Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to allow unauthenticated access to certain scripts within a Nagios installation. Although the question is not specifically about Nagios nor the CGI handling that's also illustrated below.

Essentially, I want to require authentication for anything in a specific directory:

http://example.com/nagios/cgi-bin/....

except for 2 specific paths:

http://example.com/nagios/cgi-bin/avail.cgi....
http://example.com/nagios/cgi-bin/trends.cgi....

Currently I've got Apache set up to require authentication for all access to http://example.com/nagios/cgi-bin

ScriptAlias /nagios/cgi-bin /usr/local/nagios/sbin

<Directory "/usr/local/nagios/sbin">
  Options ExecCGI
  AllowOverride None
  Order allow,deny
  Allow from all
  AuthName "Nagios Access"
  AuthType Basic
  AuthUserFile /usr/local/nagios/etc/htpasswd.users
  Require valid-user
</Directory>

I'd prefer not to replicate the scripts in a different directory as this is packaged software and I want to minimise the support effort - I'm not sure what URLs within the package use canonical paths.

edit:

Could I use a FilesMatch instead of the Direcory block? If so, are the Apache regexes PCRE or POSIX based?

Edit 3:

Using

<FilesMatch "/(cgi-bin\/)(?!trends.cgi)(?!avail.cgi)/"> 

removes authentication from all URLs in the dir :(

I've also tried replicating the avail.cgi and trends.cgi scripts in a different directory. That appears to work - but the forms are not populated with any data from my Nagios config! It appears that there is an additional layer of authentication built into the Nagios code. This would also defeat the 'Require any / allow from ip' approach. :(

While the revised behaviour in MSIE may be correct wrt rfc 2396 its causing me horrible headaches!

share|improve this question
    
So to clarify your question - this block forces authentication on everything in that directory, and you want to know how to except those two scripts from the blanket authentication requirement? –  pjmorse Sep 23 '10 at 12:19
    
@pjmorse: yes. Because I don't know what files may be added in future I'd rather have the default of authenticating, but skip authentication for named cases –  symcbean Sep 23 '10 at 12:39
    
That makes sense. That's a tougher problem than most of these answers are actually solving. –  pjmorse Sep 24 '10 at 13:07

4 Answers 4

up vote 0 down vote accepted

Did you try to create a new folder with a symbolic link to your "open" cgi?

share|improve this answer
1  
Then how would I solve the problem of canonical paths? –  symcbean Sep 23 '10 at 12:40
    
Sorry, I don't understand: "what URLs within the package use canonical paths". What do you mean? –  lg. Sep 23 '10 at 13:25
    
What if one of script I want to allow access to writes a page with a href="/nagios/cgi-bin/trends.cgi" or a form action "/nagios/cgi-bin/trends.cgi" its pointing back into the authenticated realm. I don't want to maintain a fork of the source code nor rewrite the generated HTML on th fly via a proxy –  symcbean Sep 23 '10 at 21:47
    
Usually the form action and reference hasn't full path, but relative path. I checked trends.cgi html source and there are only relative path. Full path is specified only for stylesheets and ico image. –  lg. Sep 24 '10 at 6:40
    
I'd recommend Alias instead of symbolic links, when using apache. –  Manuel Faux Sep 24 '10 at 7:26

If you have a second IP address available on the server, you could try to run a reverse proxy on this IP address which only forwards these two locations and does do the HTTP authentication.

<VirtualHost secondIP:80>
    ProxyPassMatch ^\/nagios\/cgi-bin\/(trends|avail)\.cgi$ "http://127.0.0.1/nagios/cgi-bin/"
    ProxyPassReverse /nagios/cgi-bin/ "http://127.0.0.1/nagios/cgi-bin/"
</VirtualHost>

I have not tried if this works correctly as there is no ProxyPassReverseMatch directive in apache.

share|improve this answer
    
Took me a wee while to work this one out - yes if I add an 'Allow from 127.0.0.1' and had a second ip address, then this would probably have the desired effect - but for lots of reasons outwith my control I don't have an option of a second IP address :( –  symcbean Sep 24 '10 at 10:56

Use satisfy:

Require valid-user
Order allow,deny
Allow from IP
Satisfy Any 

http://httpd.apache.org/docs/current/mod/core.html#satisfy

share|improve this answer
    
No - that how to provide access to any URL within the realm without authentication for a specific IP address - satisfy only operates on combinations of user authentication and host based access control - nothing to do with my problem. –  symcbean Sep 23 '10 at 21:42
    
No - that how to provide access to any URL within the realm without authentication for a specific IP address - satisfy only operates on combinations of user authentication and host based access control - nothing to do with my problem. –  symcbean Sep 23 '10 at 21:42
    
(whoops - I blame the flakey wifi driver on this laptop) –  symcbean Sep 23 '10 at 21:43

The following configuration worked for me to require authentication for single CGI script:

<Directory "/var/www/cgi-bin">
  <Files "my-cgi-script">
    # ...
    # AuthName, AuthType, AuthUserFile, Require
    # ...
  </Files>
</Directory>

Try to nest FilesMatch into Directory and use relative paths in the FilesPath directive.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.