[smokeping-users] how to enforce username/password logons to access smokeping

[Murray Davis]

I am trying to set up user-based access to smokeping on a system with the
following characteristics:

2.6.32-39-generic Linux Ubuntu 10.04.1 LTS \n \l
apache2 2.2.14-5ubuntu8
smokeping 2.3.6-5

I have modified /etc/apache2/conf.d/smokeping as folllows...and restarted
apache and smokeping.

ScriptAlias /smokeping/smokeping.cgi
/usr/share/smokeping/cgi-bin/smokeping.cgi
Alias /smokeping /usr/share/smokeping/www

<Directory "/usr/share/smokeping/www">
Options FollowSymLinks
AllowOverride AuthConfig
AuthType Basic
AuthName "Password Required"
AuthUserFile /etc/passwd
</Directory>

However, when I go to http://servername/smokeping, I am taken directly to
the smokeping home page.

I then added an .htaccess file to:

/usr/share/smokeping/cgi-bin...the location of smokeping.cgi.

/usr/share/smokeping/www, the Alias referenced
in /etc/apache2/conf.d/smokeping.

The .htaccess file contains:

AuthType Basic
AuthName "Password Required"
AuthUserFile /etc/passwd

Even with these .htaccess files, I still am not prompted for a username and
password. I would like to specify a specific local user, but any local
username would be sufficient.

What do I need to do to get this working?

[Peter Kristolaitis]

This isn't really a SmokePing specific issue; it's a webserver-level thing.

That said, I don't see a "Require" directive anywhere in your config.
Try adding "Require valid-user" to your <Directory ...> block.

- Pete

Post by Murray Davis
I am trying to set up user-based access to smokeping on a system with
2.6.32-39-generic Linux Ubuntu 10.04.1 LTS \n \l
apache2 2.2.14-5ubuntu8
smokeping 2.3.6-5
I have modified /etc/apache2/conf.d/smokeping as folllows...and
restarted apache and smokeping.
ScriptAlias /smokeping/smokeping.cgi
/usr/share/smokeping/cgi-bin/smokeping.cgi
Alias /smokeping /usr/share/smokeping/www
<Directory "/usr/share/smokeping/www">
Options FollowSymLinks
AllowOverride AuthConfig
AuthType Basic
AuthName "Password Required"
AuthUserFile /etc/passwd
</Directory>
However, when I go to http://servername/smokeping, I am taken directly
to the smokeping home page.
/usr/share/smokeping/cgi-bin...the location of smokeping.cgi.
/usr/share/smokeping/www, the Alias referenced
in /etc/apache2/conf.d/smokeping.
AuthType Basic
AuthName "Password Required"
AuthUserFile /etc/passwd
Even with these .htaccess files, I still am not prompted for a
username and password. I would like to specify a specific local user,
but any local username would be sufficient.
What do I need to do to get this working?
_______________________________________________
smokeping-users mailing list
https://lists.oetiker.ch/cgi-bin/listinfo/smokeping-users

[Dan O'Neill]

The /etc/passwd file is not the same format as an authentication file
for Apache. Here is the Apache Basic Auth tutorial

http://httpd.apache.org/docs/2.0/howto/htaccess.html

Change your .htaccess file to have something like this:


AuthUserFile /usr/share/smokeping.passwords

Then use the 'htpasswd' command to create the file

/usr/bin/htpasswd -c /usr/share/smokeping.passwords murray

But do read the above tutorial. If that isn't enough, google 'apache
basic auth' and you'll find additional guidance.

Best,

dano

Post by Murray Davis
I am trying to set up user-based access to smokeping on a system with the
2.6.32-39-generic Linux Ubuntu 10.04.1 LTS \n \l
apache2  2.2.14-5ubuntu8
smokeping  2.3.6-5
I have modified /etc/apache2/conf.d/smokeping as folllows...and restarted
apache and smokeping.
ScriptAlias /smokeping/smokeping.cgi
/usr/share/smokeping/cgi-bin/smokeping.cgi
Alias /smokeping /usr/share/smokeping/www
<Directory "/usr/share/smokeping/www">
    Options FollowSymLinks
    AllowOverride AuthConfig
    AuthType Basic
    AuthName "Password Required"
    AuthUserFile /etc/passwd
</Directory>
However, when I go to http://servername/smokeping, I am taken directly to
the smokeping home page.
/usr/share/smokeping/cgi-bin...the location of smokeping.cgi.
/usr/share/smokeping/www, the Alias referenced
in  /etc/apache2/conf.d/smokeping.
AuthType Basic
AuthName "Password Required"
AuthUserFile /etc/passwd
Even with these .htaccess files, I still am not prompted for a username and
password. I would like to specify a specific local user, but any local
username would be sufficient.
What do I need to do to get this working?
_______________________________________________
smokeping-users mailing list
https://lists.oetiker.ch/cgi-bin/listinfo/smokeping-users

[Murray Davis]

Thank you to Peter and Dan for their replies. After reading Peter's
response, I started looking at Apache's documentation and got things
working. As I was about to respond to the list server, I noticed Dan's
response which basically confirmed my approach. Here goes:

Step 1: Created an apache username:

htpasswd -c /etc/apache2/passwords smokeping

Step 2: Modified the smokeping config file.../etc/apache2/conf.d/smokeping

ScriptAlias /smokeping/smokeping.cgi
/usr/share/smokeping/cgi-bin/smokeping.cgi
Alias /smokeping /usr/share/smokeping/www

<Directory "/usr/share/smokeping/www">
Options FollowSymLinks
AllowOverride AuthConfig
AuthType Basic
AuthName "Restricted Files"
AuthUserFile /etc/apache2/passwords
Require user cacti
</Directory>

I changed AuthName from "Require Password" to "Restricted Files".

Step 3 Placed an .htaccess file in the root of smokeping's home directory.
I started with placing it in /usr/share/smokeping/www and cgi-bin, but
ended up placing it at the parent level.

AuthType Basic
AuthName "Restricted Files"
AuthUserFile /etc/apache2/passwords
Require user smokeping

I restarted Apache and smokeping and I am now prompted for a
username/password. Only the smokeping user gets in. If I click on the
"Cancel" button on the logon window, I am then met with an Failed
Authorization window whereas when AuthName was "Require Password", I would
be taken to the smokeping webpage.

Thanks for the help...

mgd

[Darren Murphy]

Just as an aside to this - if you _are_ using HTTP authentication,
there is a trivial modification you can make to Smokeping.pm, that
will make the logged-in user name available for use in the HTML
template.

See https://github.com/mcdarren/SmokePing/commit/50333cf052a6fc2ed29f16639ac1d0c891978b38

With that change in place, you can then use something like the
following in basepage.html

<h3>Logged in as <##authuser##></h3>

cheers,
Darren

PS. Tobi - is this worth a pull request?

Post by Murray Davis
Thank you to Peter and Dan for their replies. After reading Peter's
response, I started looking at Apache's documentation and got things
working. As I was about to respond to the list server, I noticed Dan's
htpasswd -c /etc/apache2/passwords smokeping
Step 2: Modified the smokeping config file.../etc/apache2/conf.d/smokeping
ScriptAlias /smokeping/smokeping.cgi
/usr/share/smokeping/cgi-bin/smokeping.cgi
Alias /smokeping /usr/share/smokeping/www
<Directory "/usr/share/smokeping/www">
    Options FollowSymLinks
    AllowOverride AuthConfig
    AuthType Basic
    AuthName "Restricted Files"
    AuthUserFile /etc/apache2/passwords
    Require user cacti
</Directory>
I changed AuthName from "Require Password" to "Restricted Files".
Step 3 Placed an .htaccess file in the root of smokeping's home directory. I
started with placing it in /usr/share/smokeping/www and cgi-bin, but ended
up placing it at the parent level.
AuthType Basic
AuthName "Restricted Files"
AuthUserFile /etc/apache2/passwords
Require user smokeping
I restarted Apache and smokeping and I am now prompted for a
username/password. Only the smokeping user gets in. If I click on the
"Cancel" button on the logon window, I am then met with an Failed
Authorization window whereas when AuthName was "Require Password", I would
be taken to the smokeping webpage.
Thanks for the help...
mgd
_______________________________________________
smokeping-users mailing list
https://lists.oetiker.ch/cgi-bin/listinfo/smokeping-users