd -c /etc/nginx/.htpasswd coddyuser
# -c creates the file if it doesn't exist
# You'll be prompted to enter and confirm passwordNginx Basic Auth Configuration
Once you have your password file, you can configure Nginx to use it. You'll use two main directives:
auth_basic: Sets the realm (a message shown in the login prompt).auth_basic_user_file: Specifies the path to your password file.
These directives can be placed in http, server, or location blocks.
Example: Basic Auth with Nginx
This Nginx configuration snippet protects the /admin path, requiring users to authenticate with credentials from the .htpasswd file.
http {
# ... other http settings
server {
listen 80;
server_name example.com;
location / {
root /var/www/html;
index index.html;
}
location /admin {
auth_basic "Restricted Area";
auth_basic_user_file /etc/nginx/.htpasswd;
root /var/www/admin;
index index.html;
}
}
}IP-based Access Control
Another way to secure resources is by controlling access based on the client's IP address. Nginx uses the allow and deny directives for this.
allow IP_ADDRESS | CIDR | all: Permits access from specified IPs.deny IP_ADDRESS | CIDR | all: Denies access from specified IPs.
These directives are processed in order within a block. The first matching rule applies.
Configuring IP Access Rules
You can specify single IP addresses, IP ranges using CIDR notation (e.g., 192.168.1.0/24), or all to refer to all IPs. Remember, the order matters!
For example, to allow a specific IP and deny all others, you'd list allow first, then deny all.
Example: IP Access with Nginx
This configuration allows access to /private only from 192.168.1.100 and any IP within the 10.0.0.0/8 network, denying everyone else.
http {
# ... other http settings
server {
listen 80;
server_name example.com;
location / {
root /var/www/html;
index index.html;
}
location /private {
allow 192.168.1.100;
allow 10.0.0.0/8;
deny all;
root /var/www/private;
index index.html;
}
}
}Combining Access Controls
You can combine both basic authentication and IP-based access control for enhanced security. Nginx processes these rules sequentially.
- First, IP-based rules are evaluated.
- If access is allowed by IP, then basic authentication is checked.
This means a request must satisfy both sets of rules to gain access.
Quick Check: Nginx Security
Consider the following Nginx configuration snippet. A user with IP 192.168.1.50 tries to access example.com/sensitive. The .htpasswd file contains a valid entry for 'admin'.
What will happen?
location /sensitive {
deny 192.168.1.0/24;
allow 192.168.1.50;
deny all;
auth_basic "Secure Area";
auth_basic_user_file /etc/nginx/.htpasswd;
}Recap: Nginx Access Control
In this lesson, you learned how to protect your Nginx resources using two key methods:
- Basic HTTP Authentication: Uses username/password stored in an
.htpasswdfile, configured withauth_basicandauth_basic_user_file. Best used with HTTPS. - IP-based Access Control: Filters requests based on IP addresses using the
allowanddenydirectives. Order of these rules is crucial.
These methods provide foundational security for your Nginx server and the applications it serves.
よくある質問
「Basic認証とアクセス制御」レッスンは無料ですか？
はい。「Basic認証とアクセス制御」の完全なテキストはこのウェブで無料で読めます。インタラクティブに演習し（組み込みコードエディタと24時間対応のAIチューター）、API Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway)コースの残りをアンロックするには、CoddyKit PROにアップグレードしてください。 API Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway)コースには全4レッスンが含まれています。
「Basic認証とアクセス制御」で何を学びますか？
Basic認証とIPベースのアクセス制御を設定し、Nginxのリソースを保護します。 ブラウザで直接実行するハンズオンコードでAPI Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway)を演習し、24時間対応のAIチューターがレッスンを進める中での質問に答えます。
API Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway)を始めるのに経験は必要ですか？
事前経験は必要ありません。CoddyKitのAPI Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway)は初級者から上級者向けに構成されているため、ここから始めるか最初から始めて、自分のペースで進むことができます。 これはレッスン3/4です。
「Basic認証とアクセス制御」レッスンにはどのくらい時間がかかりますか？
ほとんどのCoddyKitレッスンは約5～10分かかります。各レッスンはコンパクトでインタラクティブなので、着実に進歩し、ウェブとアプリ全体で正確に前回の場所から再開できます。
このAPI Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway)レッスンでコードを書いて実行できますか？
はい。すべてのAPI Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway)レッスンに組み込みコードエディタが含まれているため、ブラウザでリアルコードを書いて実行し、即座のAIフィードバックを取得できます。ローカル設定は不要です。