1

I have a VPS running OpenBSD 7.4 x64 that hosts my personal webpage among other things. This webpage is using the native http daemon provided by OpenBSD, not an Apache server. I would like to have the majority of my website open to anyone who encounters it, although there are certain pages that I would like to only be visible to authenticated users for privacy purposes. I have scoured the web for documentation on how to achieve this, and come up mostly empty-handed.

What I have found so far is that I need to add an authenticate statement in my /etc/httpd.conf file to prompt the user for a username and password, which is then checked against the .htpasswd file that I have previously created for the protected realm. I have also found that one may have multiple "realms" with distinct .htpasswd files for each. My issue is that I have not been able to properly setup the /etc/httpd.conf file so that it asks for authentication and then allows the user through upon receiving correct info.

It seems that the adoption of OpenBSD's native http daemon is still relatively small, at least compared to the adoption of Apache servers. I have not found any thorough explanations of how it all works besides OpenBSD's manpages, which, while many people say they are very thorough, I have still had some trouble fully understanding.

This is all a very new thing to me, in fact I was only able to set all of this up in the first place because I used a script made by someone else and followed their instructions.

To wrap all of this up, I would like to password-protect a folder/directory and all of it's subfolders/subdirectories, recursively. I envision this would be something akin to adding authenticate "realm" with "[.htpasswd file]" to a server block in my httpd.conf. The problem is that when I try this, the server merely prompts for a password and immediately prompts for it again, ad infinitum, regardless of whether or not the password matches the .htpasswd credentials I have previously created. If I hit cancel on the password prompt, the server will then give me a "401 Unauthorized" page.

Here is a config that will result in infinite password challenges:

prefork 5

types {
  include "[TYPES_FILE_LOCATION]"
}

server "[DOMAIN_NAME.COM]" {
  listen on * port 80
  location * {
    block return 301 "https://$HTTP_HOST$REQUEST_URI"
  }
  location "/.well-known/acme-challenge/*" {
    root "/acme"
    request strip 2
  }
}

server "[DOMAIN_NAME.COM]" {
  listen on 127.0.0.1 port 8080
  default type text/html

[*** PROBLEM HERE v ***]
  location "/[PROTECTED_FOLDER]" {
    authenticate "realm" with "[.HTPASSWD_LOCATION]"
  }
[*** PROBLEM HERE ^ ***]

  location "/pub/*" {
    directory auto index
  }
}

This config works as-is for regular https connections and for http -> https connections as well.

I have also tried

[*** PROBLEM HERE v ***]
  location "/[PROTECTED_FOLDER]/*" {
    authenticate "realm" with "[.HTPASSWD_LOCATION]"
  }
[*** PROBLEM HERE ^ ***]

to a similar effect.

Here are the permissions for the users.htpasswd file and all parent directories:

drwxr-xr-x  13 root  wheel   512 Nov 29 19:00 /
drwxr-xr-x  27 root  wheel   512 Nov 15 05:22 /var
drwxr-xr-x  11 root  daemon  512 Jan  1 23:20 /var/www/
-rw-------   1 www   daemon   68 Jan  1 23:29 /var/www/users.htpasswd

Does anyone know what I am doing wrong here? Any resources I might have missed? Here are some resources I have discovered so far.

similar question #1 - misc.openbsd.narkive.com

similar question #2 - reddit.com/r/openbsd archive

httpd.conf manpage - man.openbsd.org archive

Any tips/help/pointers greatly appreciated.

8
  • What is the reply status code from the server upon entering your password? 403? 200? DevTools in the browser will show you this.
    – Panki
    Nov 27, 2023 at 9:31
  • @Panki I'm not super familiar with status codes but I pulled up inspect element and found the Network tab which looks like it first returned a 301 code (likely from HTTPS upgrade) and then a "failed" code, and on mouseover it said "net::ERR_INVALID_AUTH_CREDENTIALS", so perhaps I need to triple-check the .htpasswd file?
    – qqq
    Nov 29, 2023 at 5:11
  • 2
    Permissions and owner/group for the htpasswd file please. And all directories above it to root. The httpd process runs as an unprivileged ordinary account and must be able to access and read the htpasswd file. For example if the htpasswd file is /var/www/htpasswd I would want to see ls -ld / /var /var/www /var/www/htpasswd Jan 2 at 9:37
  • 1
    @RaviRavioli you can call it whatever you like. The process running the web server must be able to access and read the configuration file Jan 3 at 11:14
  • 1
    "I am still relatively new to Linux (OpenBSD especially)" - Linux and OpenBSD are different things. If you want to learn a Linux-based distribution then do not start with OpenBSD. If you want to learn a BSD UNIX system then OpenBSD is a good choice Jan 8 at 17:02

1 Answer 1

1
+50

This minimal configuration works for me, assuming the default chroot of /var/www:

server * {
  listen on * port 80
  root "/htdocs/default"
  directory auto index

  location "/protected/" {
    authenticate "realm" with "/auth/htpasswd"
  }
}

types {
  include "/usr/share/misc/mime.types"
}

Notice the trailing / on the protected directory name. Because you've redacted your configuration file so heavily I cannot tell whether you had this or not.

mkdir /var/www/htdocs/default              # Server document root
mkdir /var/www/htdocs/default/protected    # Protected subdirectory

mkdir /var/www/auth                        # Directory to store htpasswd
htpasswd /var/www/auth/htpasswd test       # User "test"; set your own password
chown www /var/www/auth/htpasswd           # Fix ownership

rcctl enable httpd                         # Enable the service
rcctl restart httpd                        # (Re)start the web server

If you want to use a directive such as location "/pub/*" that contains a wildcard you must use location match "/pub/*". But I think location "/pub/" would be sufficient.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .