Removing Basic Auth from Nagios Behind Proxy

I recently installed checkmk to compare checkmk with Nagios (both under Docker and behind a Cloudflare proxy), and found Nagios runs a lot cooler on the CPU side.  So, considering keeping Nagios, I decided I needed to tackle one problem that has been bugging me.

Every time I connect to Nagios through the service, I also get prompted for a username and password via basic authentication.

If I keep Nagios, the above issue is unacceptable.  I need to resolve it.  So, since it is already behind Cloudflare, I know the header is getting there.  That means I simply need to load the rewrite module and ensure the header gets copied into the REMOTE_USER (just in case - may not be needed), and then set the "default_user_name" in cgi.cfg.  So, I grabbed a few files :

docker cp nagios:/opt/nagios/etc/cgi.cfg cgi.cfg
docker exec -it nagios cat /etc/apache2/sites-available/nagios.conf

I then modified the nagios.conf file in the following way :

--- apache-nagios.conf.orig	2026-10-15 16:22:42.366466648 -0600
+++ apache-nagios.conf	2026-10-15 16:47:12.198454588 -0600
@@ -7,6 +7,12 @@
 
 ScriptAlias /nagios/cgi-bin "/opt/nagios/sbin"
 
+# the following two lines are to get the authenticated user into
+# the REMOTE USER
+LoadModule rewrite_module /usr/lib/apache2/modules/mod_rewrite.so
+RewriteRule .* - [E=REMOTE_USER:%{HTTP:Cf-Access-Authenticated-User-Email}]
+
+
 <Directory "/opt/nagios/sbin">
 #  SSLRequireSSL
    Options ExecCGI
@@ -16,10 +22,10 @@ ScriptAlias /nagios/cgi-bin "/opt/nagios
          Require all granted
 #        Require host 127.0.0.1
 
-         AuthName "Nagios Access"
-         AuthType Basic
-         AuthUserFile /opt/nagios/etc/htpasswd.users
-         Require valid-user
+#         AuthName "Nagios Access"
+#         AuthType Basic
+#         AuthUserFile /opt/nagios/etc/htpasswd.users
+#         Require valid-user
       </RequireAll>
    </IfVersion>
    <IfVersion < 2.3>
@@ -29,10 +35,10 @@ ScriptAlias /nagios/cgi-bin "/opt/nagios
 #     Deny from all
 #     Allow from 127.0.0.1
 
-      AuthName "Nagios Access"
-      AuthType Basic
-      AuthUserFile /opt/nagios/etc/htpasswd.users
-      Require valid-user
+#      AuthName "Nagios Access"
+#      AuthType Basic
+#      AuthUserFile /opt/nagios/etc/htpasswd.users
+#      Require valid-user
    </IfVersion>
 </Directory>
 
@@ -47,10 +53,10 @@ Alias /nagios "/opt/nagios/share"
          Require all granted
 #        Require host 127.0.0.1
 
-         AuthName "Nagios Access"
-         AuthType Basic
-         AuthUserFile /opt/nagios/etc/htpasswd.users
-         Require valid-user
+#         AuthName "Nagios Access"
+#         AuthType Basic
+#         AuthUserFile /opt/nagios/etc/htpasswd.users
+#         Require valid-user
       </RequireAll>
    </IfVersion>
    <IfVersion < 2.3>
@@ -60,9 +66,9 @@ Alias /nagios "/opt/nagios/share"
 #     Deny from all
 #     Allow from 127.0.0.1
 
-      AuthName "Nagios Access"
-      AuthType Basic
-      AuthUserFile /opt/nagios/etc/htpasswd.users
-      Require valid-user
+#      AuthName "Nagios Access"
+#      AuthType Basic
+#      AuthUserFile /opt/nagios/etc/htpasswd.users
+#      Require valid-user
    </IfVersion>
</Directory>

And, I modified the cgi.conf file in the following way :

--- cgi.cfg.orig	2026-10-15 16:54:45.686779272 -0600
+++ cgi.cfg	2026-10-15 16:52:28.798266410 -0600
@@ -105,6 +105,7 @@ use_ssl_authentication=0
 # server will inherit all rights you assign to this user!
  
 #default_user_name=guest
+default_user_name=nagiosadmin
 
 

Now, stop your container, then delete it, and re-run adding two new parameters to map those files into place.

And, you should no longer prompt for authentication after already authenticating.