You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Ernesto Freyre <ef...@isp.qnet.com.pe> on 2003/03/21 18:17:29 UTC
[users@httpd] about mod_proxy
Hi List!, Please I have a consult about mod_proxy, before I was working with my Apache web server directly facing the network, but now for security reasons we implemented an schema uisng mod_proxy and forwarding requests to another Apache web server, my problem is that I must to validate the IP address from the client, but with the new configuration this value is not arriving to the proxied Apache Server, this shows the REMOTE_ADDR environment variable but whith the value of the Apache proxy. How could I to hold these variable at its original value?
Thank you for your replies in advance.
Regards,
Ernesto Freyre
Área de Operaciones
Qnet - Servicios Internet
Telf. 241-4122 anexos 2245/2244
www.qnet.com.pe
Re: [users@httpd] about mod_proxy
Posted by Joshua Slive <jo...@slive.ca>.
On Tue, 25 Mar 2003, Ernesto Freyre wrote:
> Thank you Joshua you are right , I was calling it at httpd.conf also.
> Now I am seeing that at my logs only the IP addres from the front-end is
> being recorded, exists some way the IP address contained in
> HTTP_X_FORWARDED_FOR to be recorded in logs of the back-end?
>
> Thank you for your valious time , and apologize me please for too much
> questions :-).
The documentation for logging in 1.3 is here:
http://httpd.apache.org/docs/mod/mod_log_config.html
What you need to do is find the logformat string that you are using and
replace %h with %{X-Forwarded-For}i
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] about mod_proxy
Posted by Ernesto Freyre <ef...@isp.qnet.com.pe>.
Thank you Joshua you are right , I was calling it at httpd.conf also.
Now I am seeing that at my logs only the IP addres from the front-end is
being recorded, exists some way the IP address contained in
HTTP_X_FORWARDED_FOR to be recorded in logs of the back-end?
Thank you for your valious time , and apologize me please for too much
questions :-).
Ernesto Freyre
Área de Operaciones
Qnet - Servicios Internet
Telf. 241-4122 anexos 2245/2244
www.qnet.com.pe
----- Original Message -----
From: Joshua Slive <jo...@slive.ca>
To: <us...@httpd.apache.org>
Sent: Tuesday, March 25, 2003 3:04 PM
Subject: Re: [users@httpd] about mod_proxy
>
> On Tue, 25 Mar 2003, Ernesto Freyre wrote:
>
> > Hi Joshua!! this works!! I can now get the Ip address of clients
accessing
> > the front-end server at the HTTP_X_FORWARDED_FOR variable, but I see
this
> > looks like as the same value separate by comma like this:
> >
> > HTTP_X_FORWARDED_FOR = 200.14.241.174, 200.14.241.174
> >
> > Please do you know why this appears duplicated?
>
> Just a guess, but I'd suspect you have loaded mod_proxy_add_forward twice.
> Is it possible you have it both statically loaded (check ./httpd -l) and
> dynamically loaded (via LoadModule in httpd.conf)?
>
> Alternatively, perhaps you are running a version of Apache that
> automatically adds the header. Try removing mod_proxy_add_forward and see
> if you still get it.
>
> Joshua.
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] about mod_proxy
Posted by Joshua Slive <jo...@slive.ca>.
On Tue, 25 Mar 2003, Ernesto Freyre wrote:
> Hi Joshua!! this works!! I can now get the Ip address of clients accessing
> the front-end server at the HTTP_X_FORWARDED_FOR variable, but I see this
> looks like as the same value separate by comma like this:
>
> HTTP_X_FORWARDED_FOR = 200.14.241.174, 200.14.241.174
>
> Please do you know why this appears duplicated?
Just a guess, but I'd suspect you have loaded mod_proxy_add_forward twice.
Is it possible you have it both statically loaded (check ./httpd -l) and
dynamically loaded (via LoadModule in httpd.conf)?
Alternatively, perhaps you are running a version of Apache that
automatically adds the header. Try removing mod_proxy_add_forward and see
if you still get it.
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] about mod_proxy
Posted by Ernesto Freyre <ef...@isp.qnet.com.pe>.
Hi Joshua!! this works!! I can now get the Ip address of clients accessing
the front-end server at the HTTP_X_FORWARDED_FOR variable, but I see this
looks like as the same value separate by comma like this:
HTTP_X_FORWARDED_FOR = 200.14.241.174, 200.14.241.174
Please do you know why this appears duplicated?
Thank you.
Regards,
Ernesto Freyre
Área de Operaciones
Qnet - Servicios Internet
Telf. 241-4122 anexos 2245/2244
www.qnet.com.pe
----- Original Message -----
From: Joshua Slive <jo...@slive.ca>
To: <us...@httpd.apache.org>
Sent: Tuesday, March 25, 2003 1:30 PM
Subject: Re: [users@httpd] about mod_proxy
>
>
>
> On Tue, 25 Mar 2003, Ernesto Freyre wrote:
>
> > Thank you for your fast reply !!,
> >
> > Please I have some further questions :
> >
> > After I have configure, make and make install how I could to recognize
in my
> > httpdd.conf this is well configured form mod_proxy_add_forward?
> >
> > I can see also that at is mentioned that at httpd.conf should to appears
the
> > line:
> >
> > PerlPostReadRequestHandler My::ProxyRemoteAddr
> >
> > I suspect then this is only for examples purpose? but at what specific
point
> > this sould to be placed?
>
> Right, and it is an example for the back-end server, not the front-end
> where mod_proxy_add_forward is installed.
>
> All you need to do is compile and load the module as described near the
> bottom of the comment section on top.
>
> Joshua.
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] about mod_proxy
Posted by Joshua Slive <jo...@slive.ca>.
On Tue, 25 Mar 2003, Ernesto Freyre wrote:
> Thank you for your fast reply !!,
>
> Please I have some further questions :
>
> After I have configure, make and make install how I could to recognize in my
> httpdd.conf this is well configured form mod_proxy_add_forward?
>
> I can see also that at is mentioned that at httpd.conf should to appears the
> line:
>
> PerlPostReadRequestHandler My::ProxyRemoteAddr
>
> I suspect then this is only for examples purpose? but at what specific point
> this sould to be placed?
Right, and it is an example for the back-end server, not the front-end
where mod_proxy_add_forward is installed.
All you need to do is compile and load the module as described near the
bottom of the comment section on top.
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] about mod_proxy
Posted by Ernesto Freyre <ef...@isp.qnet.com.pe>.
Thank you for your fast reply !!,
Please I have some further questions :
After I have configure, make and make install how I could to recognize in my
httpdd.conf this is well configured form mod_proxy_add_forward?
I can see also that at is mentioned that at httpd.conf should to appears the
line:
PerlPostReadRequestHandler My::ProxyRemoteAddr
I suspect then this is only for examples purpose? but at what specific point
this sould to be placed?
Thank you again.
Ernesto Freyre
Área de Operaciones
Qnet - Servicios Internet
Telf. 241-4122 anexos 2245/2244
www.qnet.com.pe
----- Original Message -----
From: Joshua Slive <jo...@slive.ca>
To: <us...@httpd.apache.org>
Sent: Tuesday, March 25, 2003 12:52 PM
Subject: Re: [users@httpd] about mod_proxy
>
> On Tue, 25 Mar 2003, Ernesto Freyre wrote:
>
> > Thank you for your reply, I have a doubt about the named "startup.pl"
> > script mentioned at
> >
> > http://develooper.com/code/mpaf/mod_proxy_add_forward.c
> >
> > when and from this "startup.pl" script must be called?
>
> That is just an example mod_perl script that the author uses to shove
> the IP address back into its usual place. But you don't need to use
> anything like it. You can simply look at the X-Forwarded-For HTTP
> request header, which can be logged or passed to cgi scripts in the
> normal manner.
>
> Joshua.
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] about mod_proxy
Posted by Joshua Slive <jo...@slive.ca>.
On Tue, 25 Mar 2003, Ernesto Freyre wrote:
> Thank you for your reply, I have a doubt about the named "startup.pl"
> script mentioned at
>
> http://develooper.com/code/mpaf/mod_proxy_add_forward.c
>
> when and from this "startup.pl" script must be called?
That is just an example mod_perl script that the author uses to shove
the IP address back into its usual place. But you don't need to use
anything like it. You can simply look at the X-Forwarded-For HTTP
request header, which can be logged or passed to cgi scripts in the
normal manner.
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] about mod_proxy
Posted by Ernesto Freyre <ef...@isp.qnet.com.pe>.
Thank you for your reply, I have a doubt about the named "startup.pl"
script mentioned at
http://develooper.com/code/mpaf/mod_proxy_add_forward.c
when and from this "startup.pl" script must be called?
Thank you.
Ernesto Freyre
Área de Operaciones
Qnet - Servicios Internet
Telf. 241-4122 anexos 2245/2244
www.qnet.com.pe
----- Original Message -----
From: Joshua Slive <jo...@slive.ca>
To: <us...@httpd.apache.org>
Sent: Friday, March 21, 2003 12:24 PM
Subject: Re: [users@httpd] about mod_proxy
>
> On Fri, 21 Mar 2003, Ernesto Freyre wrote:
>
> > Hi List!, Please I have a consult about mod_proxy, before I was working
> > with my Apache web server directly facing the network, but now for
> > security reasons we implemented an schema uisng mod_proxy and forwarding
> > requests to another Apache web server, my problem is that I must to
> > validate the IP address from the client, but with the new configuration
> > this value is not arriving to the proxied Apache Server, this shows the
> > REMOTE_ADDR environment variable but whith the value of the Apache
> > proxy. How could I to hold these variable at its original value?
> >
> > Thank you for your replies in advance.
>
> One solution is here:
> http://develooper.com/code/mpaf/
>
> If you are using mod_rewrite there are other ways to do it.
>
> Joshua.
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] about mod_proxy
Posted by Joshua Slive <jo...@slive.ca>.
On Fri, 21 Mar 2003, Ernesto Freyre wrote:
> Hi List!, Please I have a consult about mod_proxy, before I was working
> with my Apache web server directly facing the network, but now for
> security reasons we implemented an schema uisng mod_proxy and forwarding
> requests to another Apache web server, my problem is that I must to
> validate the IP address from the client, but with the new configuration
> this value is not arriving to the proxied Apache Server, this shows the
> REMOTE_ADDR environment variable but whith the value of the Apache
> proxy. How could I to hold these variable at its original value?
>
> Thank you for your replies in advance.
One solution is here:
http://develooper.com/code/mpaf/
If you are using mod_rewrite there are other ways to do it.
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org