TUTORIAL: Securing SABnzbd+ behind lighttpd authentication
Posted: June 17th, 2008, 8:44 am
This tutorial will show you how to secure your SABnzbd+ server behind lighttpd, utilizing htpasswd authentication. The method I've chosen to use will result in all WAN access being require to authenticate, while still allowing LAN connections access without authentication.
This tutorial assumes a few things:
1. You already have lighttpd installed and working.
2. SABnzbd+ is installed on the same machine as lighttpd.
3. You're doing no virtual hosting.
4. You have basic unix skills and understanding of lighttpd configuration files.
Let's get started.
First, we'll need to ensure that the proper modules are loaded, so you'll need to edit your lighttpd.conf file:
(Note: If for some reason you don't have these modules, you'lll need to compile them)
Note the order the modules are loaded in. mod_auth MUST be loaded before mod_proxy, else the connection will hang.
Next, let's add the necessary configuration:
Now, what you've done here is setup a proxy to pass all requests for http://yoursite.com/sabnzbd/ to http://localhost:8080/sabnzbd/ once authenticated. You can now set SABnzbd+ to bind ONLY to the LAN interface (127.0.0.1) since it will be accessed directly by lighttpd rather than the WAN client. You can now access SABnzbd+ locally as before via http://localhost:8080/sabnzbd/ without need for authentication.
The final step is to create an htpasswd file, located in the path you specified in the configuration above:
Now you can restart your lighttpd server and test your handwork!
Good luck! If you have problems, I'll try to help the best I can -- but please, keep this topic free of questions such as, "HOW DO I INSTALL LIGHTTPD?", "WHY DOESN'T THIS WORK ON WINDOWS?", etc.
This tutorial assumes a few things:
1. You already have lighttpd installed and working.
2. SABnzbd+ is installed on the same machine as lighttpd.
3. You're doing no virtual hosting.
4. You have basic unix skills and understanding of lighttpd configuration files.
Let's get started.
First, we'll need to ensure that the proper modules are loaded, so you'll need to edit your lighttpd.conf file:
(Note: If for some reason you don't have these modules, you'lll need to compile them)
Code: Select all
server.modules += (
"mod_auth",
"mod_proxy"
)Next, let's add the necessary configuration:
Code: Select all
$HTTP["url"] =~ "^/sabnzbd/" {
auth.debug = 0
auth.backend = "htpasswd"
auth.backend.htpasswd.userfile = "/path/to/password_file"
auth.require = (
"" => (
"method" => "basic",
"realm" => "Password Protected",
"require" => "valid-user"
)
)
proxy.server = (
"" => ((
"host" => "127.0.0.1",
"port" => 8080
))
)
}The final step is to create an htpasswd file, located in the path you specified in the configuration above:
Code: Select all
$ htpasswd -c password_file usernameCode: Select all
$ /etc/init.d/lighttpd restart