nginx认证与访问模块

深碍√TFBOYSˉ_ 2022-06-08 01:15 164阅读 0赞

### nginx认证模块 ###

Module ngx_http_auth_basic_module
    
    Syntax: auth_basic string | off;
    Default:    
    auth_basic off;
    Context:    http, server, location, limit_except
    说明： string说明影响的范围，off只在当前的指定context中有效，不会被继承
    
    Syntax: auth_basic_user_file file;
    Default:    —
    Context:    http, server, location, limit_except
    Specifies a file that keeps user names and passwords, in the following format:
    
    # comment
    name1:password1
    name2:password2:comment
    name3:password3

使用htpasswd生成加密的密码文件  
\#htpasswd –help

Usage:
        htpasswd [-cmdpsD] passwordfile username
        htpasswd -b[cmdpsD] passwordfile username password 
    
        htpasswd -n[mdps] username
        htpasswd -nb[mdps] username password
        //-b命令行输入用户密码
     -c  Create a new file.
     -n  Don't update file; display results on stdout.
     -m  Force MD5 encryption of the password.
     -d  Force CRYPT encryption of the password (default).
     -p  Do not encrypt the password (plaintext).
     -s  Force SHA encryption of the password.
     -b  Use the password from the command line rather than prompting for it.
     -D  Delete the specified user.

example：

location / {
            auth_basic           "closed site";
            auth_basic_user_file htpasswd;  //默认在conf下
        }
    
    # htpasswd  -cb htpasswd  test 123
    Adding password for user test
    # cat htpasswd
    test:89XzEEI/P0e56
    
    输入错误的用户或密码，出现401认证失败
    当auth_basic_user_file不正确，出现403错误，查看错误日志
    
    403 Forbidden
    403错误，表示资源不可用。服务器理解客户的请求，但拒绝处理它，通常由于服务器上文件或目录的权限设置导致的WEB访问错误。

### nginx访问模块 ###

Module ngx_http_access_module
    
    Syntax: [allow|deny]  address | CIDR | unix: | all;
    Default:     —
    Context:    http, server, location, limit_except
    Allows access for the specified network or address. If the special value unix: is specified (1.5.1), allows access for all UNIX-domain sockets.

Example Configuration

location / {
        deny  192.168.1.1;
        allow 192.168.1.0/24;
        allow 10.1.1.0/16;
        allow 2001:0db8::/32;
        deny  all;
    }
    
    deny的ip访问时，报403错误