2FA Auth für geschützte Web Verzeichnisse (NGINX)

Authelia installieren

# Aktuelle Version herunterladen (amd64)
wget https://github.com/authelia/authelia/releases/download/v4.39.20/authelia_4.39.20-1_amd64.deb

# Installieren
dpkg -i authelia_4.39.20-1_amd64.deb

Zusätzlich noch Redis:

apt install redis-server
systemctl enable --now redis-server

Verzeichnisstruktur & Secrets generieren

sudo mkdir -p /etc/authelia
sudo mkdir -p /var/lib/authelia

Secrets generieren + Outputs notieren!

openssl rand -hex 32 # → jwt_secret

openssl rand -hex 32 # → session secret

openssl rand -hex 32 # → storage encryption_key

Passwort-Hash generieren

authelia crypto hash generate argon2 --password 'DEINPASSWORT' 

User-Datei anlegen

vi /etc/authelia/users.yml

users:
  teslina:
    displayname: "Teslina"
    password: "$argon2id$..." # Hash von oben
    email: deine@email.ch
    groups:
      - admins

Schritt 5: Hauptkonfiguration

vi /etc/authelia/configuration.yml

server:
  address: 'tcp://127.0.0.1:9091'

log:
  level: warn

identity_validation:
  reset_password:
    jwt_secret: "ERSTER_HEX_STRING" # von openssl rand -hex 32

totp:
  issuer: mydomain.com

authentication_backend:
  file:
    path: /etc/authelia/users.yml

access_control:
  default_policy: deny
  rules:
    - domain: protected.mydomain.com
      policy: two_factor

session:
  secret: "ZWEITER_HEX_STRING" # von openssl rand -hex 32
  same_site: lax
  cookies:
    - domain: mydomain.com
      authelia_url: https://auth.mydomain.com
      expiration: 3600
      inactivity: 600
 redis:
   host: 127.0.0.1
   port: 6379

storage:
  encryption_key: "DRITTER_HEX_STRING" # von openssl rand -hex 32
  local:
    path: /var/lib/authelia/db.sqlite3

notifier:
  filesystem:
    filename: /var/lib/authelia/notification.txt

Dann Berechtigungen setzen:

chown -R www-data:www-data /etc/authelia
chown -R www-data:www-data /var/lib/authelia
chmod 600 /etc/authelia/configuration.yml
chmod 600 /etc/authelia/users.yml

Konfiguration testen:

authelia validate-config --config /etc/authelia/configuration.yml

Schritt 6: Systemd-Service

vi /etc/systemd/system/authelia.service

[Unit]
Description=Authelia authentication service
After=network.target

[Service]
User=www-data
ExecStart=/usr/bin/authelia --config /etc/authelia/configuration.yml
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target

systemctl daemon-reload
systemctl enable --now authelia
systemctl status authelia

Schritt 7: nginx anpassen

# Authelia Portal
server {
    listen 443 ssl;
    server_name auth.mydomain.com;

    ssl_certificate /etc/letsencrypt/live/mydomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mydomain.com/privkey.pem;

    location / {
       proxy_pass http://127.0.0.1:9091;
       proxy_set_header Host $host;
       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# Protected Web geschützt
server {
    listen 443 ssl;
    server_name protected.mydomain.com;

    ssl_certificate /etc/letsencrypt/live/mydomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mydomain.com/privkey.pem;

    # Authelia auth_request Helper
    location /authelia {
        internal;
        proxy_pass http://127.0.0.1:9091/api/authz/forward-auth;
        proxy_http_version 1.1;
        proxy_set_header Host $http_host;
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $http_host;
        proxy_set_header X-Forwarded-Method $request_method;
        proxy_set_header X-Forwarded-URI $request_uri;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header Cookie $http_cookie;
        proxy_set_header Authorization "";
        proxy_set_header Accept "application/json"; # ← zwingt Authelia zu 401 statt 3
    }

    location / {
        auth_request /authelia;
        auth_request_set $redirect $upstream_http_location;
        error_page 401 =302 https://auth.mydomain.com/?rd=$scheme://$http_host$request_uri;
        try_files $uri $uri/ /index.php;


        # bestehende phpMyAdmin-Konfiguration hier einfügen
        # z.B. proxy_pass oder root/fastcgi
    }
}

nginx -t
service nginx reload

2FA einrichten

1. auth.mydomain.ch im Browser aufrufen
2. Mit Username + Passwort einloggen
3. Authelia fordert dich auf, TOTP einzurichten (wähle hier Einmal-Passwort für normale Authenticator App – WebAuthn wäre Hardware/Passkey) → QR-Code scannen
4. Danach schützt Authelia phpMyAdmin mit 2FA

-> Authelia schickt den Code / Registrierung Link per Mail. Sollte das Mail nicht ankommen, findest du die Daten auch in

/var/lib/authelia/notification.txt

Unterhalt:

Neue User und Webs hinzufügen

User + Configuration Files anpassen:

/etc/authelia/

Authelia neu starten

systemctl restart authelia

.