# Secure FS Service with authentification

**URL:** <https://forum.genieacs.com/t/secure-fs-service-with-authentification/1919>\
**Category:** Uncategorized\
**Created:** [August 5, 2021, 4:24pm UTC](https://forum.genieacs.com/t/secure-fs-service-with-authentification/1919 "2021-08-05T16:24:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Timeuhmeuh](https://avatars.discourse-cdn.com/v4/letter/t/76d3ee/32.png) [@Timeuhmeuh](https://forum.genieacs.com/u/Timeuhmeuh)\
**Post date:** [August 5, 2021, 4:24pm UTC](https://forum.genieacs.com/t/secure-fs-service-with-authentification/1919/1 "2021-08-05T16:24:03Z")

</div>

Hi,

I need to secure the FS service with authentication so that files are private.

In 1.1.3 I was simply using this below and it seems to me that it worked.  
(LUA script checks the device S/N in a third-party database and it works for cwmp service)

```auto
location / {
                access_by_lua_file /usr/local/openresty/nginx/conf/auth_acs.lua;
                proxy_pass http://127.0.0.1:7567;
        }

```

In 1.2.5, I cannot add an authentication mechanism to the config updater provision.

```auto
// Compare the current revision with the expected revision
if (cur_rev == res.expected_version) {
    log(serial + ' => is in the latest version')
    return;
    } else {
    log(serial + ' => Current revision: ' + cur_rev + ' & Remote revision: ' + res.expected_version);
    log(serial + ' => Need Config Update');

    declare("Downloads.[FileType:3 Vendor Configuration File]", {path: 1}, {path: 1});
    declare("Downloads.[FileType:3 Vendor Configuration File].FileName", {value: 1}, {value: serial});
    declare("Downloads.[FileType:3 Vendor Configuration File].Download", {value: 1}, {value: Date.now()});
}

```

I try with cwmp.auth or fs.auth with the same result.  
Ideally, the credentials would be the device serial number.

Do you have an idea ?

Thanks.

---

<div class="post-metadata">

**Author:** ![JonasGhost](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.genieacs.com/jonasghost/32/286_2.png) [@JonasGhost](https://forum.genieacs.com/u/JonasGhost)\
**Post date:** [August 5, 2021, 7:40pm UTC](https://forum.genieacs.com/t/secure-fs-service-with-authentification/1919/2 "2021-08-05T19:40:16Z")

</div>

I think it is not possible to add authentication throw this way.

Does the lua script check if the file is allow for this CPE or does it only check if the device is allowed to download any file?

---

<div class="post-metadata">

**Author:** ![Timeuhmeuh](https://avatars.discourse-cdn.com/v4/letter/t/76d3ee/32.png) [@Timeuhmeuh](https://forum.genieacs.com/u/Timeuhmeuh)\
**Post date:** [August 6, 2021, 8:28am UTC](https://forum.genieacs.com/t/secure-fs-service-with-authentification/1919/3 "2021-08-06T08:28:46Z")

</div>

The LUA script is just a dynamic .htaccess.

For 1.1 the FS seems to support authentication [GenieACS Auth Config · genieacs/genieacs Wiki · GitHub](https://github.com/genieacs/genieacs/wiki/GenieACS-Auth-Config) with nginx reverse proxy.

I try without success :

- Pass authentification to GENIEACS\_FS\_URL\_PREFIX with this format `GENIEACS_FS_URL_PREFIX=http://USER:PASSWORD@acsconfig.example.com:7567/`
- Use classic htaccess.

CWMP Log :

```auto
2021-08-06T06:22:18.920Z [INFO] 127.0.0.1 hAP%20ac%C2%B2: ACS request; acsRequestId="17b1a20685c0000" acsRequestName="Download" acsRequestCommandKey="17b1a20685c0000"
2021-08-06T06:22:21.066Z [INFO] 127.0.0.1 hAP%20ac%C2%B2: Inform; informEvent="7 TRANSFER COMPLETE,M Download" informRetryCount=0
2021-08-06T06:22:22.056Z [INFO] 127.0.0.1 hAP%20ac%C2%B2: CPE request; cpeRequestName="TransferComplete" cpeRequestCommandKey="17b1a20685c0000"
2021-08-06T06:22:22.056Z [WARN] 127.0.0.1 hAP%20ac%C2%B2: Channel has faulted; channel="boot" retries=7 faultCode="cwmp.9012" faultMessage="HTTP 401 auth failed"

```

Nginx FS Log (the log format shows that it’s not trying to use a user) :

```auto
192.168.0.1 - - [06/Aug/2021:08:22:18 +0200] "GET /B4A00C15417C HTTP/1.1" 401 29 "-" "MikroTik"

```

Nginx CWMP Log :  
`192.168.0.1 - user1 [06/Aug/2021:10:33:40 +0200] "POST / HTTP/1.1" 204 0 "-" "MikroTik"`