Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm configuring Apache in front of Hawtio - a Karaf-hosted JVM management console. Although Hawtio is served by Jetty and protected by Karaf's JAAS implementation, we want Apache to add Basic Auth that we can then additionally secure it - e.g. from brute force attacks with Fail2Ban.

However, despite following advice such as this and this, Apache's basic auth keeps popping up rather than asking for the credentials once only. Hawtio's log-in page loads after two requests for credentials but then, once you've put in the Hawtio log-in details, Apache keeps popping up its log-in page. I've even gone as far as entering the credentials twenty times but it still asks for more!

Am I missing something obvious?

Here's my config:-

<VirtualHost *:80>
  ServerAdmin admin@localhost
  ServerName hawtio.mydomain.com

  ErrorLog ${APACHE_LOG_DIR}/error.log
  LogLevel warn

  CustomLog ${APACHE_LOG_DIR}/access.log combined

  # suppress rule checking for Hawtio stuff
  SecRuleRemoveById 950901 960010 970003 970014 981257 981318 981407 981205 981222 981240 981220

  <Location />
    ProxyPass http://application-server:8765/
    ProxyPassReverse http://application-server:8765

    AuthUserFile /etc/users
    AuthName "Restricted area"
    AuthGroupFile /dev/null 
    AuthType Basic
    Require valid-user

    RequestHeader unset Authorization
  </Location>

</VirtualHost> 

I've tried numerous variations including with the <Proxy> group rather than <Location /> but to no avail. As per this post, I added RequestHeader unset Authorization to see if it was Jetty that was complaining but neither the presence nor the absence of that directive makes a difference.

The site works perfectly if I remove the basic auth directives.

Thanks for any pointers.

share|improve this question
    
Is it sending a new 401 to the client each time? Is the client sending the credentials in each request's headers? –  Shane Madden Jan 4 at 8:42
    
Hi Shane - thanks for the reply. I've put Wireshark on it, and in the detail it shows a 401 being demanded and the credentials then being passed back to the server once I've typed them in. NB the client in this case is Google Chrome. J. –  Jeremy Gooch Jan 4 at 16:29
    
PS. sorry, to be clear, it's demanding a 401 multiple times. –  Jeremy Gooch Jan 4 at 16:58
    
Are the subsequent 401s on the request for the same resource? In other words, is it GET / -> 401 -> GET / with authorization -> 401 -> GET / with authorization again -> 200? Or are the subsequent 401s occurring on requests for other resources? –  Shane Madden Jan 4 at 21:04
    
Hi Shane - each request is for a different resource. Is my expectation that one authorisation will cover all matching resources incorrect? –  Jeremy Gooch Jan 6 at 12:50
add comment

1 Answer

You need to set a cookie or cache the credentials some how. I've seen this when configuring Apache with one-time passcodes. mod_auth_radius supports AuthRadiusCookieValid. Not sure what you would use here.

share|improve this answer
    
Thanks - I've come to the conclusion that the basic auth directives are simply not going to work in my case, so I'll bite the bullet and look into certs, RADIUS, etc. –  Jeremy Gooch Jan 20 at 7:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.