Apache Proxy - Revision history

Michael.mast at 12:05, 10 October 2019

2019-10-10T12:05:40Z

Michael.mast: /* Dockerfile Example */

2019-06-13T19:39:43Z

Dockerfile Example

Michael.mast: /* Dockerfile Example */

2019-06-13T19:38:56Z

Dockerfile Example

Michael.mast: /* Certbot Letsencrypt */

2019-06-13T19:25:16Z

Certbot Letsencrypt

Michael.mast: /* Dockerfile Example */

2019-06-13T19:22:04Z

Dockerfile Example

Michael.mast at 18:39, 13 June 2019

2019-06-13T18:39:49Z

Michael.mast: /* Certbot Letsencrypt */

2019-04-12T20:37:48Z

Certbot Letsencrypt

Michael.mast at 14:54, 7 April 2019

2019-04-07T14:54:19Z

Michael.mast at 15:58, 1 April 2019

2019-04-01T15:58:18Z

Michael.mast: Created page with "While trying to set an ssl proxy, I ran into an issue where the ssl handshake would not work with the stupid website icon.

 Error during SSL Handshake with remote server..."

2018-06-29T23:12:41Z

Created page with "While trying to set an ssl proxy, I ran into an issue where the ssl handshake would not work with the stupid website icon. <pre> Error during SSL Handshake with remote server..."

New page

While trying to set an ssl proxy, I ran into an issue where the ssl handshake would not work with the stupid website icon.
<pre>
Error during SSL Handshake with remote server returned by /favicon.ico
</pre>
In this case it was ok to ignore the authenticity of the connection, restricted use case and something that I would normally not do<ref>https://stackoverflow.com/questions/18872482/error-during-ssl-handshake-with-remote-server</ref>
<pre>
SSLProxyEngine On
SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProxyCheckPeerExpire off
</pre>

← Older revision		Revision as of 12:05, 10 October 2019
Line 111:		Line 111:
	</VirtualHost>		</VirtualHost>
	</pre>		</pre>
		+
		+	==Use Source IP==
		+	By default the destination server will use the IP of the proxy in it's logs, as well as for processing htaccess files. I found this out during a migration where my htaccess require fields were essentially worthless.<br>
		+	<br>
		+	The key here is to tell the server behind the proxy to use the "X-Forwarded-For" header, set by default by Apache mod_proxy, for logging. Apache will NOT process this source IP without it being set in the log (I didn't see this in the documentation<ref>https://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/manual/mod/mod_remoteip.xml</ref>).<br><br>
		+	<ref>https://www.digitalocean.com/community/questions/get-client-public-ip-on-apache-server-used-behind-load-balancer</ref>
		+	#Add "RemoteIPHeader X-Forwarded-For" to your config (either default httpd.conf or your vhost file).
		+	#Edit the LogFormat to match the following. The key is replacing "%h" at the beginning with "%a".
		+	<pre>
		+	LogFormat "%a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
		+	</pre>
		+
		+	<br>
		+	<br>

@@ Line 15: / Line 15: @@
          openssl \
          yum install certbot python2-certbot-apache
-RUN echo -e "ServerTokens Prod\nServerSignature Off\nLoadModule deflate_module modules/mod_deflate.so" >> /etc/httpd/conf/httpd.con
+RUN echo -e "ServerTokens Prod\nServerSignature Off\nLoadModule deflate_module modules/mod_deflate.so" >> /etc/httpd/conf/httpd.conf
 RUN :> /etc/httpd/conf.d/welcome.conf
 EXPOSE 80 443

@@ Line 15: / Line 15: @@
          openssl \
          yum install certbot python2-certbot-apache
 EXPOSE 80 443
 CMD /usr/sbin/httpd -DFOREGROUND

@@ Line 41: / Line 41: @@
 </pre>
-<ref>https://certbot.eff.org/docs/using.html#webroot</ref>
+<ref>https://certbot.eff.org/docs/using.html#webroot</ref>There are two methods for running certbot with containers.
 <pre>
 sudo docker run --rm --name certbot -v /proxy/sitefiles:/var/www/ -v /proxy/certs/letsencrypt:/etc/letsencrypt \
 certbot/certbot certonly --agree-tos -m your@email.com --webroot -w /var/www/ -d your.domain.com
 </pre>

@@ Line 1: / Line 1: @@
 ==Dockerfile Example==
 Sometimes I run the proxy using the default httpd container, other times I use the following centos build. Depending on how I feel that day.
 <pre>
 FROM centos:latest
@@ Line 17: / Line 18: @@
 CMD /usr/sbin/httpd -DFOREGROUND
 </pre>
 ==Certbot Letsencrypt==
 In this case I am trying to use webroot verification to obtain a certificate for a running site behind a proxy. This is all done using docker containers. Still working on the specifics, but one issue I am running into is that SELinux on CentOS 7 doesn't like processes from containers hitting ZFS directories created by Docker. Will need to finish migrating these containers to VMs running on the CentOS 7 host.

← Older revision		Revision as of 18:39, 13 June 2019
Line 1:		Line 1:
		+	==Dockerfile Example==
		+	Sometimes I run the proxy using the default httpd container, other times I use the following centos build. Depending on how I feel that day.
		+	<pre>
		+	FROM centos:latest
		+	RUN yum -y upgrade
		+	RUN yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
		+	RUN yum -y install http://rpms.remirepo.net/enterprise/remi-release-7.rpm
		+	RUN yum -y install yum-utils
		+	RUN yum-config-manager --enable remi-php73
		+	RUN yum-config-manager --enable rhui-REGION-rhel-server-extras rhui-REGION-rhel-server-optional
		+	RUN yum -y install \
		+	http \
		+	mod_ssl \
		+	openssl \
		+	yum install certbot python2-certbot-apache
		+	EXPOSE 80 443
		+	CMD /usr/sbin/httpd -DFOREGROUND
		+	</pre>
	==Certbot Letsencrypt==		==Certbot Letsencrypt==
	In this case I am trying to use webroot verification to obtain a certificate for a running site behind a proxy. This is all done using docker containers. Still working on the specifics, but one issue I am running into is that SELinux on CentOS 7 doesn't like processes from containers hitting ZFS directories created by Docker. Will need to finish migrating these containers to VMs running on the CentOS 7 host.		In this case I am trying to use webroot verification to obtain a certificate for a running site behind a proxy. This is all done using docker containers. Still working on the specifics, but one issue I am running into is that SELinux on CentOS 7 doesn't like processes from containers hitting ZFS directories created by Docker. Will need to finish migrating these containers to VMs running on the CentOS 7 host.

@@ Line 8: / Line 8: @@
 ProxyPass /.well-known/ !
 </pre>
 <ref>https://certbot.eff.org/docs/using.html#webroot</ref>
 <pre>

← Older revision		Revision as of 14:54, 7 April 2019
Line 1:		Line 1:
		+	==Certbot Letsencrypt==
		+	In this case I am trying to use webroot verification to obtain a certificate for a running site behind a proxy. This is all done using docker containers. Still working on the specifics, but one issue I am running into is that SELinux on CentOS 7 doesn't like processes from containers hitting ZFS directories created by Docker. Will need to finish migrating these containers to VMs running on the CentOS 7 host.
		+	<br>
		+	<br>
		+	I digress.
		+	*Make sure you prevent the proxy from proxying the challenge<ref>https://serverfault.com/questions/518355/how-to-exclude-an-url-for-apache-mod-proxy</ref> by adding the following to your vhost for the domain.
		+	<pre>
		+	ProxyPass /.well-known/ !
		+	</pre>
		+	<ref>https://certbot.eff.org/docs/using.html#webroot</ref>
		+	<pre>
		+	sudo docker run --rm --name certbot -v /proxy/sitefiles:/var/www/ -v /proxy/certs/letsencrypt:/etc/letsencrypt \
		+	certbot/certbot certonly --agree-tos -m your@email.com --webroot -w /var/www/ -d your.domain.com
		+	</pre>
		+
	==SSL Handshake with remote server favicon.ico==		==SSL Handshake with remote server favicon.ico==
	While trying to set an ssl proxy, I ran into an issue where the ssl handshake would not work with the stupid website icon.		While trying to set an ssl proxy, I ran into an issue where the ssl handshake would not work with the stupid website icon.

@@ Line 1: / Line 1: @@
 While trying to set an ssl proxy, I ran into an issue where the ssl handshake would not work with the stupid website icon.
 <pre>
@@ Line 10: / Line 11: @@
 SSLProxyCheckPeerName off
 SSLProxyCheckPeerExpire off
 </pre>