Subject: mod_ssl & mod_proxy

From: "HMajidy" <[email-masked]>
Date: Thu, 5 Dec 2002 10:12:21 -0800

This is to report a problem with Apache with mod_ssl and mod_proxy, and to
request the community’s help in resolving it.

Objective: The objective is to set up Apache as a reverse proxy, to receive
encrypted HTTPS traffic over the Internet and to convert it to HTTP and
direct it to a web server through a firewall.

Problem: Apache seems to be redirecting traffic to the virtual hosts on the
local filesystem correctly, but mod_proxy does not seem to send requests to
remote URL (as specified by ProxyRemote directive below). SSL does display
correct certificate from requesting browser.

Troubleshooting Steps Taken: Experimenting with the target URL (IP and
hosname) and various proxy directives (ie ProxyPassReverse, ProxyPass) I
have not been able to establish that proxy is doing anything at all.

Apache has been recompiled with mod_ssl and mod_proxy as DSOs as well as
statically linked in modules.

Here’s the system configuration:

Linux version 2.2.16-22smp

gcc version egcs-2.91.66

Server version: Apache/1.3.27 (Unix)

Compiled-in modules:

  http_core.c

  mod_env.c

  mod_log_config.c

  mod_mime.c

  mod_negotiation.c

  mod_status.c

  mod_include.c

  mod_autoindex.c

  mod_dir.c

  mod_cgi.c

  mod_asis.c

  mod_imap.c

  mod_actions.c

  mod_userdir.c

  mod_alias.c

  mod_access.c

  mod_auth.c

  mod_proxy.c

  mod_setenvif.c

  mod_ssl.c

OpenSSL 0.9.6g 9 August 2002

httpd.conf

AddModule mod_proxy.c

<IfModule mod_proxy.c>

    ProxyRequests off

    NoCache *

    AllowCONNECT 443,80

    <Directory />

        Order Allow,Deny

        Allow from All

    </Directory>

ProxyRemote * http://1.2.3.4:85

</IfModule>

NameVirtualHost *

Listen *:443

<VirtualHost _default_:443>

        SSLEngine on

        ServerName www.mydomain.com

        DocumentRoot /usr/local/apache/htdocs

        ErrorLog logs/443-error_log

</VirtualHost>

Listen *:80

<VirtualHost *:80>

    ServerAdmin [email-masked]

    DocumentRoot /usr/local/apache/www

    ServerName www1.mydomain.com

    ErrorLog logs/80-error_log

</VirtualHost>

Can anyone see a conflict or omission in this configuration? Does anyone
have these two modules working together in a reverse proxy scenario? Any
help or suggestions would be appreciated.

Regards,

Hamid.

PS. Please reply to [email-masked] as well as to this list.

---

From: Christopher McCrory <[email-masked]>
Date: 05 Dec 2002 10:28:55 -0800

Hello...

On Thu, 2002-12-05 at 10:12, HMajidy wrote:
> This is to report a problem with Apache with mod_ssl and mod_proxy,
> and to request the communitys help in resolving it.  
> 
>  
> 
> Objective: The objective is to set up Apache as a reverse proxy, to
> receive encrypted HTTPS traffic over the Internet and to convert it to
> HTTP and direct it to a web server through a firewall.
> 

>From what I see, you don't have a proxypass directive, ala:

ProxyPass        /foo    http://cruella.pricegrabber.com/foo
ProxyPassReverse /foo    http://cruella.pricegrabber.com/foo

>  
> 
> Problem: Apache seems to be redirecting traffic to the virtual hosts
> on the local filesystem correctly, but mod_proxy does not seem to send
> requests to remote URL (as specified by ProxyRemote directive below).
> SSL does display correct certificate from requesting browser.
> 
>  
> 
> hosname) and various proxy directives (ie ProxyPassReverse, ProxyPass)
> I have not been able to establish that proxy is doing anything at all.
> 
> Apache has been recompiled with mod_ssl and mod_proxy as DSOs as well
> as statically linked in modules.
> 
>  
> 
> Heres the system configuration:
> 
> Can anyone see a conflict or omission in this configuration? Does
> anyone have these two modules working together in a reverse proxy
> scenario? Any help or suggestions would be appreciated.
> 
>  
> 
> Regards,
> 
> Hamid.
> 
>  
> 
-- 
Christopher McCrory <[email-masked]>
Pricegrabber

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Alexandre <[email-masked]>
Date: Thu, 05 Dec 2002 14:52:36 -0200

oh my God
i have the exactly the same problem ...
the only diference is that my autentication is on Ldap directory in the internal net
when a click on link http://host.myinternalnet.com
nothing hapen
only the loop
and the apache dont get a request
im sniffing the interfaces but the request dont send ok.
any people can help us ???
thanks
Alexandre
HMajidy wrote:

This is to report a problem with Apache with mod_ssl and mod_proxy, and to request the community?s help in resolving it.

<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" />
Objective: The objective is to set up Apache as a reverse proxy, to receive encrypted HTTPS traffic over the Internet and to convert it to HTTP and direct it to a web server through a firewall.

Problem: Apache seems to be redirecting traffic to the virtual hosts on the local filesystem correctly, but mod_proxy does not seem to send requests to remote URL (as specified by ProxyRemote directive below). SSL does display correct certificate from requesting browser.

Troubleshooting Steps Taken: Experimenting with the target URL (IP and hosname) and various proxy directives (ie ProxyPassReverse, ProxyPass) I have not been able to establish that proxy is doing anything at all.
Apache has been recompiled with mod_ssl and mod_proxy as DSOs as well as statically linked in modules.

Here?s the system configuration:
Linux version 2.2.16-22smp
gcc version egcs-2.91.66
Server version: Apache/1.3.27 (Unix)
Compiled-in modules:
http_core.c
mod_env.c
mod_log_config.c
mod_mime.c
mod_negotiation.c
mod_status.c
mod_include.c
mod_autoindex.c
mod_dir.c
mod_cgi.c
mod_asis.c
mod_imap.c
mod_actions.c
mod_userdir.c
mod_alias.c
mod_access.c
mod_auth.c
mod_proxy.c
mod_setenvif.c
mod_ssl.c
OpenSSL 0.9.6g 9 August 2002

httpd.conf
AddModule mod_proxy.c
<IfModule mod_proxy.c>
ProxyRequests off
NoCache *
AllowCONNECT 443,80
<Directory />
Order Allow,Deny
Allow from All
</Directory>

Can anyone see a conflict or omission in this configuration? Does anyone have these two modules working together in a reverse proxy scenario? Any help or suggestions would be appreciated.

Regards,
Hamid.

---

From: "HMajidy" <[email-masked]>
Date: Thu, 5 Dec 2002 10:34:22 -0800

Thanks for your reply. The behavior is the same with ProxyPass and ProxyPassReverse instead of ProxyRemote. 

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Christopher McCrory
Sent: Thursday, December 05, 2002 10:29 AM
To: [email-masked]
Subject: Re: mod_ssl & mod_proxy

Hello...

On Thu, 2002-12-05 at 10:12, HMajidy wrote:
> and to request the community’s help in resolving it.  
> 
>  
>

---

From: "HMajidy" <[email-masked]>
Date: Thu, 5 Dec 2002 10:39:45 -0800

Apache does get the requests in my case, as verified in log files created by
CustomLog /usr/local/apache/logs/referer_log referer
CustomLog /usr/local/apache/logs/agent_log agent in httpd.conf. BTW, my LDAP
authentication is handled by the internal (iPlanet) web server.

  -----Original Message-----
  From: [email-masked]
[mailto:[email-masked]]On Behalf Of Alexandre
  Sent: Thursday, December 05, 2002 8:53 AM
  To: [email-masked]
  Subject: Re: mod_ssl & mod_proxy

  oh my God
  the only diference is that my autentication is on Ldap directory in the
internal net

  thanks

  Alexandre

  HMajidy wrote:

    This is to report a problem with Apache with mod_ssl and mod_proxy, and
to request the community?s help in resolving it.
     <?xml:namespace prefix = o ns =
"urn:schemas-microsoft-com:office:office" />

    Objective: The objective is to set up Apache as a reverse proxy, to
receive encrypted HTTPS traffic over the Internet and to convert it to HTTP
and direct it to a web server through a firewall.

    Problem: Apache seems to be redirecting traffic to the virtual hosts on
the local filesystem correctly, but mod_proxy does not seem to send requests
to remote URL (as specified by ProxyRemote directive below). SSL does
display correct certificate from requesting browser.

    gcc version egcs-2.91.66

    Compiled-in modules:

    http_core.c

    mod_env.c

    mod_log_config.c

    mod_mime.c

    mod_negotiation.c

    mod_status.c

    mod_include.c

    mod_autoindex.c

    mod_dir.c

    mod_cgi.c

    mod_asis.c

    mod_imap.c

    mod_actions.c

    mod_userdir.c

    mod_alias.c

    mod_access.c

    mod_auth.c

    mod_proxy.c

    mod_setenvif.c

    mod_ssl.c

    httpd.conf

    AddModule mod_proxy.c

    <IfModule mod_proxy.c>

    ProxyRequests off

    NoCache *

    AllowCONNECT 443,80

    <Directory />

    Order Allow,Deny

    Allow from All

    </Directory>

    </IfModule>

    NameVirtualHost *

    Listen *:443

    SSLEngine on

    </VirtualHost>

    Listen *:80

    <VirtualHost *:80>

    </VirtualHost>

    Regards,

    Hamid.