1

I'm trying to allow unauthenticated access to certain scripts within a Nagios installation. Although the question is not specifically about Nagios nor the CGI handling that's also illustrated below.

Essentially, I want to require authentication for anything in a specific directory:

http://example.com/nagios/cgi-bin/....

except for 2 specific paths:

http://example.com/nagios/cgi-bin/avail.cgi....
http://example.com/nagios/cgi-bin/trends.cgi....

Currently I've got Apache set up to require authentication for all access to http://example.com/nagios/cgi-bin

ScriptAlias /nagios/cgi-bin /usr/local/nagios/sbin

<Directory "/usr/local/nagios/sbin">
  Options ExecCGI
  AllowOverride None
  Order allow,deny
  Allow from all
  AuthName "Nagios Access"
  AuthType Basic
  AuthUserFile /usr/local/nagios/etc/htpasswd.users
  Require valid-user
</Directory>

I'd prefer not to replicate the scripts in a different directory as this is packaged software and I want to minimise the support effort - I'm not sure what URLs within the package use canonical paths.

edit:

Could I use a FilesMatch instead of the Direcory block? If so, are the Apache regexes PCRE or POSIX based?

Edit 3:

Using

<FilesMatch "/(cgi-bin\/)(?!trends.cgi)(?!avail.cgi)/"> 

removes authentication from all URLs in the dir :(

I've also tried replicating the avail.cgi and trends.cgi scripts in a different directory. That appears to work - but the forms are not populated with any data from my Nagios config! It appears that there is an additional layer of authentication built into the Nagios code. This would also defeat the 'Require any / allow from ip' approach. :(

While the revised behaviour in MSIE may be correct wrt rfc 2396 its causing me horrible headaches!

3
  • So to clarify your question - this block forces authentication on everything in that directory, and you want to know how to except those two scripts from the blanket authentication requirement?
    – pjmorse
    Sep 23, 2010 at 12:19
  • @pjmorse: yes. Because I don't know what files may be added in future I'd rather have the default of authenticating, but skip authentication for named cases
    – symcbean
    Sep 23, 2010 at 12:39
  • That makes sense. That's a tougher problem than most of these answers are actually solving.
    – pjmorse
    Sep 24, 2010 at 13:07

4 Answers 4

0

Did you try to create a new folder with a symbolic link to your "open" cgi?

6
  • 1
    Then how would I solve the problem of canonical paths?
    – symcbean
    Sep 23, 2010 at 12:40
  • Sorry, I don't understand: "what URLs within the package use canonical paths". What do you mean?
    – lg.
    Sep 23, 2010 at 13:25
  • What if one of script I want to allow access to writes a page with a href="/nagios/cgi-bin/trends.cgi" or a form action "/nagios/cgi-bin/trends.cgi" its pointing back into the authenticated realm. I don't want to maintain a fork of the source code nor rewrite the generated HTML on th fly via a proxy
    – symcbean
    Sep 23, 2010 at 21:47
  • Usually the form action and reference hasn't full path, but relative path. I checked trends.cgi html source and there are only relative path. Full path is specified only for stylesheets and ico image.
    – lg.
    Sep 24, 2010 at 6:40
  • I'd recommend Alias instead of symbolic links, when using apache. Sep 24, 2010 at 7:26
1

If you have a second IP address available on the server, you could try to run a reverse proxy on this IP address which only forwards these two locations and does do the HTTP authentication.

<VirtualHost secondIP:80>
    ProxyPassMatch ^\/nagios\/cgi-bin\/(trends|avail)\.cgi$ "http://127.0.0.1/nagios/cgi-bin/"
    ProxyPassReverse /nagios/cgi-bin/ "http://127.0.0.1/nagios/cgi-bin/"
</VirtualHost>

I have not tried if this works correctly as there is no ProxyPassReverseMatch directive in apache.

1
  • Took me a wee while to work this one out - yes if I add an 'Allow from 127.0.0.1' and had a second ip address, then this would probably have the desired effect - but for lots of reasons outwith my control I don't have an option of a second IP address :(
    – symcbean
    Sep 24, 2010 at 10:56
0

Use satisfy:

Require valid-user
Order allow,deny
Allow from IP
Satisfy Any 

http://httpd.apache.org/docs/current/mod/core.html#satisfy

3
  • No - that how to provide access to any URL within the realm without authentication for a specific IP address - satisfy only operates on combinations of user authentication and host based access control - nothing to do with my problem.
    – symcbean
    Sep 23, 2010 at 21:42
  • No - that how to provide access to any URL within the realm without authentication for a specific IP address - satisfy only operates on combinations of user authentication and host based access control - nothing to do with my problem.
    – symcbean
    Sep 23, 2010 at 21:42
  • (whoops - I blame the flakey wifi driver on this laptop)
    – symcbean
    Sep 23, 2010 at 21:43
0

The following configuration worked for me to require authentication for single CGI script:

<Directory "/var/www/cgi-bin">
  <Files "my-cgi-script">
    # ...
    # AuthName, AuthType, AuthUserFile, Require
    # ...
  </Files>
</Directory>

Try to nest FilesMatch into Directory and use relative paths in the FilesPath directive.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .