SECURITY! password protected directories

[SebastianK1]

He forums,

if I create a password protected directory in plesk 12.5 it will create the directory protection. But just for the directory, not for the files inside!

If I "abort" at the login popup, the page behind is shown!!!!!!

If I know the files behind, I can directly access all files by clicking "abort" at the login popup, e.g. domain.com/secured/file1.php

I deleted and added the directory protection new, but same problem. Any hints?

 

[IgorG]

Hmm... I always see 401 Authorization Required page whenever I click "Cancel" for popup password window.
Have you created user with password for protection directory?

 

[SebastianK1]

yes, user and password created!

 

[IgorG]

Try to run

# plesk repair web
# plesk repair fs

and check results.

 

[sebgonzes]

If you use php-fpm for your domain, protect directory not work correctly, it's an bug that I reported in december 2015 and have not been solved yet :
#PPPM-3839

 

[SebastianK1]

@IgorG
is there any parameter to start a dry run? Without action? First I want to see what errors the tool finds.

@sebgonzes
thanks! Yes, running php-fpm.....

Best,

Sebastian

 

[sebgonzes]

Well, answer about support to solve problem is for now this one :

workaround #1: Use non-'PHP-FPM...' PHP-handler. For example set 'FastCGI application served by Apache' via 'Home > Subscriptions > example.com > Websites & Domains > PHP Settings > run PHP as'.

Note: This workaround is applicable if there are no strict requirements to the PHP-handler used on the website:

workaround #2: Set additional nginx directives in the 'Home > Subscriptions > example.com > Websites & Domains > Apache & nginx Settings > Additional nginx directives' field. For example to protect the '/var/www/vhosts/example.com/httpdocs/prot' directory add the following:
==========================
location ~* (/prot/) {
auth_basic "Protected by password";
auth_basic_user_file /var/www/vhosts/example.com/httpdocs/.htpasswd;
root /var/www/vhosts/example.com/httpdocs;
}
==========================

Where '.htpasswd' is a file with user name and password:
==========================
# cat /var/www/vhosts/a.tld/httpdocs/.htpasswd
test_user:$1$-encrypted_test_password
==========================