7

I am attempting to use ProxyPass and ProxyPassReverse to proxy requests through Apache to another server instance that is bound to the localhost on a different TCP port that the Vhost exists (VHost is bound to :80, when the target is bound to :5000).

However, I am repeatedly receiving HTTP 503 when accessing the Location.

According to the ProxyPass documentation...

<VirtualHost *:80>
    ServerName apacheserver.domain.local
    DocumentRoot /var/www/redmine/public
    ErrorLog logs/redmine_error

    <Directory /var/www/redmine/public>
            Allow from all
            Options -MultiViews
            Order allow,deny
            AllowOverride all
    </Directory>
</VirtualHost>
PassengerTempDir /tmp/passenger

<Location /rhodecode>
  ProxyPass http://127.0.0.1:5000/rhodecode
  ProxyPassReverse http://127.0.0.1:5000/rhodecode
  SetEnvIf X-Url-Scheme https HTTPS=1
</Location>

I have tested binding the alternate server to the interface IP address, and the same issue occurs.

The server servicing request is an instance of python paste:httpserver, and it has been configured to use the /rhodecode suffix (as I saw this to be mentioned in other posts about ProxyPass). The documentation from the project itself, Rhodecode, reports to use the above.

The issue is persistent if I target another server that is serving on a different port.

Does ProxyPass allow proxying to a different TCP port?

[update]

I won't delete this, in case someone comes across the same issue.

I had set an ErrorLog, and in that ErrorLog the following error was reported:

[Wed Nov 09 11:36:35 2011] [error] (13)Permission denied: proxy: HTTP: attempt to connect to 127.0.0.1:5000 (192.168.100.100) failed
[Wed Nov 09 11:36:35 2011] [error] ap_proxy_connect_backend disabling worker for (192.168.100.100)

After some more research, I attempted to set SELinux to permissive (echo 0 >/selinux/enforce), and try again.

It turns out the SELinux boolean httpd_can_network_connect must be set to 1.

For persistence on reboot:

setsebool -P httpd_can_network_connect=1

Improve this question
3
  • 1
    If you connect to 127.0.0.1:5000/rhodecode directly do you get a response?
    – David
    Nov 9, 2011 at 16:23
  • Yes, I have tested this with lynx on the local machine.
    – brandeded
    Nov 9, 2011 at 16:37
  • Seems like it could be related to SELinux. I will changed to permissive and attempt again
    – brandeded
    Nov 9, 2011 at 16:40

1 Answer 1

Reset to default
5

A nicer way to fix this (to have your cake and eat it) with regards to SELinux is to run this command to make httpd_t types aware of the port you are using..

semanage port -a -p tcp -t http_port_t 5000

You can turn off that boolean then and still get it to work.

Improve this answer
4
  • 2
    Thanks man. I spotted that boolean on this manpage on die.net. It indicates: SELinux policy can be setup such that httpd scripts are not allowed to connect out to the network. This would prevent a hacker from breaking into you httpd server and attacking other machines. If you need scripts to be able to connect you can set the httpd_can_network_connect boolean on. I believe the "httpd scripts are not allowed to connect out to the network" is a default policy. Meaning, regardless of the port policy, wouldn't this boolean also have to be set to 1?
    – brandeded
    Nov 14, 2011 at 1:48
  • 2
    Well, I had to perform setsebool -P httpd_can_network_connect=1, just tuning the port label didn't do it. Fedora 29.
    – David Tonhofer
    Apr 10, 2019 at 19:55
  • 1
    Matthrex, @DavidTonhofer - adding the port to http_port_t only works if a SE-boolean that guards http_port_t usage is enabled, as well - such us httpd_can_network_relay. Note that httpd_can_network_relay is disabled, by default - and that it also guards some other port labels such as http_cache_port_t. Enabling httpd_can_network_connect always works because it allows connections to any port. Thus the advantage of using something else is to have less ports reachable from a compromised http server.
    – maxschlepzig
    Feb 14, 2021 at 13:46
  • Seems on EL7 and EL8 there are a few booleans that control it which are on by default. [root@scratch-el8 ~]# sesearch -s httpd_t --allow -t http_port_t -p name_connect allow httpd_t http_port_t:tcp_socket name_connect; [ httpd_can_network_relay ]:True allow httpd_t http_port_t:tcp_socket name_connect; [ httpd_graceful_shutdown ]:True allow httpd_t port_type:tcp_socket name_connect; [ httpd_can_network_connect ]:True allow nsswitch_domain reserved_port_type:tcp_socket name_connect; [ nis_enabled ]:True In particular httpd_graceful_shutdown
    – Matthew Ife
    Feb 14, 2021 at 18:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.