[Linux] Allow from localhost 失效 @ Ubuntu 14.04 / Apache 2.4.7

[Linux] Allow from localhost 失效 @ Ubuntu 14.04 / Apache 2.4.7

週末把某檯機器更新後，發現原先寫的 apache.conf 失效，主要是 Allow from localhost 這段：

<Directory /data/path>
AuthType Basic
AuthName "Password Required"
AuthUserFile /path/auth_pass

Order allow,deny
Allow from localhost
# Allow from DeviceIP


Satisfy any
</Directory>

直到我加上 DeviceIP 後才行。

$ wget -O /dev/null http://localhost/service/api
Resolving localhost (localhost)... 127.0.0.1
Connecting to localhost (localhost)|127.0.0.1|:443... connected.
WARNING: no certificate subject alternative name matches
        requested host name ‘localhost’.
HTTP request sent, awaiting response... 401 Unauthorized

Username/Password Authentication Failed.

追了一下，發現是 iptables 的設定，把這條拿掉就行了：

iptables --table nat --append POSTROUTING --jump MASQUERADE

此筆記是用來記錄，iptables 的影響 Orz

[Linux] Nginx 提供 localhost 不受 authorization 限制 @ Ubuntu 12.004

最近用 nginx 架設服務時，採用 HttpAuthBasicModule 限制存取時必須認證才行，然而，偶爾還是希望某些特定 IP 可以不受限制，研究一下是可行的:

http://nginx.org/en/docs/http/ngx_http_core_module.html#satisfy

syntax: satisfy all | any;
default:
satisfy all;
context: http, server, location

Allows access if all (all) or at least one (any) of the ngx_http_access_module, ngx_http_auth_basic_module or ngx_http_auth_request_module modules allow access.

因此，就只需在特定的 location 中，加上上述敘述即可：

location ^~ /service/ {
satisfy any;

# ngx_http_access_module
allow 127.0.0.1/32;
deny all;

# ngx_http_auth_basic_module
auth_basic "Restricted Area";
auth_basic_user_file    htpasswd;

# …
}