Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have apache running on a fw machine that reverse proxies different folders to different back end servers, and also wraps the connection in SSL. ...a fairly common setup.

Predictably, the backend mediawiki instance believes all access is coming from 1 IP, that of the reverse proxy. Since it's a significant part of mediawiki functionality that is lost, is it possible to pass the correct IP address for mediawiki to reference and use for user management and logging i.e. IP assertion? HTTP headers would make sense.

share|improve this question

2 Answers 2

up vote 1 down vote accepted

Absolutely.

If you are using mod_proxy_http, Apache is likely already sending the real IP in the X-Forwarded-For headers.

It looks like MediaWiki supports this out of the box by enabling a variable in your configuration:

$wgUsePrivateIPs = true;
$wgSquidServers = array( 'proxy fqdn', 'proxy ip address' );

More info: https://www.mediawiki.org/wiki/Manual:$wgUsePrivateIPs

Enabling this will tell MediaWiki to read the client IP from X-Forwarded-For headers.

share|improve this answer
    
Worked like a charm -- also added my interpretation of the other variable required. –  khaki54 Jul 26 '13 at 15:04
    
Also... Welcome to serverfault! –  khaki54 Jul 26 '13 at 18:06
    
-1 - instead of $wgSquidServers, should use $wgSquidServersNoPurge –  danorton Feb 22 at 20:55
    
Sorry, I can't seem to undo the -1. I was relying on incorrect documentation but I see that, in practice, it must be $wgSquidServers. –  danorton Feb 22 at 21:33

You could try the following module for apache

# yum info mod_extract_forwarded
Name        : mod_extract_forwarded
Arch        : x86_64
Version     : 2.0.2
Release     : 8.el6
Size        : 15 k
Repo        : epel
Summary     : Extract real source IP for forwarded HTTP requests
URL         : http://www.openinfo.co.uk/apache/
License     : ASL 1.1
Description : mod_extract_forwarded hooks itself into Apache's header parsing phase and looks
            : for the X-Forwarded-For header which some (most?) proxies add to the proxied
            : HTTP requests. It extracts the IP from the X-Forwarded-For and modifies the
            : connection data so to the rest of Apache the request looks like it came from
            : that IP rather than the proxy IP.
share|improve this answer
    
+1 Hmmm this looks like a good idea if the app didn't have native support already. I will have to keep this in mind for future projects though. Thanks. –  khaki54 Jul 26 '13 at 18:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.