1 Topic by xazziri (edited by xazziri 2016-03-03 06:27:04)

  • xazziri
  • Member
  • Offline
  • Registered: 2016-03-03
  • Posts: 2

Topic: Adding extra security to iRedAdmin

==== Required information ====
- iRedMail version (check /etc/iredmail-release): 0.9.4 (OS)
- Linux/BSD distribution name and version: Debian 8.0
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL (MariaDB)
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? yes, but not on this testing machine
- Related log if you're reporting an issue:
====

Okay, we run a production machine with iRedAdmin-Pro on apache. Now I was playing aroud with the free edition to check out the newest version in combination with nginx. I was trying to add some extra security to the iRedAdmin panel before exposing it to the web. I was thinking about adding a authentication layer with  auth_basic, but I can not figure out where to put the lines:

auth_basic "Restricted"; 
auth_basic_user_file /somelocation/.htpasswd

I've tried a lot of places, mostly in /etc/nginx/templates/iredadmin.tmpl, but it does not seem to work. Does anyone have an idea how (where) to do this, or how to add other extra security layer (maybe an IP filter?). Or is this totally unnecessary?

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,792

Re: Adding extra security to iRedAdmin

xazziri wrote:

I can not figure out where to put the lines:
auth_basic "Restricted"; 
auth_basic_user_file /somelocation/.htpasswd

This can be added in Apache config file. Or '.htaccess' file under the web directory.

If you're running Nginx, you need this tutorial instead:
http://nginx.org/en/docs/http/ngx_http_ … odule.html

3 Reply by xazziri

  • xazziri
  • Member
  • Offline
  • Registered: 2016-03-03
  • Posts: 2

Re: Adding extra security to iRedAdmin

Thanks for your answer. In the end I just tried every possible option in the location and server parts, with nginx restarts and cache clearing in browsers in between.

Turns out I had to put it in /etc/nginx/templates/iredadmin.tmpl, just below the line:
location ~ ^/iredadmin(.*) {