Nginx gives an Internal Server Error 500 after I h

2019-06-16 00:47发布

站内文章 / 移动开发

44 0

祖国的老花朵

女 | 书童

私信

可以将文章内容翻译成中文,广告屏蔽插件可能会导致该功能失效(如失效，请关闭广告屏蔽插件后再试):

问题:

I am trying to do basic auth on Nginx. I have version 1.9.3 up and running on Ubuntu 14.04 and it works fine with a simple html file.

Here is the html file:

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <title></title>
</head>
<body>
  "Some shoddy text"
</body>
</html>

And here is my nginx.conf file:

user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    include /etc/nginx/conf.d/*.conf;
    server {
        listen 80;
        server_name 192.168.1.30;
        location / {
            root /www;
            index index.html;
            auth_basic "Restricted";
            auth_basic_user_file /etc/users;
        }
    }
}

I used htpasswd to create two users in the "users" file under /etc (username "calvin" password "Calvin", and username "hobbes" password "Hobbes"). It's encrypted by looks like this:

calvin:$apr1$Q8LGMfGw$RbO.cG4R1riIfERU/175q0
hobbes:$apr1$M9KoUUhh$ayGd8bqqlN989ghWdTP4r/

All files belong to root:root. The server IP address is 192.168.1.30 and I am referencing that directly in the conf file.

It all works fine if I comment out the two auth lines and restart nginx, but if I uncomment them, then I do indeed get the username and password prompts when I try to load the site, but immediately thereafter get an Error 500 Internal Server error which seems to persist and I have to restart nginx.

Anybody can see what I'm doing wrong here? I had the same behaviour on the standard Ubuntu 14.04 apt-get version of Nginx (1.4.something) so I don't think it's the nginx version.

回答1:

Not really an answer to your question as you are using MD5. However as this thread pops up when searching for the error, I am attaching this to it.

Similar errors happen when bcrypt is used to generate passwords for auth_basic:

htpasswd -B <file> <user> <pass>

Since bcrypt is not supported within auth_basic ATM, mysterious 500 errors can be found in nginx error.log, (usually found at /var/log/nginx/error.log), they look something like this:

*1 crypt_r() failed (22: Invalid argument), ...

At present the solution is to generate a new password using md5, which is the default anyway.

Edited to address md5 issues as brought up by @EricWolf in the comments:

md5 has its problems for sure, some context can be found in the following threads

Is md5 considered insecure?
Is md5 still considered secure for single use authentications?

Of the two, speed issue can be mitigated by using fail2ban, by banning on failed basic auth you'll make online brute forcing impractical (guide). You can also use long passwords to try and fortify a bit as suggested here.

Other than that it seems this is as good as it gets with nginx...

回答2:

I had goofed up when initially creating a user. As a result, the htpasswd file looked like:

user:
user:$apr1$passwdhashpasswdhashpasswdhash...

After deleting the blank user, everything worked fine.

回答3:

I will just stick the htpassword file under "/etc/nginx" myself. Assuming it is named htcontrol, then ...

sudo htpasswd -c /etc/nginx/htcontrol calvin

Follow the prompt for the password and the file will be in the correct place.

location / {
    ...

    auth_basic "Restricted";
    auth_basic_user_file htcontrol;
}

or auth_basic_user_file /etc/nginx/htcontrol; but the first variant works for me

回答4:

I was running Nginx in a Docker environment and I had the same issue. The reason was that some of the passwords were generated using bcrypt. I resolved it by using nginx:alpine.

回答5:

I just had the same problem - after checking log as suggested by @Drazen Urch I've discovered that the file had root:root permissions - after changing to forge:forge (I'm using Forge with Digital Ocean) - the problem went away.

回答6:

Well, just use correct RFC 2307 syntax:

passwordvalue          = schemeprefix encryptedpassword
schemeprefix           = "{" scheme "}"
scheme                 = "crypt" / "md5" / "sha" / altscheme
altscheme              = "x-" keystring
encryptedpassword      = encrypted password

For example: sha1 for helloworld for admin will be * admin:{SHA}at+xg6SiyUovktq1redipHiJpaE=

I had same error cause i wrote {SHA1} what against RFC syntax. When i fixed it - all worked like a charm. {sha} will not work too. Only correct {SHA}.

回答7:

First, check out your nginx error logs:

tail -f /var/log/nginx/error.log

In my case, I found the error:

[crit] 18901#18901: *6847 open() "/root/temp/.htpasswd" failed (13: Permission denied),

The /root/temp directory is one of my test directories, and cannot be read by nginx. After change it to /etc/apache2/ (follow the official guide https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-http-basic-authentication/) everything works fine.

===

After executing the ps command we can see the nginx worker process maintained by the user www-data, I had tried to chown www-data:www-data /root/temp to make sure www-data can access this file, but it still not working. To be honest, I don't have a very deep understanding on Linux File Permissions, so I change it to /etc/apache2/ to fix this in the end. And after a test, you can put the .htpasswd file in other directories which in /etc (like /etc/nginx).