This question comes up every so often, and its actually fairly easy besides the fact you do not use an .htaccess file. To do so we’ll need the auth_basic module which comes included with Nginx.
First we’ll need to create a password file, you can create this in the folder you wish to protect (though the file can reside anywhere Nginx has access to).
Creating .htpasswd
If you previously had apache/httpd installed on your machine you may still have some of the utilities that came with it. In this case we’ll want to use the htpasswd command:
htpasswd -c /var/www/domain.com/admin/.htpasswd username
When you run the above command, it will prompt you for a password for the provided username, and then create the file .htpasswd in the folder you specified. If you already have a pre-existing password file, you can omit the -c flag. You can use the -D flag to remove the specified user from a password file.
If you do not have htpasswd on your system, you can create the file yourself which each line in the format of:
username:encrypted-password:comment
To generate the encrypted password you can use Perl which is installed on most systems.
perl -le 'print crypt("your-password", "salt-hash")'
Or you can use Ruby via the interactive console command ‘irb’:
"your-password".crypt("salt-hash")
Setting up Nginx
Add protection for the /admin folder.
server {
listen 80;
server_name domain.com www.domain.com;
location / {
# your normal content
}
location /admin {
auth_basic "Administrator Login";
auth_basic_user_file /var/www/domain.com/admin/.htpasswd;
}
#!!! IMPORTANT !!! We need to hide the password file from prying eyes
# This will deny access to any hidden file (beginning with a .period)
location ~ /\. { deny all; }
}With the above access to the admin directory will prompt the user with a basic authentication dialog, and will be challenged against the password file provided.
Additional Security Considerations
The password file itself does not have to be named .htpasswd, but if you do store it a web-accessible location make sure to protect it. With the last location block above using any name with a period in front should be protected from web-access.
The safest place to store a password file is outside of the web-accessible location even if you take measures to deny access. If you wish to do so, you can create a protected folder in your nginx/conf directory to store your password files (such as conf/domain.com/folder-name/password) and load the user file from that location in your configuration.