Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently trying to offload some of the file serving puppet does using NGINX (As displayed here, however I keep having 403 errors on both file and catalog retrieval.

One thing that did fix it was adding "auth any" to the first definition in my auth.conf yet as far as I'm aware that would disable client verification completely?

So am I not passing all the needed headers with NGINX or is there something else wrong? Config files follow.


logdir = /var/log/puppet
rundir = /var/run/puppet
ssldir = $vardir/ssl
server = Puppet.xServ

    external_nodes = /usr/sbin/external_nodes
    node_terminus = exec

    certname = puppet.xserv

classfile = $vardir/classes.txt
localconfig = $vardir/localconfig


path ~ ^/catalog/([^/]+)$
method find
allow localhost
allow $1

path /certificate_revocation_list/ca
method find
allow *

path /report
method save
allow *

path /file
allow *

path /certificate/ca
auth no
method find
allow *

path /certificate/
auth no
method find
allow *

path /certificate_request
auth no
method find, save
allow *

path /
auth any 


allow *


server {
    listen 8140;

    ssl on; 
    ssl_session_timeout 5m; 
    ssl_certificate /var/lib/puppet/ssl/certs/puppet.xserv.pem;
    ssl_certificate_key /var/lib/puppet/ssl/private_keys/puppet.xserv.pem; 
    ssl_client_certificate /var/lib/puppet/ssl/ca/ca_crt.pem; 
    ssl_verify_client optional; 

    root /etc/puppet;

    # make sure we serve everything
    # as raw 
    types { } 
    default_type application/x-raw;

    # ask the puppetmaster for everything else
    location / { 
        proxy_redirect off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Client-Verify $ssl_client_verify;
        proxy_set_header X-SSL-Subject $ssl_client_s_dn;
        proxy_set_header X-SSL-Issuer $ssl_client_i_dn;
        proxy_buffer_size 16k;
        proxy_buffers 8 32k;
        proxy_busy_buffers_size 64k;
        proxy_temp_file_write_size 64k;
        proxy_read_timeout 65; 
share|improve this question

Puppet authentication is based on the IP of origin, not on what a header file is saying. After all, header files are easily faked. I don't know if Puppet can be configured to take the IP it checks from a header file.

share|improve this answer
As far as I know it bases it on the data in the SSL certificate of the client, it also indeed normally only allows the specific hostname of a single client to access that client's catalog, but that's why I added the "allow localhost" – Not Available May 22 '11 at 9:26
@Xeross yes but imagine that attacker uses your proxy to get catalogs... – confiq Mar 31 '15 at 15:07

It seems I had an error in my configuration, I have copied over a working configuration from someone else and it started working instantly, and I also switched to Unicorn so that also might have to do something with it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.