Базовая аутентификация и контроль доступа

When Nginx serves content or acts as a proxy, it's crucial to control who can access your resources. This helps prevent unauthorized access and keeps your applications secure.

In this lesson, we'll explore two fundamental ways to secure Nginx: Basic HTTP Authentication and IP-based Access Control.

Basic HTTP Authentication is a simple way to protect web resources using a username and password. When a user tries to access a protected resource, their browser will prompt them to enter credentials.

• The browser sends credentials with each request.
• Nginx verifies these against a stored file.
• It's straightforward but sends credentials as base64 encoded text (not encrypted), so always use it with HTTPS!

To use basic authentication, Nginx needs a file containing usernames and encrypted passwords. We use the htpasswd utility, which is typically part of the Apache utilities package.

Here's how to create or add users to a password file:

Once you have your password file, you can configure Nginx to use it. You'll use two main directives:

• auth_basic: Sets the realm (a message shown in the login prompt).
• auth_basic_user_file: Specifies the path to your password file.

These directives can be placed in http, server, or location blocks.

This Nginx configuration snippet protects the /admin path, requiring users to authenticate with credentials from the .htpasswd file.

Another way to secure resources is by controlling access based on the client's IP address. Nginx uses the allow and deny directives for this.

• allow IP_ADDRESS | CIDR | all: Permits access from specified IPs.
• deny IP_ADDRESS | CIDR | all: Denies access from specified IPs.

These directives are processed in order within a block. The first matching rule applies.

You can specify single IP addresses, IP ranges using CIDR notation (e.g., 192.168.1.0/24), or all to refer to all IPs. Remember, the order matters!

For example, to allow a specific IP and deny all others, you'd list allow first, then deny all.

This configuration allows access to /private only from 192.168.1.100 and any IP within the 10.0.0.0/8 network, denying everyone else.

You can combine both basic authentication and IP-based access control for enhanced security. Nginx processes these rules sequentially.

• First, IP-based rules are evaluated.
• If access is allowed by IP, then basic authentication is checked.

This means a request must satisfy both sets of rules to gain access.

Consider the following Nginx configuration snippet. A user with IP 192.168.1.50 tries to access example.com/sensitive. The .htpasswd file contains a valid entry for 'admin'.

What will happen?

In this lesson, you learned how to protect your Nginx resources using two key methods:

• Basic HTTP Authentication: Uses username/password stored in an .htpasswd file, configured with auth_basic and auth_basic_user_file. Best used with HTTPS.
• IP-based Access Control: Filters requests based on IP addresses using the allow and deny directives. Order of these rules is crucial.

These methods provide foundational security for your Nginx server and the applications it serves.