How to setup?

[phoo8ar]

Hi there and thx for the module.
I'm trying to wrap my head around how to setup and authenticate.

The module is statically compiled into version 1.29.1 of Nginx and is "visible" as below
Adding the proposed section to the location I'm only getting a 401 Authorization Required when trying to reach the server. Without the protected part it runs as normal.

Output of -V:
nginx version: nginx/1.29.1
built by gcc 14.2.0 (Debian 14.2.0-19)
built with OpenSSL 3.5.1 1 Jul 2025
TLS SNI support enabled
configure arguments: --prefix=/usr/local/nginx --sbin-path=/usr/local/nginx/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --pid-path=/us
r/local/nginx/run/nginx.pid --lock-path=/usr/local/nginx/run/nginx.lock --error-log-path=/usr/local/nginx/log/error.log --http-log-path=/usr/local
/nginx/log/access.log --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_auth_request_module --with-http_v2_module --with-http_dav_module --with-http_slice_module --with-http_addition_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_sub_module --with-mail_ssl_module --with-stream_ssl_module --with-stream --add-module=../nginx-http-auth-totp-1.1.0

Any way to debug the setup any further?

[61131]

Hi @phoo8ar,

The return of the 401 Authorization Required suggests that you have correctly built and installed the module. Can you share your nginx.conf configuration as it relates to the nginx-http-auth-totp module and any messages returned in the error log?

Thanks in advance.

Regards,
Rob

[phoo8ar]

@61131, thank you for your quick response, really appreciate it.

Actually it seems that there was a cookie (or two) that were lying around because of different testing.
Now I have come a little bit further. I'm now prompted with the auth prompted username/password for authentication. However I get a positive auth with any kind of username/password and no traces in the error log. I can see traces of the username in the access log but nothing else. The site is open to any combination of username and password

1.2.3.4 - foo [25/Sep/2025:15:40:08 +0200] "GET / HTTP/1.1" 200 1288 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0"

When it comes to the config file, It looks like this:

server {
    server_name monitor.xxx.yyy;
    listen [::]:443 ssl; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/monitor.xxx.yyy/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/monitor.xxx.yyy/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    location / {
        auth_totp_realm "Protected";
        auth_totp_file /usr/local/nginx/conf/totp.conf;
        auth_totp_length 6;
        auth_totp_reuse off;
        auth_totp_skew 1;
        auth_totp_step 1m;
        auth_totp_cookie "pbl-totp-session";
        auth_totp_expiry 1d;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://frank;
        proxy_read_timeout 90;
    }
} 

BR

[61131]

Thanks for this additional detail - To simplify this process, I would suggest reverting a more basic configuration without proxy_pass so that we can debug this issue. There is no reason that I am aware of as to why nginx-http-auth-totp should not work with proxy_pass, but I would like to remove this variable from the configuration to understand what is happening.

[phoo8ar]

I removed all the proxy directives and added one simple line for configuration. Unfortunately the same behavior. Any combination of usernames/passwords gives access. No additional info in access or error.log

root /usr/local/nginx/html;