# Satisfy problem

**URL:** <https://www.ruby-forum.com/t/satisfy-problem/205495>\
**Category:** NGINX\
**Created:** [April 7, 2011, 5:53pm UTC](https://www.ruby-forum.com/t/satisfy-problem/205495 "2011-04-07T17:53:03Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![luislavena](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@luislavena](https://www.ruby-forum.com/u/luislavena)\
**Post date:** [April 7, 2011, 5:53pm UTC](https://www.ruby-forum.com/t/satisfy-problem/205495/1 "2011-04-07T17:53:03Z")

</div>

in 0.9.7  
use:

```
    location ^~ /ks/admin
    {
            satisfy any;
            allow 10.68.136.241/32;
            allow 10.66.23.80/32;
            deny all;
            auth_basic "passwd";
            auth_basic_user_file ksadminpasswd;
   }

```

when IP is not 10.68.136.241 or 10.66.23.80, people can still visit  
/ks/admin,not prompt for user and passwd.

Is this a bug?

---

<div class="post-metadata">

**Author:** ![lhmwzy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/90db22/32.png) [@lhmwzy](https://www.ruby-forum.com/u/lhmwzy)\
**Post date:** [April 7, 2011, 7:01pm UTC](https://www.ruby-forum.com/t/satisfy-problem/205495/2 "2011-04-07T19:01:38Z")

</div>

On Thu, Apr 07, 2011 at 11:52:09PM +0800, lhmwzy wrote:

Hi there,

> when IP is not 10.68.136.241 or 10.66.23.80, people can still visit  
> /ks/admin,not prompt for user and passwd.

When I test that, I get the http 401 password challenge that I expect.

So I don’t see the problem.

What does your debug log say?

## f

Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![lhmwzy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/90db22/32.png) [@lhmwzy](https://www.ruby-forum.com/u/lhmwzy)\
**Post date:** [April 7, 2011, 8:28pm UTC](https://www.ruby-forum.com/t/satisfy-problem/205495/3 "2011-04-07T20:28:07Z")

</div>

On 7 April 2011 17:52, lhmwzy [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> ```
> auth_basic_user_file ksadminpasswd;
> }
> 
> ```
> 
> when IP is not 10.68.136.241 or 10.66.23.80, people can still visit  
> /ks/admin,not prompt for user and passwd.
> 
> Is this a bug?

Don’t you want satisfy _all_?

---

<div class="post-metadata">

**Author:** ![lhmwzy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/90db22/32.png) [@lhmwzy](https://www.ruby-forum.com/u/lhmwzy)\
**Post date:** [April 8, 2011, 1:52am UTC](https://www.ruby-forum.com/t/satisfy-problem/205495/4 "2011-04-08T01:52:21Z")

</div>

I have found the reason:  
when install the module named nginx-accesskey-2.0.3,then the bug will  
appear.

---

<div class="post-metadata">

**Author:** ![lhmwzy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/90db22/32.png) [@lhmwzy](https://www.ruby-forum.com/u/lhmwzy)\
**Post date:** [April 8, 2011, 2:09am UTC](https://www.ruby-forum.com/t/satisfy-problem/205495/5 "2011-04-08T02:09:03Z")

</div>

Today Apr 8, 2011 at 07:52 lhmwzy wrote:

> I have found the reason:  
> when install the module named nginx-accesskey-2.0.3,then the bug will appear.

It return NGX\_OK when not configured.  
Fix:

— ../nginx-accesskey-2.0.3/ngx\_http\_accesskey\_module.c.orig  
2007-12-30  
+++ ../nginx-accesskey-2.0.3/ngx\_http\_accesskey\_module.c  
2010-07-18  
@@ -125,7 +125,7 @@  
alcf = ngx\_http\_get\_module\_loc\_conf(r, ngx\_http\_accesskey\_module);

```
 if (!alcf->enable) {

```

- 

```
   return NGX_OK;

```

- 

```
   return NGX_DECLINED;

```

}

if (!alcf-\>signature\_lengths || !alcf-\>signature\_values) {

---

<div class="post-metadata">

**Author:** ![lhmwzy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/90db22/32.png) [@lhmwzy](https://www.ruby-forum.com/u/lhmwzy)\
**Post date:** [April 8, 2011, 1:53am UTC](https://www.ruby-forum.com/t/satisfy-problem/205495/6 "2011-04-08T01:53:36Z")

</div>

nginx -V without nginx-accesskey-2.0.3  
nginx: configure arguments: --prefix=/usr/local/etc/nginx  
–with-cc-opt=’-I /usr/local/include’ --with-ld-opt=’-L  
/usr/local/lib’ --conf-path=/usr/local/etc/nginx/nginx.conf  
–sbin-path=/usr/local/sbin/nginx --pid-path=/var/run/nginx.pid  
–error-log-path=/var/log/nginx-error.log --user=www --group=www  
–http-client-body-temp-path=/var/tmp/nginx/client\_body\_temp  
–http-fastcgi-temp-path=/var/tmp/nginx/fastcgi\_temp  
–http-proxy-temp-path=/var/tmp/nginx/proxy\_temp  
–http-scgi-temp-path=/var/tmp/nginx/scgi\_temp  
–http-uwsgi-temp-path=/var/tmp/nginx/uwsgi\_temp  
–http-log-path=/var/log/nginx-access.log --with-http\_addition\_module  
–add-module=/usr/ports/www/nginx-devel/work/ngx\_headers\_more\_module-0.14  
–with-http\_gzip\_static\_module --with-http\_realip\_module  
–with-http\_secure\_link\_module --with-http\_ssl\_module  
–with-http\_stub\_status\_module --with-http\_sub\_module  
–add-module=/usr/ports/www/nginx-devel/work/nginx\_upstream\_fair-20090923  
–add-module=/usr/ports/www/nginx-devel/work/nginx\_upstream\_hash-0.3.1  
–add-module=/usr/ports/www/nginx-devel/work/ngx\_http\_upstream\_keepalive-0.3  
–with-pcre

nginx -V with nginx-accesskey-2.0.3  
nginx: configure arguments: --prefix=/usr/local/etc/nginx  
–with-cc-opt=’-I /usr/local/include’ --with-ld-opt=’-L  
/usr/local/lib’ --conf-path=/usr/local/etc/nginx/nginx.conf  
–sbin-path=/usr/local/sbin/nginx --pid-path=/var/run/nginx.pid  
–error-log-path=/var/log/nginx-error.log --user=www --group=www  
–http-client-body-temp-path=/var/tmp/nginx/client\_body\_temp  
–http-fastcgi-temp-path=/var/tmp/nginx/fastcgi\_temp  
–http-proxy-temp-path=/var/tmp/nginx/proxy\_temp  
–http-scgi-temp-path=/var/tmp/nginx/scgi\_temp  
–http-uwsgi-temp-path=/var/tmp/nginx/uwsgi\_temp  
–http-log-path=/var/log/nginx-access.log  
–add-module=/usr/ports/www/nginx-devel/work/nginx-accesskey-2.0.3  
–with-http\_addition\_module  
–add-module=/usr/ports/www/nginx-devel/work/ngx\_headers\_more\_module-0.14  
–with-http\_gzip\_static\_module --with-http\_realip\_module  
–with-http\_secure\_link\_module --with-http\_ssl\_module  
–with-http\_stub\_status\_module --with-http\_sub\_module  
–add-module=/usr/ports/www/nginx-devel/work/nginx\_upstream\_fair-20090923  
–add-module=/usr/ports/www/nginx-devel/work/nginx\_upstream\_hash-0.3.1  
–add-module=/usr/ports/www/nginx-devel/work/ngx\_http\_upstream\_keepalive-0.3  
–with-pcre

---

<div class="post-metadata">

**Author:** ![lhmwzy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/90db22/32.png) [@lhmwzy](https://www.ruby-forum.com/u/lhmwzy)\
**Post date:** [April 8, 2011, 6:17am UTC](https://www.ruby-forum.com/t/satisfy-problem/205495/7 "2011-04-08T06:17:29Z")

</div>

another problem:

when use:  
location ^~ /ks/admin  
{  
satisfy any;  
allow 10.68.136.241/32;  
allow 10.66.23.80/32;  
deny all;  
auth\_basic “passwd”;  
auth\_basic\_user\_file ksadminpasswd;  
}  
then the 401 error page can not be customized,only show the default  
401error page:

"401 Authorization Required

---

<div class="post-metadata">

**Author:** ![lhmwzy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/90db22/32.png) [@lhmwzy](https://www.ruby-forum.com/u/lhmwzy)\
**Post date:** [April 8, 2011, 6:56am UTC](https://www.ruby-forum.com/t/satisfy-problem/205495/8 "2011-04-08T06:56:19Z")

</div>

my conf is:

server {  
listen 80;  
server\_name 10.66.23.112;  
#charset koi8-r;  
more\_set\_headers “Server:lhmwzy web server”;  
access\_log off;  
root /usr/www/112/www;  
index index.php index.html index.htm;  
location ^~ /phpmyadmin/  
{  
satisfy any;  
#allow 10.68.136.241;  
allow 10.68.9.210;  
deny all;  
auth\_basic “passwd”;  
auth\_basic\_user\_file ksadminpasswd;  
location ~ .php$ {  
fastcgi\_pass 127.0.0.1:10080;  
include fastcgi;  
fastcgi\_index index.php;  
}  
}

```
    location ~ \.php$ {
            fastcgi_pass 127.0.0.1:10080;
            include fastcgi;
            fastcgi_index index.php;
            }

    error_page 401 403 /error/401.html;
    error_page 404 /error/404.html;
    error_page 500 502 503 504 = /error/50x.html;

```

}

When access phpmyadmin from 10.68.136.241, nginx can not show the  
/error/401.html,but the default 401 error\_page.

---

<div class="post-metadata">

**Author:** ![lhmwzy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/90db22/32.png) [@lhmwzy](https://www.ruby-forum.com/u/lhmwzy)\
**Post date:** [April 11, 2011, 12:12pm UTC](https://www.ruby-forum.com/t/satisfy-problem/205495/9 "2011-04-11T12:12:35Z")

</div>

On Fri, Apr 08, 2011 at 12:16:34PM +0800, lhmwzy wrote:

> ```
> auth_basic_user_file ksadminpasswd;
> }
> 
> ```
> 
> then the 401 error page can not be customized,only show the default  
> 401error page:
> 
> ## "401 Authorization Required
> 
> nginx/0.9.7  
> ".

The attached patch should fix the bug.

---

<div class="post-metadata">

**Author:** ![lhmwzy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/90db22/32.png) [@lhmwzy](https://www.ruby-forum.com/u/lhmwzy)\
**Post date:** [April 11, 2011, 12:20pm UTC](https://www.ruby-forum.com/t/satisfy-problem/205495/10 "2011-04-11T12:20:00Z")

</div>

On Mon, Apr 11, 2011 at 02:11:58PM +0400, Igor S. wrote:

> > ```
> > auth_basic "passwd";
> > 
> > ```
> 
> The attached patch should fix the bug.  
> A new better patch.

---

<div class="post-metadata">

**Author:** ![lhmwzy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/90db22/32.png) [@lhmwzy](https://www.ruby-forum.com/u/lhmwzy)\
**Post date:** [April 11, 2011, 4:51pm UTC](https://www.ruby-forum.com/t/satisfy-problem/205495/11 "2011-04-11T16:51:25Z")

</div>

this is working…TKS

2011/4/11 Igor S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

---

<div class="post-metadata">

**Author:** ![lhmwzy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/90db22/32.png) [@lhmwzy](https://www.ruby-forum.com/u/lhmwzy)\
**Post date:** [April 11, 2011, 4:50pm UTC](https://www.ruby-forum.com/t/satisfy-problem/205495/12 "2011-04-11T16:50:10Z")

</div>

this is not working…

2011/4/11 Igor S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

---

<div class="post-metadata">

**Author:** ![lhmwzy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/90db22/32.png) [@lhmwzy](https://www.ruby-forum.com/u/lhmwzy)\
**Post date:** [April 11, 2011, 5:01pm UTC](https://www.ruby-forum.com/t/satisfy-problem/205495/13 "2011-04-11T17:01:18Z")

</div>

sorry,this is working too.  
tks again.

2011/4/11 lhmwzy [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

---

<div class="post-metadata">

**Author:** ![lhmwzy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/90db22/32.png) [@lhmwzy](https://www.ruby-forum.com/u/lhmwzy)\
**Post date:** [April 12, 2011, 4:20am UTC](https://www.ruby-forum.com/t/satisfy-problem/205495/14 "2011-04-12T04:20:49Z")

</div>

I have some questions for this.but my nginx is 0.8.54,howto change .ths

Posted at Nginx Forum:

> **[Re: satisfy problem](https://forum.nginx.org/read.php?2,189160,190374#msg-190374)**
>
> in 0.9.7 use: location ^~ /ks/admin { satisfy any; allow 10.68.136.241/32; allow 10.66.23.80/32; deny all; auth\_basic "passwd";

---

<div class="post-metadata">

**Author:** ![lhmwzy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/90db22/32.png) [@lhmwzy](https://www.ruby-forum.com/u/lhmwzy)\
**Post date:** [April 12, 2011, 4:30am UTC](https://www.ruby-forum.com/t/satisfy-problem/205495/15 "2011-04-12T04:30:03Z")

</div>

use this patch is not working!

Posted at Nginx Forum:

> **[Re: satisfy problem](https://forum.nginx.org/read.php?2,189160,190376#msg-190376)**
>
> in 0.9.7 use: location ^~ /ks/admin { satisfy any; allow 10.68.136.241/32; allow 10.66.23.80/32; deny all; auth\_basic "passwd";