Hot answers tagged

92

Schematic: ssh ssh A ------> B ------> C ^ ^ using A's using B's ssh key ssh key Preconditions: A is running ssh-agent; A can access B; B can access C; A's ssh public key is present in B:~/.ssh/authorized_keys B's ssh public key is present in C:~/.ssh/authorized_keys In ~/.ssh/config on A, add Host C ProxyCommand ...


68

You should use URI part in proxy_pass directive. Also, you mixed up order arguments of proxy_redirect directive, and probably you don't need it at all. Nginx has reasonable default for this directive. In this case your location block could be really simple: location /some/path/ { proxy_pass http://192.168.1.24/; # note this slash -----------^ ...


63

First, you shouldn't use root directive inside the location block, it is a bad practice. In this case it doesn't matter though. Try adding a second location block: location ~ /some/path/(?<section>.+)/index.html { proxy_pass http://192.168.1.24/$section/index.html; proxy_set_header Host $host; } This captures the part after /some/path/ and ...


56

A small addition to the great answer from Xaviar: If you happen to be not so well acquainted with nginx, there's an important difference between adding the slash to the end of the proxy_pass directive. The following does not work: location ~* ^/dir/ { rewrite ^/dir/(.*) /$1 break; proxy_pass http://backend/; but this one does: location ~* ^/dir/ { ...


49

You didn't told nginx for how much time the response is valid and must be served from cache. This must be specified with proxy_cache_valid directive. proxy_cache one; proxy_cache_key $host$uri$is_args$args; proxy_cache_valid 200 10m; But, this won't work for POST requests because you have no cache key that differs from a POST request to another on the ...


36

it looks like proxy_http_module isn't getting loaded, make sure you have following inside of your httpd.conf: LoadModule proxy_http_module modules/mod_proxy_http.so


35

Unless I completely misread your question: You simply set up server blocks for each sub-domain and the define the correct reverse proxy for the root of that subdomain i.e. something along the lines of: server { server_name subdomain1.example.com; location / { proxy_pass http://hostname1:port1; } } server { ...


30

You can use AWS API Gateway (documentation). API Gateway helps developers deliver robust, secure and scalable mobile and web application backends. API Gateway allows developers to securely connect mobile and web applications to business logic hosted on AWS Lambda, APIs hosted on Amazon EC2, or other publicly addressable web services hosted inside or ...


29

The header attribute USER_CUSTOMER is invalid syntax. Underscores are not valid in header attributes. There is a workaround but best solution is to rewrite the attribute to valid syntax. Workaround is to set the following where you specify the server name in config: underscores_in_headers on;


26

Although you could achieve this with if, this is generally discouraged by the Nginx documentation, because if doesn't play well with other directives. For example, assume that GET should be open for everyone, while POST is only for authenticated users, using HTTP Basic Auth. That would require if to be combined with auth_basic, which doesn't work properly. ...


24

The -k option should do the trick. From the manpage of nc(1): -k Forces nc to stay listening for another connection after its current connection is completed. It is an error to use this option without the -l option. I've noticed the netcat-traditional package on Debian/Ubuntu does not keep listening as it should. In that case use ...


24

It tells you that the URI in the proxy pass directive can't be used in a regex location. This is because nginx can't replace the part of the URI matching the regex in the location block with the one passed in the proxy_pass directive a generic way. Simply imagine your location regex is /foo/(.*)/bar, and you specify proxy_pass http://server/test, nginx ...


23

There is now a module in the Apache trunk called mod_proxy_wstunnel which allows mod_proxy (ProxyPass/ProxyPassReverse) to pass through WebSocket traffic. Someone wrote a blog post about back-porting mod_proxy_wstunnel to Apache 2.4/2.2 and provided a patch to do so. I figured out concrete instructions to set up mod_proxy_wstunnel on Ubuntu (tested with ...


23

Is it sufficient to have the client certificate details passed through? You can add proxy_set_header X-SSL-CERT $ssl_client_escaped_cert; to your config and then the certificate info is available to server B via a X-SSL-Cert header.


21

As per this bug, the fix is to use a full path. So this is the correct line in the .ssh/config: ProxyCommand C:\Windows\System32\OpenSSH\ssh.exe jumphost netcat -w 120 %h %p For further development see this issue: https://github.com/microsoft/vscode-remote-release/issues/18


20

From what you describe, GOR seems to fit your needs. https://github.com/buger/gor/ "HTTP traffic replay in real-time. Replay traffic from production to staging and dev environnements." ?


19

Sure. But be careful; a lot of web applications aren't designed well for having their URL path change. Is the application used in a sub-directory currently? # You'll probably want this to maintain the host mapping in IIS ProxyPreserveHost On # Swap in the IP address or internal host name of your IIS server: ProxyPass /subdir/ http://192.0.2.100/subdir/ ...


19

Yes, HTTPs will put a damper on network caching. Specifically because caching HTTPs requires doing a man in the middle type attack - replacing the SSL certificate with that of the cache server. That certificate will have to be generated on the fly and signed by a local authority. In a corporate environment you can make all PCs trust your cache server ...


19

You are missing the backend type definition (file, Docker, Swarm...). In your case just add (or uncomment) [file] in your conf file, like that: defaultEntryPoints = ["http"] [entryPoints] [entryPoints.http] address = ":80" [file] [backends] [backends.backend1] [backends.backend1.servers.server1] url = "http://10.0....


18

Looks like this feature has been recently added to docker, particularly in version 1.11.0. Though there isn't enough documentation about its usage, setting the ALL_PROXY environment variable should work, according to this comment. $ export ALL_PROXY=socks5://localhost:port $ docker pull image I'm not sure about docker-compose at the moment. If your ...


18

TL;DR ProxyCommand ssh.exe -q -W %h:%p yyy The long(?) story Running ssh -vvv XXX shows: debug3: spawning "C:\\Windows\\System32\\OpenSSH\\ssh -q -W XXX:22 YYY" CreateProcessW failed error:2 posix_spawn: No such file or directory According to CreateProcess document on MSDN, I guess posix_spawn is calling CreateProcess in a way that lpApplicationName ...


17

Let's look at your rewrite line: rewrite /tomcatapi/(.*) $1 break; You're taking the bit in brackets (i.e. everything after /tomcatapi/), which gets assigned to $1, and using that as the sole contents of your rewritten URI. In your example, there is nothing after /tomcatapi/, so the rewrite ends up empty, and this is what nginx is moaning about. If you ...


17

proxy_http module requires proxy, and ProxyPass directive is defined in the latter. Make sure it's also loaded.


16

Your response probably has other content-type than defined in sub_filter_types by default. Reference: http://nginx.org/r/sub_filter_types


16

Next solution works pretty good and is exactly what I wanted: map $http_user_agent $outdated { default 0; "~MSIE [1-9]\." 1; "~Mozilla.*Firefox/[1-9]\." 1; "~Mozilla.*Firefox/[0-2][0-9]\." 1; "~Mozilla.*Firefox/3[0-1]\." 1; "~Opera.*Version/[0-9]\." ...


16

From: http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cache_valid Syntax: proxy_cache_valid [code ...] time; ... Parameters of caching can also be set directly in the response header. This has higher priority than setting of caching time using the directive. The “X-Accel-Expires” header field sets caching time of a ...


15

To keep performance at a maximum (avoiding a regex every hit) but still cleaning up the config, I'd use an external file for your ACLs here. For example let's say you had a file called /etc/haproxy/sub1urls, which was exactly this: apple.gamma.com banana.gamma.com cherry.gamma.com Then in your config the ACL could simply be: acl is_sub1 hdr(host) -i -f /...


15

A Bastion host is a machine that is outside of your security zone. And is expected to be a weak point, and in need of additional security considerations. Because your security devices are technically outside of your security zone, firewalls and security appliances are also considered in most cases Bastion hosts. Usually we're talking about: DNS Servers ...


14

First, run cmd as administrator to open a command prompt. Command to copy proxy settings of current user to WinHttp: netsh winhttp import proxy source =ie To reset the proxy to default settings: netsh winhttp reset proxy To show proxy settings of current user: netsh winhttp show proxy


14

It's in the Host header: curl -v http://www.google.ca/ >/dev/null * Hostname was NOT found in DNS cache % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Trying 2607:...


Only top voted, non community-wiki answers of a minimum length are eligible