We moved our Nagios installation to a new (High performance) server. Some users started complaining that with every refresh of their browser screen the http password box appeared and asked for the login and password of the secure site.
After some searching around in log files it hit me:
10.248.2.198 – blaat [05/Dec/2012:16:00:13 +0100] “GET /nagios/media/hostdown.wav HTTP/1.1” 401 493 “-” “NSPlayer/12.00.7601.17514 WMFSDK/12.00.7601.17514”
10.248.2.198 – blaat [05/Dec/2012:16:00:15 +0100] “GET /nagios/media/hostdown.wav HTTP/1.1” 401 493 “-” “NSPlayer/12.00.7601.17514 WMFSDK/12.00.7601.17514”
The browser (IE 9.x in this case) loads the “status.cgi”. Because there is a hostdown, I wants to play the according media file. IE apparently don’t has any build in decoder for .wav files. And it uses the NSplayer embedded within IE for this. Problem is that somewhere between parsing and remembering the L&P for this site/file there goes something wrong. Because with every refresh (and thus every get of the .wav file) the password box pop-ups.
Highly annoying. Not want to lose to much time to fix this, I decided that the easiest way was to make all *.wav free files.
vi /etc/httpd/conf.d/nagios.conf
Directory “/usr/share/nagios”>
# We need to allow media files in: /usr/share/nagios/media/*.wav to be retrievable:
# Some browser use another http agent without password reminder to get those:
<Files *.wav>
Order deny,allow
Allow from All
Satisfy any
</Files>
</Directory>
This will do quite nicely. Because this Nagios installation is connected on a private LAN it won’t be a problem for me. The CGI and all the other files are still protected anyway!