Protect your website with password on nginx ubuntu 16.04

Sometimes it is necessary to run a website for internal purpose within organisation or you might be want to share your website to only few people. In those scenarios it is necessary to promote asking for username and password whenever someone lands on your website.

In this article, we’ll show you how you can protect your website with password on nginx web server running on Ubuntu 16.04.

Hope you have pre installed nginx on your ubuntu. If not follow these two commands.

sudo apt-get update
sudo apt-get install nginx

Create credentials file

Using OpenSSL Utilities we can handle the credentials, So basically we need to create one hidden secured file under nginx folder which will carry all the user name and password combinations. You can create a file name . htpasswd in the configuration directory of /etc/nginx.

You can create the user name using the following command.

 sudo sh -c "echo -n 'john:' >> /etc/nginx/.htpasswd"

and then we can create the password for the user using following.

sudo sh -c "openssl passwd -apr1 >> /etc/nginx/.htpasswd"

It will ask you to enter the password, once you entered the confirming password the encrypted password will be stored in the .htpasswd file.

And you can do repeat this for creating multiple users. You can see how the usernames and encrypted passwords are stored within the file by typing:

cat /etc/nginx/.htpasswd
 
Output
john:$apr1$wI1/T0nB$jEKuTJHkTOOWkopnXqC1d1

Configure Nginx Password Authentication

So for now we have created user credentials, then we need to let nginx server know that website going to be authenticated by editing the configuration file.

sudo vim /etc/nginx/sites-enabled/default

The configuration file will look something like this.

server {
    listen 80 default_server;
    listen [::]:80 default_server ipv6only=on;

    root /usr/share/nginx/html;
    index index.html index.htm;

    server_name localhost;

    location / {
        try_files $uri $uri/ =404;
    }
}

To enable the authentication we need to set up auth basic as restrict and link the file path of .htpasswd. Nginx allows you to set restrictions on the server level or inside a specific location. You can choose the restrict entire root location or specified locations too. Let’s restrict entire root location by doing following.

server {
    listen 80 default_server;
    listen [::]:80 default_server ipv6only=on;

    root /var/www/html;
    index index.html index.htm;

    server_name localhost;

    location / {
        try_files $uri $uri/ =404;
        auth_basic "Restricted Content";
        auth_basic_user_file /etc/nginx/.htpasswd;
    }
}

Now you can save these changes and restart the nginx web server to protect the location you specified.

 sudo service nginx restart

You can go to your website and check the same. You will be prompted with user name password before proceeding the with website like the following.

Protect your website with password on nginx ubuntu 16.04

Here, Your site is protected and you can circulate it with the credentials.

3 thoughts on “Protect your website with password on nginx ubuntu 16.04

  1. Thanks for another informative website. Where else could I am getting that type of information written in such an ideal way? I’ve a venture that I am simply now running on, and I have been at the look out for such information.

  2. Having read this I thought it was very informative. I appreciate you taking the time and effort to put this article together. I once again find myself spending way to much time both reading and commenting. But so what, it was still worth it!

Leave a Reply

Your email address will not be published. Required fields are marked *