I have an Apache 2.4.12 on a dedicated machine (RedHat 6.x) that must balance on another machine with two Weblogic Managed Servers (port: 9101 and 9102. Weblogic 12c on RedHat 6.x) where I have deployed the application "Pega".
I have implemented the configuration below on the Apache VirtualHost (myvirtualhost.conf) but if I have both BalancerMember active it doesn't work. If I comment one of the two BalancerMember it works fine.
Do you have any suggestion to fix it?
thanks in advance for your collaboration
<VirtualHost myvirtualhost:443>
SSLEngine on
SSLProxyEngine on
SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProtocol all -SSLv2
#Server certificate
SSLCertificateFile /opt/rh/httpd24/root/etc/httpd/ssl/xxx.cer
#chiave privata del server:
SSLCertificateKeyFile /opt/rh/httpd24/root/etc/httpd/ssl/xxx.key
#chain del certificato del server:
SSLCertificateChainFile /opt/rh/httpd24/root/etc/httpd/ssl/xxx.crt
#Certificate Authority (CA):
#SSLCACertificateFile /opt/rh/httpd24/root/etc/httpd/ssl/xxx.crt
################################
<Proxy balancer://mybalancing>
BalancerMember https://myweblogicserver:9101
BalancerMember https://myweblogicserver:9102
</Proxy>
ProxyRequests on
ProxyPreserveHost on
##########Disable URL ############
ProxyPass /myexcludedpath !
##################################
ProxyPass "/" "balancer://mybalancing/"
ProxyPassReverse "/" "balancer://mybalancing/"
</VirtualHost>
Edit:
Yes i set correctly parameters.
I reach the login page (both when it works and when it doesn't) but when it doesn't work, if i enter my credential, i see:
Status fail
Message There has been an issue; please consult your system administrator
Operator ID Unauthenticated or not available
Requestor ID No ID available
Timestamp Thu Feb 25 12:37:36 CET 2016
Engine Version PegaRULES 7.10 ML9 (coreAssemblyCached_719_730)
But if i comment one of the BalancerMember:
<Proxy balancer://mybalancing>
# BalancerMember https://myweblogicserver:9101
BalancerMember https://myweblogicserver:9102
</Proxy>
It works fine.
So i guess i miss something in the declaration of 'balancer' , or maybe i miss some directive..
Any suggestion would be really appreciated.
Thanks
EDIT2:
Yes the session replication works well between the two servers. I'm able to login using a direct URL to a server (actually a Node in a server, the machine is the same, what changes is the port : 9101 and 9102) and then switch the other server (other node) maintaining my current session..
I guess it's some directive of proxypass but its the first time i face it
To use the WebLogic Web Server plugins, these are the basic steps:
Download the .so file and copy to /etc/httpd/modules.
Create a file called /etc/httpd/conf.d/weblogic.conf with the following content:
LoadModule weblogic_module modules/mod_wl_24.so
<IfModule weblogic_module>
WebLogicCluster myweblogicserver:9101,myweblogicserver:9102
DebugConfigInfo ON
MatchExpression *
</IfModule>
Related
I decided to post about my situation after many days of troubleshooting. I recently installed NextCloud as snap on Ubuntu 18.04 and everything worked fine. I did the port forwarding and used Let’s Encrypt (from snap commands) to create the certificates for NC.
Then I decided to install Collabora server on the same machine to use the office functionality. I used the official Collaboration guides for installation mentioned here. However, in this guide, it is assumed that NC is installed manually (not snap). According to guides, I had to install Apache (or any other proxy/web server) to proxy the traffic to whether NC or Collabora.
I think there is a problem with my proxy configuration or something wrong with SSL certificates. When both Apache and snap are running, I can get to Apache page and Collabora should be running, but cannot get to NC page.
I can go to (port 443) link below and get to the page (meaning Collabora is responding?)
https://collabora.domain.com/loleaflet/dist/admin/admin.html
But when accessing the NC domain, the browser says “Did Not Connect: Potential Security Issue” and complain that the certificates are not for that NC domain I am trying to connect but the certificate is for Collabora domain. If I stop the Apache and let Snap running, I can access the NC domain with no issues (except I need to set the ports to 443 and 80 again! Is this problematic?)
My Apache proxy config file (located under /etc/apache2/sites-available/) is as follows:
<VirtualHost *:444>
ServerName nextcloud.domain.com:444
ProxyPreserveHost On
ProxyPass / https://192.168.1.50/
ProxyPassReverse / https://192.168.1.50/
SSLProxyEngine on
SSLCertificateFile /etc/letsencrypt/live/nextcloud.domain.com/cert.pem
SSLCertificateChainFile /etc/letsencrypt/live/nextcloud.domain.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/nextcloud.domain.com/privkey.pem
</VirtualHost>
<VirtualHost *:443>
ServerName collabora.domain.com:443
# SSL configuration, you may want to take the easy route instead and use Lets Encrypt!
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/collabora.domain.com/cert.pem
SSLCertificateChainFile /etc/letsencrypt/live/collabora.domain.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/collabora.domain.com/privkey.pem
SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-$
SSLHonorCipherOrder on
# Encoded slashes need to be allowed
AllowEncodedSlashes NoDecode
# Container uses a unique non-signed certificate
SSLProxyEngine On
SSLProxyVerify None
SSLProxyCheckPeerCN Off
SSLProxyCheckPeerName Off
# keep the host
ProxyPreserveHost On
# static html, js, images, etc. served from loolwsd
# loleaflet is the client part of LibreOffice Online
ProxyPass /loleaflet https://127.0.0.1:9980/loleaflet retry=0
ProxyPassReverse /loleaflet https://127.0.0.1:9980/loleaflet
# WOPI discovery URL
ProxyPass /hosting/discovery https://127.0.0.1:9980/hosting/discovery$
ProxyPassReverse /hosting/discovery https://127.0.0.1:9980/hosting/discovery
# Main websocket
ProxyPassMatch "/lool/(.*)/ws$" wss://127.0.0.1:9980/lool/$1/ws nocanon
# Admin Console websocket
ProxyPass /lool/adminws wss://127.0.0.1:9980/lool/adminws
# Download as, Fullscreen presentation and Image upload operations
ProxyPass /lool https://127.0.0.1:9980/lool
ProxyPassReverse /lool https://127.0.0.1:9980/lool
# Endpoint with information about availability of various features
ProxyPass /hosting/capabilities https://127.0.0.1:9980/hosting/capabilities retry=0
ProxyPassReverse /hosting/capabilities https://127.0.0.1:9980/hosting/capabilities
</VirtualHost>
To be honest, this is first time I am setting up proxy server that do not know how it works. Most of my config file is copied and think that is the issue :) If someone can have a look at it and guide me to the right direction, that would save me lots of headache and time.
I went through the same pain for a similar amount of time and eventaully got a simple solution.
The online instructions for docker here are correct except that they omit enabling proxy for websockets.
a2enmod proxy
a2enmod proxy_wstunnel
a2enmod proxy_http
a2enmod ssl
The only other change I had to make were to add --cap-add MKNOD to the docker start.
In Nextcloud I then only needed to add https://collab.example.com to the WAPI server address configuration after creating LetsEncrypt certs for my domain (obviously example.com is not my real domain).
Hope someone can point me in the right direction. I've been trying to get this to work for many hours :(
Scenario - I have a DMZ where I've set up the Apache server. I need to securely talk to the internal server where I have set up another Apache server which is reverse proxied again to a localhost app within the server.. So, basically..
outside world > internet (https://app1.com) > dmz (apache reverse proxy) > internal server (apache reverse proxy - https://app1prod.com) > (http) > localhost:8080
Now, in dmz, I can directly access https://app1prod.com without issues. But, I can't for the life of me get https://app1.com to work from dmz. I get a '503 service unavailable' message :( Here is my apache config in dmz..
<VirtualHost *:443>
ServerName app1.com
ProxyRequests off
SSLProxyCheckPeerName off
SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerExpire off
LogLevel debug
SSLEngine on
SSLProxyEngine on
SSLCertificateFile "xxx/cert.crt"
SSLCertificateKeyFile "xxx/key.key"
SSLCertificateChainFile "xxx/certchain.crt"
ProxyPass / https://app1prod.com/
ProxyPassReverse / https://app1prod.com/
<Proxy *>
order deny,allow
Allow from all
</Proxy>
ProxyPreserveHost on
ProxyTimeout 1200
</VirtualHost>
On my httpd.conf, I have the following modules loaded in addition to the defaults..
mod_proxy.so
mod_proxy_connect.so
mod_proxy_http.so
mod_ssl
mod_rewrite.so
mod_socache_shmcb.so
mod_ssl.so
What am I doing wrong? Please help! Thanks a lot..
Try removing ProxyPreserveHost on.
With that directive enabled, the proxied requests will be send to server defined in ProxyPass directive, but the HTTP Host: header will be preserved from initial request. In your case, the requests sent by Apache to app1prod.com will have Host: app1.com header, and app1prod.com i not configured (probably deliberately) to respond to such request.
Since integrating CsrfPreventionRequestCycleListener into our Apache Wicket (7.6.0) application, we have a problem operating the application behind an Apache reverse proxy.
Our configuration terminates SSL at Apache, and the reverse proxy passes the requests via http to our Wildfly 10 application server. This allows us to offload TLS/SSL among other things.
But since adding the CsrfPreventionRequestCycleListener, we are seeing the following in the server.log file and connections are aborted:
[org.apache.wicket.protocol.http.CsrfPreventionRequestCycleListener]
(default task-12) Possible CSRF attack, request URL:
http://example.com/example/portal/wicket/page,
Origin: https://example.com, action: aborted with error
400 Origin does not correspond to request
The problematic Apache config:
<VirtualHost example.com:443>
ServerName example.com
LogLevel debug
SSLEngine On
SSLCertificateFile /var/example/example.com/signed.crt
SSLCertificateKeyFile /var/example/example.com/domain.key
SSLCACertificateFile /var/example/example.com/intermediate.pem
SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1
SSLOpenSSLConfCmd DHParameters "/usr/local/apache2/1024dhparams.pem"
SSLProxyEngine on
ProxyPass / http://localhost:8390/ timeout=600
ProxyPassReverse / http://localhost:8390/ timeout=600
ProxyPreserveHost On
Header set Access-Control-Allow-Origin "*"
Header set Access-Control-Allow-Credentials "true"
Header edit Location ^http(\:\/\/.*)$ https$1
We found a solution using http2 but would prefer one without http2 (for reasons, see in https://http2.pro/doc/Apache).
The working Apache configuration using http2
<VirtualHost example.com:443>
ServerName example.com
LogLevel debug
SSLEngine On
SSLCertificateFile /var/example/example.com/signed.crt
SSLCertificateKeyFile /var/example/example.com/domain.key
SSLCACertificateFile /var/example/example.com/intermediate.pem
SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1
SSLOpenSSLConfCmd DHParameters "/usr/local/apache2/1024dhparams.pem"
SSLProxyEngine On
ProxyPreserveHost On
# Settings for http2 communication
Protocols h2 http/1.1
ProxyPass / https://localhost:8754/ timeout=600
ProxyPassReverse / https://localhost:8754/ timeout=600
SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProxyCheckPeerExpire off
Header set Access-Control-Allow-Origin "*"
Header set Access-Control-Allow-Credentials "true"
# Header edit Location ^http(\:\/\/.*)$ https$1
</VirtualHost>
Can anyone help us create a valid apache reverse proxy configuration that works with the CsrfPreventionRequestCycleListener without the http2 module?
I think I had a similar issue here and solved it just now. I think you might have solved your issue by now but maybe anyone else is falling over this topic.
You might want to look into a network dump to verify the problem. For me, apache sent requests to the locally running service (your case to http://localhost:8754) while some request headers were still referring the public name https://example.com. This was detected as a security risk and the connection refused by the underlying service.
I made sure, that mod_headers was enabled in apache and added the line
RequestHeader edit Referer "https://example.com" "http://localhost:8754"
After that no more references to anything related to example.com was in my tcp dumps and the connection was opened successfully.
You might need to adopt according to your setup (maybe you need multiple headers corrected or something similar). I cannot try it out at the moment.
I have an Endeca cluster setup with 3 dgraph(1 EAC Central Server and 2 EAC agent only instances). I am trying to put an Apache mod_proxy load balancer for testing purpose before the MDEX engines(I am using presentation API to hit the MDEX engine(we are working on assembler API also)). We shall be having an F5(or Nginx, which one shall be better?) hardware load balancer when we'll shall do the actual deployment. My apache server is listening at port 5555, All my Dgraphs are running at port 15000 on three different host. I'm directing the all my queries to apache load balancer.
MDEX_HOST = localhost
MDEX_PORT = 5555
private static ENEConnection createConnection() {...}
And here is my Apache Load balancer configuration. Load balancer modules included in httpd.conf file mod_proxy, mod_proxy_balancer, mod_proxy_connect, mod_proxy_http, mod_negotiation. I have put the load balancer configuration in httpd-vhosts.conf file.
NameVirtualHost *:5555
<VirtualHost *:5555>
Header add Set-Cookie "ROUTEID=.%{BALANCER_WORKER_ROUTE}e; path=/"
env=BALANCER_ROUTE_CHANGED
ServerName localhost
ProxyPass / balancer://cluster/
<Proxy balancer://cluster>
BalancerMember http://172.16.26.129:15000 loadfactor=1 retry=0 route=1
BalancerMember http://172.16.26.210:15000 loadfactor=1 retry=0 route=2
BalancerMember http://172.16.27.87:15000 loadfactor=1 retry=0 route=3
Order Deny,Allow
Deny from none
Allow from all
ProxySet lbmethod=byrequests
ProxySet stickysession=ROUTEID
</Proxy>
</VirtualHost>
<Location /balancer-manager>
SetHandler balancer
</Location>
When I do a query(Type ahead service) I'm getting the following error..
** Error Fri Apr 10 20:05:53 IST 2015 1428676553858 /atg/rest/processor/RestActorManager Caused by (#6):com.endeca.navigation.ENEException: HTTP Error 404 - Navigation Engine not able to process request 'http://localhost:5555/search?terms=je&rank=0&offset=0&irversion=640'.
Can anyone please see my load balancer configuration what I'm doing wrong? Thanks
I currently have apache2 configured so that requests on specific urls such as /myapp are directed to my internal tomcat server at tomcathost:8080/myapp.
All the requests to myapp to apache2 work as expected.
The problem that I'm facing is that whenever a request is sent to myapp trough apache2 it seems that apache2 is keeping the connection open to tomcat and after a while all the threads in tomcat are taken by apache and apparently not released.
Could somebody point me in the right direction to solve this issue ?
ProxyPass /myapp balancer://apps/myapp
ProxyPassReverse /myapp balancer://apps/myapp
<Proxy balancer://apps>
BalancerMember http://appserver01:8080 route=Node01 loadfactor=1
BalancerMember http://appserver02:8080 route=Node02 loadfactor=1
ProxySet lbmethod=byrequests
ProxySet stickysession=JSESSIONID|jsessionid
ProxySet nofailover=On
</Proxy>
You can set connectiontime out in server.xml so incase if any thread is open it get timedout.
connectionTimeout="120000"
Also you might use JConsole which is part of JDK installation to monitor threads via JMX for your tomcat to see if there is any loop of threads which causes increase in threads.