Apache 2.4 reverse proxy setup cannot impose basic authentication - apache

I have apache2.4 set up and when visiting any apache served web sites basic authentication works great.
Now I have one more webserver running from an other service at port 8000 and I wanted to setup apache as a reverse proxy hoping that it can also impose and handle basic authentication there as well...but instead for asking for user and password it just serves the website unprotected.
my setup is:
<VirtualHost *:8000>
ProxyPreserveHost On
ProxyPass / http://192.168.0.101:8000/
ProxyPassReverse / http://192.168.0.101:8000/
<Location />
AuthType Basic
AuthName "Authorization"
AuthUserFile /etc/htpasswd/.htpasswd
require valid-user
</Location>
</VirtualHost>
what am i doing wrong?
Update:
solution found by marked answer:
<VirtualHost *:8000>
ProxyPreserveHost On
<Location />
ProxyPass http://192.168.0.101:8000/
ProxyPassReverse http://192.168.0.101:8000/
AuthType Basic
AuthName "Authorization"
AuthUserFile /etc/htpasswd/.htpasswd
require valid-user
</Location>
</VirtualHost>
Also make sure that apache is configured to listen to that port and also if the proxied server is local it is not running at the same port as listened one

The problem is that Apache doesn't 'link' Proxypass / http://example.com and <Location /> - even though they both try to work with /. This means that Proxypass is handling requests for '/' first, and the Location section is never being used.
You need to move the Proxy config inside the Location, dropping the path, e.g.:
<VirtualHost *:8000>
ProxyPreserveHost On
<Location />
ProxyPass http://192.168.0.101:8000/
ProxyPassReverse http://192.168.0.101:8000/
AuthType Basic
AuthName "Authorization"
AuthUserFile /etc/htpasswd/.htpasswd
require valid-user
</Location>
</VirtualHost>

Related

APACHE AUTH PROXY FOR QUESTDB

I want to configure an apache Auth proxy for access to QuestDB that does not have Authentication system. I try it to VM in a first time.
I made a very simple configuration:
<VirtualHost *:80>
ServerAdmin webmaster#localhost
DocumentRoot /var/www/html
<Proxy *>
Order deny,allow
Allow from all
AuthType Basic
Authname "Password Required"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user
</Proxy>
ProxyPass / http://127.0.0.1:9000/
ProxyPassReverse / http://127.0.0.1:9000/
ProxyRequests Off
</VirtualHost>
I configured my QuestDB with a bind adress http://127.0.0.1:9000.
When I go to http://myipadress and give my Apache authentified user, I have :
Bad request
refresh
Content without CSS
refresh
Bad request
refresh
QuestDB opened
refresh
and looping like this forever.
Any idea ?
When I just set the ProxyPass / ProxyPassReverses lines, I got the same phenomenom.
I have enabled my Apache server mods : proxy_http, proxy, rewrite and cache and the default ones that are enabled.
The below config is working for me. I think the difference is I am not using a DocumentRoot.
<VirtualHost *:80>
ProxyPreserveHost On
<Proxy *>
Order deny,allow
Allow from all
AuthType Basic
Authname "Password Required"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user
</Proxy>
ProxyRequests Off
ServerName 127.0.0.1:80
ServerAlias localhost
ProxyPass / http://localhost:9000/
ProxyPassReverse / http://localhost:9000/
</VirtualHost>

How to combine proxy and basic auth in Apache

How do you combine basic auth with a reverse proxy in Apache?
I have an Apache site currently configured to use basic auth with an htpasswd file using this config:
<VirtualHost *:80>
# Requires: a2enmod proxy_http
ProxyPass / http://127.0.0.1:8010/
<Location />
AuthType Basic
AuthName "Sensitive"
AuthUserFile /usr/local/myproject/htpasswd
Require valid-user
</Location>
</VirtualHost>
Apache is acting as a wrapper around a Buildbot server being served on port :8010. However, this app has been upgraded so it now requires the use of websockets. The suggested Apache configuration is:
<VirtualHost *:80>
<Location /ws>
ProxyPass ws://127.0.0.1:8010/ws
ProxyPassReverse ws://127.0.0.1:8010/ws
</Location>
ProxyPass /ws !
ProxyPass / http://127.0.0.1:8010/
ProxyPassReverse / http://127.0.0.1:8010/
</VirtualHost>
However, this doesn't use any authentication. I tried re-adding my <Location /> section from the previous config, so I now have:
<VirtualHost *:80>
<Location />
AuthType Basic
AuthName "Sensitive"
AuthUserFile /usr/local/myproject/htpasswd
Require valid-user
</Location>
<Location /ws>
ProxyPass ws://127.0.0.1:8010/ws
ProxyPassReverse ws://127.0.0.1:8010/ws
</Location>
ProxyPass /ws !
ProxyPass / http://127.0.0.1:8010/
ProxyPassReverse / http://127.0.0.1:8010/
</VirtualHost>
and although Apache now correctly prompts for my username+password, the Buildbot still isn't given authenticated username and still renders for an anonymous user.
How do I fix this config to pass the username (I believe the REMOTE_USER header) through to the web app behind the reverse proxy?

set up gerrit with http authentication

I am trying to configure gerrit with http baisc authentication , my httpd config is
<VirtualHost *:8081>
ServerName localhost
ProxyRequests Off
ProxyVia Off
ProxyPreserveHost On
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
<Location "/login/">
AuthType Basic
AuthName "Gerrit Code Review"
AuthBasicProvider file
AuthUserFile /usr/local/apache/passwd/passwords
Require valid-user
</Location>
ProxyPass / http://localhost:8081/
</VirtualHost>
and my gerrit.config is
[gerrit]
basePath = git
canonicalWebUrl = http://localhost:8081/
[database]
type = mysql
hostname = localhost
database = reviewdb
username = gerrit
[auth]
type = HTTP
[sendemail]
smtpServer = localhost
smtpUser = gerrit
[container]
user = gerrit
javaHome = /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre
[sshd]
listenAddress = *:29418
[httpd]
listenUrl = proxy-http://*:8081/
[cache]
directory = cache
i am not sure where am i going wrong but the accessing http://x.x.x.x:8081 says
The HTTP server did not provide the username in the Authorization header when it forwarded the request to Gerrit Code Review.
If the HTTP server is Apache HTTPd, check the proxy configuration includes an authorization directive with the proper location, ensuring it ends with '/':
my gerrit runs on the inbuild jetty countainer and my OS is centos 6.4
where am i going wrong.?
Okay. Actually I was creating a virtual host on port 8081 and my Jetty (that comes along with gerrit) was also listening to the same port,my configuration remained almost the same but these are the additional steps :-
Add a new port to your selinux (which has some basic ports defined initially) or you can disable it if security is not an issue.
tell httpd to listen to this port(in my case i added 8082) ,so add the line listen <port-no> in your http conf file
Change the virtual host to your port number
now your virtualhost is set on port 8082
<VirtualHost *:8082>
ServerName localhost
ProxyRequests Off
ProxyVia Off
ProxyPreserveHost On
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
<Location "/login/">
AuthType Basic
AuthName "Gerrit Code Review"
AuthBasicProvider file
AuthUserFile /usr/local/apache/passwd/passwords
Require valid-user
</Location>
ProxyPass / http://localhost:8081/
</VirtualHost>
change the canonical url to port 8082 (so that it redirects it to same port)
finally restart the apache and Gerrit (access your-host:8082).
Gerrit it expecting the authentication to be provided. It does not allow anonymous access when you use HTTP authentication.
For this to work you need to authenticate at the root and your Location block should look like this:
<Location "/">
AuthType Basic
AuthName "Gerrit Code Review"
AuthBasicProvider file
AuthUserFile /usr/local/apache/passwd/passwords
Require valid-user
</Location>
There are a few issues with your configuration:
Apache and try to listen on the same port 8081, this is not possible
You ProxyPass is not the best, it will create some small issues. These issues are:
Unable to to create projects names with a slash in it like: main/sub
When reviewing files the check mark will not appear next to the file to show it as reviewed, again this is related to the forward slash not being properly processed
It is most common to use a subfolder and not the root, I guess that works better with the reverse proxy
This is my recommended configuration for you:
<VirtualHost *:80>
ServerName localhost
ProxyRequests Off
ProxyVia Off
ProxyPreserveHost On
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
<Location "/">
AuthType Basic
AuthName "Gerrit Code Review"
AuthBasicProvider file
AuthUserFile /usr/local/apache/passwd/passwords
Require valid-user
</Location>
AllowEncodedSlashes On
ProxyPass /r http://localhost:8081/r nocanon
</VirtualHost>
Ofcourse don't forget to amend the gerrit.config, the canonicalWebUrl is what you type in the address bar, not what apache uses to find gerrit.
[gerrit]
basePath = git
canonicalWebUrl = http://localhost:8082/r
To prevent the apache default page from showing add a index.php in your root folder that will redirect your browser to the sub path:
<?php
header('Location: http://localhost:8082/r/');
?>

Apache HTTP Server Location directive - exclude url

I've an Apache HTTP server that is used as a proxy (over https) for JBoss-deployed webapp. I've the following entry in a conf file:
<Location "/app">
ProxyPass http://localhost:8080/app
ProxyPassReverse http://localhost:8080/app
AuthType Basic
AuthName "Private Documentation Repository"
AuthUserFile <path-to-file>
Require valid-user
</Location>
As You can see, a valid user is required to access /app.
The question is: how to write a directive that will exclude one particular file from JBoss webapp, so that access to this file won't require a valid user e.g.:
<Location "/app/some-file.xyz">
ProxyPass http://localhost:8080/app/some-file.xyz
ProxyPassReverse http://localhost:8080/app/some-file.xyz
</Location>
I mean: when user requests anything (app/) but /app/some-file.xyz he/she will be prompted for the password, otherwise Apache will enable the user to download some-file.xyz. Any help would be greatly appreciated.
<Location "/app/*.xyz">
allow from all
satisfy any
ProxyPass http://localhost:8080/app/*.xyz
ProxyPassReverse http://localhost:8080/app/*.xyz
</Location>

Remove basic authentication header with apache mod proxy

I have a HTTP Basic secured website. I hide a Tomcat application server with mod_proxy. Can I remove the HTTP Basic header? The Tomcat application reads the header and returns 401 not authorized. Basic auth isn't needed because the application uses cookie sessions. So I think just removing the headers would be fine.
Make sure mod_headers is enabled. An example config:
<VirtualHost *:80>
ServerName something.example.com
ServerAdmin admin#example.com
ProxyRequests Off
ProxyPreserveHost Off
AllowEncodedSlashes On
KeepAlive Off
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
<Location />
AuthType Basic
AuthName "Authorized Users Only"
AuthUserFile /etc/apache2/passwd
Require valid-user
</Location>
RequestHeader unset Authorization
ProxyPass / http://localhost:5984/ example
ProxyPassReverse / http://localhost:5984/
ErrorLog /var/log/apache2/something.example.com-error_log
CustomLog /var/log/apache2/something.example.com-access_log common
</VirtualHost>
I just had the same problem with Apache in front of another Java server trying to do basic auth, adding the following to my Apache config seemed to fix it:
RequestHeader unset Authorization