[HELP] : Cannot make it work.

[ericxuo]

Hi,

I'd like to add a 2FA authentication for some specific applications (subsonic for ex) on my web site.
Currently, I've got some Letsencrypt certificates for all my subdomains.
Here is my current subsonic.conf file :

<VirtualHost *:443>

    <IfModule mod_headers.c>
	    Header always set Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"
    </IfModule>

    <IfModule mod_proxy_http.c>
	ProxyRequests Off
	ProxyPreserveHost On
	ServerName subsonic.my_domain.fr
	RequestHeader unset Accept-Encoding
    
	<Location />
	    Order allow,deny
	    Allow from all
	    ProxyPass http://192.168.0.14:4040/
	    ProxyPassReverse http://192.168.0.14:4040/
	</Location>

    </IfModule>

</VirtualHost>

192.168.0.14 is the local ip of wy Web server on which Apache is running.

Here is the apache_2fa.conf file :

<VirtualHost *:443>
    
    RewriteEngine On

    RewriteCond %{REQUEST_URI} ^/subsonic/
    RewriteCond %{REQUEST_URI} !^/auth/
    RewriteCond %{HTTP_COOKIE} !^.*2FA_Auth=([a-zA-Z0-9]+)
    RewriteRule ^(.*)$ /auth/auth?$1?%{QUERY_STRING} [L,R=302]

    RewriteCond %{REQUEST_URI} !^/auth/
    RewriteCond %{HTTP_COOKIE} ^.*2FA_Auth=([a-zA-Z0-9]+)
    RewriteCond /usr/share/apache_2fa/state/%1 !-f
    RewriteRule ^(.*)$ /auth/auth?$1?%{QUERY_STRING} [L,R=302]

    ScriptAlias /auth/ /usr/share/apache_2fa/

    <Directory /usr/share/apache_2fa>
	AuthType Digest
	AuthName "my_domain.fr"
	AuthDigestDomain /
	AuthDigestProvider file
	AuthUserFile /usr/share/apache_2fa/apache_credentials
	Require valid-user
    </Directory>

    <Directory /usr/share/subsonic>
	AuthType Digest
	AuthName "my_domain.fr"
	AuthDigestDomain /
	AuthDigestProvider file
	AuthUserFile /usr/share/apache_2fa/apache_credentials
	Require valid-user
    </Directory>
    
</VirtualHost>

After I've :

systemctl restart httpd

I'm not asked for any auth.

Do you have any idea to help me to solve this issue ?

Regards.

Xuo.

[itemir]

Here is a quick AI analysis:

Hi Xuo,

I think there are two likely issues here.

First, the apache_2fa rules need to be inside the same VirtualHost that serves subsonic.my_domain.fr. Right now your subsonic.conf has ServerName subsonic.my_domain.fr, while apache_2fa.conf defines a separate <VirtualHost *:443> without that ServerName. Apache will only use one vhost for the request, so your rewrite rules may never run.

You can confirm this with:

apachectl -S

Second, this condition does not match your setup:

RewriteCond %{REQUEST_URI} ^/subsonic/

If you access Subsonic as:

https://subsonic.my_domain.fr/

then the request URI is /, not /subsonic/.

Try moving the apache_2fa config into the subsonic.my_domain.fr VirtualHost and remove the /subsonic/ condition, for example:

<VirtualHost *:443>
    ServerName subsonic.my_domain.fr

    RewriteEngine On

    RewriteCond %{REQUEST_URI} !^/auth/
    RewriteCond %{HTTP_COOKIE} !^.*2FA_Auth=([a-zA-Z0-9]+)
    RewriteRule ^(.*)$ /auth/auth?$1?%{QUERY_STRING} [L,R=302]

    RewriteCond %{REQUEST_URI} !^/auth/
    RewriteCond %{HTTP_COOKIE} ^.*2FA_Auth=([a-zA-Z0-9]+)
    RewriteCond /usr/share/apache_2fa/state/%1 !-f
    RewriteRule ^(.*)$ /auth/auth?$1?%{QUERY_STRING} [L,R=302]

    ScriptAlias /auth/ /usr/share/apache_2fa/

    <Directory /usr/share/apache_2fa>
        AuthType Digest
        AuthName "my_domain.fr"
        AuthDigestDomain /
        AuthDigestProvider file
        AuthUserFile /usr/share/apache_2fa/apache_credentials
        Require valid-user
    </Directory>

    ProxyRequests Off
    ProxyPreserveHost On
    RequestHeader unset Accept-Encoding

    <Location />
        ProxyPass http://192.168.0.14:4040/
        ProxyPassReverse http://192.168.0.14:4040/
    </Location>
</VirtualHost>

Also, the <Directory /usr/share/subsonic> block probably does not help here, because the application is being served through ProxyPass, not directly from that local directory.

After changing it, run:

apachectl configtest
systemctl reload httpd

Hope this helps.

[ericxuo]

Hi,

Thank you for your answer. It didn't work. I've asked AI and after many trials, it could propose something working but which is not what I was looking for.
Here is the final Apache conf file :

<VirtualHost *:443>

    ServerName subsonic.my_domain.fr

    ProxyPreserveHost On
    ProxyRequests Off

    ProxyPass / http://192.168.0.14:4040/
    ProxyPassReverse / http://192.168.0.14:4040/

    <Location />
        AuthType Digest
        AuthName "subsonic.my_domain.fr"
        AuthDigestProvider file
        AuthUserFile /usr/share/apache_2fa/apache_credentials
        Require valid-user
    </Location>

</VirtualHost>

At the end, I've just got a pop-up window that asks me from a username and password (the same way as when we use the htpasswd command). This works but I was expecting to be able to enter a code from my TOTP application on my phone.
The IA proposed me to use Authelia but I'd prefer to use something simple (if any).

Any help will be appreciated.

regards.

Xuo.