Loading ...Lighttpd secure digest authentication (mod_auth)
This method transfers the username and the password in cleartext over the network (base64 encoded) and might result in security problems if not used in conjunction with a crypted channel between client and server.
The Digest method only transfers a hashed value over the network which performs a lot of work to harden the authentication process in insecure networks.
There are total three steps to configure Lighttpd secure digest authentication:
=> Setup username and password using htdigest (Apache program)
=> Configure lighttpd core directives
=> Apply restrictions to selected directories aka set password protected directory
Step # 1: Setup username and password using htdigest (Apache program)
Command htdigest is used to create and update the flat-files used to store usernames, realm and password for digest authentication of HTTP users. Genreal syntax is as follows:
htdigest -c /path/to/password/file 'Realm' username
For example add a user called tom:
# htdigest -c /etc/lighttpd/.passwd 'Authorized users only' tom
Where,
- -c: Create the /etc/lighttpd/.passwd
- /etc/lighttpd/.passwd: Password file name. It contain the username, realm and password. If -c is given, this file is created if it does not already exist, or deleted and recreated if it does exist.
- 'Authorized users only': The realm name to which the user name belongs
- tom: The user name (tom) to create or update in /etc/lighttpd/.passwd. If username does not exist is this file, an entry is added. If it does exist, the password is changed.
Step # 2: Configure lighttpd core directives
Open /etc/lighttpd.conf file.# vi /etc/lighttpd.confMake sure mod_auth is loaded:
server.modules += ( "mod_auth" )Now, append following 3 lines:
auth.backend = "htdigest"
auth.backend.htdigest.userfile = "/etc/lighttpd/.passwd"
auth.debug = 2
Step # 3: Apply restrictions to selected directories aka set password protected directory
Let us say you would like to protect directory called /docs (http://domain.com/docs). Append following directives (/etc/lighttpd.conf file):
auth.require = ( "/docs/" =>
(
"method" => "digest",
"realm" => "Authorized users only",
"require" => "valid-user"
)
)
Save and close the file.
Restart the lighttpd:
# /etc/init.d/lighttpd restart
You can always find more debugging information in your error log file -/var/log/lighttpd/error.log:
# tail -f /var/log/lighttpd/error.log
Point a web browser to http://domain.com/docs/ or http://localhost/docs/ or http://ip-address/docs. You should be prompted for a username (for e.g. tom) and password (your password).
For additional security it is recommended that you use SSL configuration.
Want to stay up to date with the latest Linux tips, news and announcements? Subscribe to our free e-mail newsletter or RSS feed to get all updates.
You can Email this page to a friend.
You may also be interested in other helpful articles:
- Lighttpd setup a password protected directory (directories)
- Wordpress 2.0.7 available for download
- Installing and configuring lighttpd webserver - HOWTO
- Lighttpd Install and Configure AwStats Software Log Analyzer
- How to Setup Kerberized authentication of Windows Terminal Service
Discussion on This Article:
Leave a Reply
We encourage your comments, and suggestions. But please stay on topic, be polite, and avoid spam. Thank you very much for stopping by our site!
Great article. Works after one small type correction.
you wrote:
auth.backend.htdigest.userfile = "/etc/lighttpd/.passwd "
I copied and pasted the above and couldn’t restart lighttpd. There’s a space after .passed and before the ending quote. Removing the space, lighty started fine.
Thanks for this tutorial and all the others.
Thai,
Opps, sorry for typo, post has been updated.
Appreciate your post!
hi,
if i have some fils in the http folder and in browser i write http://mydomain.com/http/some.jpg
it gives me an error 404 not found and in have done secure digest authentication on the http folder
why i m getting this problem i m not able to figure it out.
please help me. Thanks in advance
Unfortunately lighttpd still doesnt write meaningful entries into error.log on failed logins so its hard to check for wordbook attacks etc.
htdigest is available on apache2-utils, if you don’t have it, you can install it by this cmd on debian system
apt-get install apache2-utils
what should be the correct unix permissions for .passwd?
I’m getting this error:
2008-07-22 11:44:23: (http_auth.c.151) opening digest-userfile /etc/lighttpd/.passwd failed: Permission denied
Peter,
You should set permission to lighttpd or www i.e. lighttpd server username using chmod command.
# ls -la /etc/lighttpd/
drw-r—– 2 www www 512 Jul 22 19:16 .
drwxr-xr-x 21 root wheel 2048 Jul 21 14:30 ..
-rw-r–r– 1 www www 60 Jul 22 19:16 .passwd
# tail -f /var/log/lighttpd.error.log
2008-07-22 19:27:50: (http_auth.c.1002) username xpto
2008-07-22 19:27:50: (http_auth.c.1003) realm Authorized users only
2008-07-22 19:27:50: (http_auth.c.1004) nonce 27292a400655857236e04710538278ba
2008-07-22 19:27:50: (http_auth.c.1005) uri /wordpress/wp-admin/
2008-07-22 19:27:50: (http_auth.c.1006) algorigthm MD5
2008-07-22 19:27:50: (http_auth.c.1007) qop auth
2008-07-22 19:27:50: (http_auth.c.1008) cnonce 21nkwLwMcFj1CHbiIF9IzfvpLzHgiNpzNzZEJzptCcW=
2008-07-22 19:27:50: (http_auth.c.1009) nc 00000001
2008-07-22 19:27:50: (http_auth.c.1010) response 96649fb136d6c4fc4bfd21e13a7d7f23
2008-07-22 19:27:50: (http_auth.c.151) opening digest-userfile /etc/lighttpd/.passwd failed: Permission denied
What is output of the following command?
grep -i server.username /etc/lighttpd/lighttpd.confYou need to use that username, also make sure, /etc/lighttpd also owned by that user.
# grep -i server.username /usr/local/etc/lighttpd.conf
server.username = “www”
I created the .passwd on another machine running apache, but I think that’s not the cause of this error