Introduction

NGINX is a popular web server that provides a high-performance, scalable, and flexible platform for hosting web applications. As with any web server, security is a top concern to ensure that your server remains safe from unauthorized access and malicious activities. In this blog post, we will demonstrate how to restrict access to your NGINX server based on IP address, HTTP method, and URI, as well as how to authenticate requests using basic authentication.

Restricting Access to NGINX Based on IP Address

To restrict access to your NGINX server based on IP address, you can use the allow and deny directives in your NGINX configuration file. The allow directive allows access from a specific IP address or range of IP addresses, while the deny directive denies access from a specific IP address or range of IP addresses.

For example, to allow access from only the IP address 192.168.1.100, you can add the following lines to your NGINX configuration file:

http {
    ...
    limit_except GET {
        allow 192.168.1.100;
        deny all;
    }
}

This configuration will allow only GET requests from the IP address 192.168.1.100 and deny all other requests.

You can also specify a range of IP addresses by using CIDR notation. For example:

http {
    ...
    limit_except GET {
        allow 192.168.1.0/24;
        deny all;
    }
}

This configuration will allow only GET requests from the entire subnet 192.168.1.0/24.

Restricting Access to NGINX Based on HTTP Method

To restrict access to your NGINX server based on the HTTP method (e.g., GET, POST, PUT, DELETE), you can use the if directive with the http_method variable.

For example, to allow only GET and POST requests:

http {
    ...
    if ($request_method = GET) {
        allow all;
    }
    if ($request_method = POST) {
        allow all;
    }
    deny all;
}

This configuration will allow only GET and POST requests and deny all other requests.

Demonstrating Basic Authentication (Auth Basic)

Basic authentication is a simple form of authentication where the client provides a username and password in the request headers. To enable basic authentication in NGINX, you can use the auth_basic directive.

For example:

http {
    ...
    auth_basic "Restricted Area";
    auth_basic_user_file /etc/nginx/.htpasswd;
}

In this example, we are setting the basic authentication realm to “Restricted Area” and specifying the path to the password file /etc/nginx/.htpasswd.

The .htpasswd file should contain lines in the format <username>:<password>:

user1:password1
user2:password2

When a client attempts to access a restricted resource, they will be prompted to enter a username and password.

Restricting URIs

To restrict access to specific URIs, you can use the location directive with a regular expression.

For example, to restrict access to the /admin URI:

http {
    ...
    location /admin {
        auth_basic "Admin Area";
        auth_basic_user_file /etc/nginx/.htpasswd;
        allow 192.168.1.100;
        deny all;
    }
}

In this example, we are restricting access to the /admin URI and allowing only requests from the IP address 192.168.1.100. All other requests will be denied.

Conclusion

In this blog post, we demonstrated how to restrict access to your NGINX server based on IP address, HTTP method, and URI, as well as how to authenticate requests using basic authentication. By implementing these security measures, you can significantly improve the security of your NGINX server and protect it from unauthorized access and malicious activities.

Remember to always keep your NGINX configuration up-to-date and secure by regularly updating your server software and configuring your firewall correctly.