0

I have a Single Vmware ESXi host in a private Network which I have exposed the management into the public Internet via an Apache Reverse Proxy configuration. In order to make it harder to random people to detect the service running on the Domain I applied Basic Authentication which works, but I had to disable it for some sites to make all the Features of the management console work.

Here is my configuration:

<IfModule mod_ssl.c>
SSLStaplingCache shmcb:/tmp/stapling_cache(128000)
<VirtualHost *:443>
    Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
    Header always set X-Frame-Options SAMEORIGIN
    Header always set X-Content-Type-Options nosniff
    Header always set X-Xss-Protection "1; mode=block"
    ServerAdmin webmaster@example.org
    ServerName server.example.org
    ServerAlias vmware.example.org

    DocumentRoot /var/www

    Include /etc/apache2/conf-available/example.org-ssl-wildcard.conf

    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/

    ErrorLog ${APACHE_LOG_DIR}/vmware_error.log

    # Possible values include: debug, info, notice, warn, error, crit, alert, emerg.
    LogLevel warn

    CustomLog ${APACHE_LOG_DIR}/vmware_access.log combined

    #Modules needed: proxy, proxy_http, proxy_wstunnel
    SSLProxyEngine On
    ProxyRequests On
    ProxyVia On
    ProxyPreserveHost Off
    #Self signed Cert
    SSLProxyCheckPeerCN Off
    SSLProxyCheckPeerName Off
    ProxyPass /ticket/ wss://192.168.2.50/ticket/ retry=1 acquire=3000 timeout=600 Keepalive=On
    ProxyPassReverse /ticket/ wss://192.168.2.50/ticket/
    ProxyPass / https://192.168.2.50/ keepalive=On flushpackets=On
    ProxyPassReverse / https://192.168.2.50/

    <Location /ui>
        AuthType Basic
        AuthName "Restricted Content"
        AuthUserFile /etc/apache2/.htpasswd
        Require valid-user

        Options -Indexes
        Options FollowSymLinks

        ProxyPass https://192.168.2.50/ui keepalive=On flushpackets=On
        ProxyPassReverse https://192.168.2.50/ui
    </Location>
</VirtualHost>
</IfModule>

As you can see, I Had to expose the webroot / to be accessible without password to make it work. Otherwise I landed in a redirect loop. Also the websocket port had to be exposed without authentication. And to make things worse: The ESXi seems to also use basic Authentication, so when I try to open up the web console and the Apache based user does not match the ESXi User I have to re-authenticate using the ESXi username and password to continue! (This does not happen when I configure the Apache user with the same password as on the ESXi side)

Any Ideas on how to secure the whole site with Basic auth without breaking the ESXi Authentication and more important the websocket

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.