Skip to main content
Solved

Centreon can't access https


Forum|alt.badge.img+2

Hi,

I am trying to configure https following the centreon guide (Secure your platform | Centreon Documentation), so far everything seems to work fine in the console at least. No error on httpd.

The problem is that i can’t access the website via my navigator, i get the error “xx.xx.xx.xx was too long to answer”. If i put back the old  10-centreon.conf everything works  fine (but http only).

Here a both version of the config file (it might be a stupid mistake but i can’t find it) :

Header set X-Frame-Options: "sameorigin"
Header always edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure;SameSite=Strict
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
ServerSignature Off
ServerTokens Prod
TraceEnable Off

Define base_uri "/centreon"
Define install_dir "/usr/share/centreon"

ServerTokens Prod

<VirtualHost *:80>
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
</VirtualHost>

<VirtualHost *:443>
    #####################
    # SSL configuration #
    #####################
    SSLEngine On
    SSLProtocol All -SSLv3 -SSLv2 -TLSv1 -TLSv1.1
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-DSS-AES256-GCM-SHA384:DHE-DSS-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-GCM-SHA256:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ADH:!IDEA
    SSLHonorCipherOrder On
    SSLCompression Off
    SSLCertificateFile /etc/pki/tls/certs/centreon.crt
    SSLCertificateKeyFile /etc/pki/tls/private/centreon.key

    Alias ${base_uri}/api ${install_dir}
    Alias ${base_uri} ${install_dir}/www/

    <LocationMatch ^\${base_uri}/?(?!api/latest/|api/beta/|api/v[0-9]+/|api/v[0-9]+\.[0-9]+/)(.*\.php(/.*)?)$>
        ProxyPassMatch "fcgi://127.0.0.1:9042${install_dir}/www/$1"
    </LocationMatch>

    <LocationMatch ^\${base_uri}/?(authentication|api/(latest|beta|v[0-9]+|v[0-9]+\.[0-9]+))/.*$>
        ProxyPassMatch "fcgi://127.0.0.1:9042${install_dir}/api/index.php/$1"
    </LocationMatch>

    ProxyTimeout 300
    ErrorDocument 404 ${base_uri}/index.html
    Options -Indexes +FollowSymLinks

    <IfModule mod_security2.c>
        # https://github.com/SpiderLabs/ModSecurity/issues/652
        SecRuleRemoveById 200003
    </IfModule>

    <Directory "${install_dir}/www">
        DirectoryIndex index.php
        AllowOverride none
        Require all granted
        FallbackResource ${base_uri}/index.html
    </Directory>

    <Directory "${install_dir}/api">
        AllowOverride none
        Require all granted
    </Directory>

    <If "'${base_uri}' != '/'">
        RedirectMatch ^/$ ${base_uri}
    </If>
</VirtualHost>
#
# Section added by Centreon Install Setup
#
Header set X-Frame-Options: "sameorigin"
Header always edit Set-Cookie ^(.*)$ $1;HttpOnly
ServerSignature Off
ServerTokens Prod
TraceEnable Off

Alias /centreon/api /usr/share/centreon
Alias /centreon /usr/share/centreon/www/

<LocationMatch ^/centreon/(?!api/latest/|api/beta/|api/v[0-9]+/|api/v[0-9]+\.[0-9]+/)(.*\.php(/.*)?)$>
    ProxyPassMatch fcgi://127.0.0.1:9042/usr/share/centreon/www/$1
</LocationMatch>

<LocationMatch ^/centreon/(authentication|api/(latest|beta|v[0-9]+|v[0-9]+\.[0-9]+))/.*$>
    ProxyPassMatch fcgi://127.0.0.1:9042/usr/share/centreon/api/index.php/$1
</LocationMatch>

ProxyTimeout 300

<Directory "/usr/share/centreon/www">
    DirectoryIndex index.php
    Options Indexes
    AllowOverride all
    Order allow,deny
    Allow from all
    Require all granted
    <IfModule mod_php5.c>
        php_admin_value engine Off
    </IfModule>

    FallbackResource /centreon/index.html

    AddType text/plain hbs
</Directory>

<Directory "/usr/share/centreon/api">
    Options Indexes
    AllowOverride all
    Order allow,deny
    Allow from all
    Require all granted
    <IfModule mod_php5.c>
        php_admin_value engine Off
    </IfModule>

    AddType text/plain hbs
</Directory>

RedirectMatch ^/$ /centreon

 

Thanks in advance ^^

 

Best answer by Kriko

Hello o/

When you restarted httpd, there is nothing in /var/log/httpd/error_log or /var/log/httpd24/error_log (or even in /var/log/messages) ?

firewalld and iptables are disabled ?

Regards,

View original
Did this topic help you find an answer to your question?

Forum|alt.badge.img+16
  • Steward **
  • May 30, 2022

Hello o/

When you restarted httpd, there is nothing in /var/log/httpd/error_log or /var/log/httpd24/error_log (or even in /var/log/messages) ?

firewalld and iptables are disabled ?

Regards,


Forum|alt.badge.img+2
  • Steward *
  • May 30, 2022

Thanks.

The  /var/log/httpd/error_log was empty and I didn’t see any error in /var/log/messages.

I have some lines that I will need to look into in the /var/log/httpd24/error_log.

If there was a problem with either firewalld and iptables, why is it working in http only ?

 

 

Show content

[Sun May 29 03:47:01.811462 2022] [ssl:warn] [pid 4045] AH01906: centreon:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Sun May 29 03:47:01.811575 2022] [http2:warn] [pid 4045] AH10034: The mpm module (prefork.c) is not supported by mod_http2. The mpm determines how things are processed in your server. HTTP/2 has more demands in this regard and the currently selected mpm$
[Sun May 29 03:47:01.812094 2022] [lbmethod_heartbeat:notice] [pid 4045] AH02282: No slotmem from mod_heartmonitor
[Sun May 29 03:47:01.812339 2022] [mpm_prefork:notice] [pid 4045] AH00163: Apache/2.4.34 (Red Hat) OpenSSL/1.0.2k-fips configured -- resuming normal operations
[Sun May 29 03:47:01.812345 2022] [core:notice] [pid 4045] AH00094: Command line: '/opt/rh/httpd24/root/usr/sbin/httpd -D FOREGROUND'
[Mon May 30 10:55:01.178581 2022] [mpm_prefork:notice] [pid 4045] AH00170: caught SIGWINCH, shutting down gracefully
[Mon May 30 10:55:19.386240 2022] [core:notice] [pid 1266] SELinux policy enabled; httpd running as context system_u:system_r:httpd_t:s0
[Mon May 30 10:55:19.393978 2022] [ssl:warn] [pid 1266] AH01906: centreon:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Mon May 30 10:55:19.394454 2022] [suexec:notice] [pid 1266] AH01232: suEXEC mechanism enabled (wrapper: /opt/rh/httpd24/root/usr/sbin/suexec)
[Mon May 30 10:55:19.402307 2022] [:notice] [pid 1266] ModSecurity for Apache/2.9.3 (http://www.modsecurity.org/) configured.
[Mon May 30 10:55:19.402321 2022] [:notice] [pid 1266] ModSecurity: APR compiled version="1.4.8"; loaded version="1.4.8"
[Mon May 30 10:55:19.402324 2022] [:notice] [pid 1266] ModSecurity: PCRE compiled version="8.32 "; loaded version="8.32 2012-11-30"
[Mon May 30 10:55:19.402329 2022] [:notice] [pid 1266] ModSecurity: LUA compiled version="Lua 5.1"
[Mon May 30 10:55:19.402330 2022] [:notice] [pid 1266] ModSecurity: YAJL compiled version="2.0.4"
[Mon May 30 10:55:19.402332 2022] [:notice] [pid 1266] ModSecurity: LIBXML compiled version="2.9.1"
[Mon May 30 10:55:19.402334 2022] [:notice] [pid 1266] ModSecurity: Status engine is currently disabled, enable it by set SecStatusEngine to On.
[Mon May 30 10:55:19.586143 2022] [ssl:warn] [pid 1266] AH01906: centreon:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Mon May 30 10:55:19.586234 2022] [http2:warn] [pid 1266] AH10034: The mpm module (prefork.c) is not supported by mod_http2. The mpm determines how things are processed in your server. HTTP/2 has more demands in this regard and the currently selected mpm$
[Mon May 30 10:55:19.586646 2022] [lbmethod_heartbeat:notice] [pid 1266] AH02282: No slotmem from mod_heartmonitor
[Mon May 30 10:55:19.591365 2022] [mpm_prefork:notice] [pid 1266] AH00163: Apache/2.4.34 (Red Hat) OpenSSL/1.0.2k-fips configured -- resuming normal operations
[Mon May 30 10:55:19.591393 2022] [core:notice] [pid 1266] AH00094: Command line: '/opt/rh/httpd24/root/usr/sbin/httpd -D FOREGROUND'

 


Forum|alt.badge.img+2
  • Steward *
  • May 30, 2022

Great news i stop the firewalld service just to be sure… 

I now know what is the problem

 

 


Forum|alt.badge.img+16
  • Steward **
  • May 30, 2022

The SSL configuration seems to be wrong:

[Sun May 29 03:47:01.811462 2022] [ssl:warn] [pid 4045] AH01906: centreon:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)

You’re in 22.04 ?


Forum|alt.badge.img+2
  • Steward *
  • May 30, 2022

Though i was 22.10 but im just blind im 21.1 xD

Also why is the https service not showing on the service list when i enabled it?

is there something else to add to allow https?


Forum|alt.badge.img+16
  • Steward **
  • May 30, 2022

Sorry did not catch you.

With firewalld off it’s working ?


Forum|alt.badge.img+2
  • Steward *
  • May 30, 2022

Yes with firewall of its working, 


Forum|alt.badge.img+2
  • Steward *
  • May 30, 2022

upgrading to 22.04 seems to have resolved the issue x).

My bad I’m just stupid


Forum|alt.badge.img+16
  • Steward **
  • May 30, 2022

No you’re not :)

I’m not an expert on firewalld sorry about that.


Forum|alt.badge.img+2
  • Steward *
  • May 30, 2022

For some reason after the upgrade, the https is now showing in the service list.

I have no clue what was the issue appart from the config file may be !

Anyway thanks for your help !


Reply


Cookie policy

We use cookies to enhance and personalize your experience. If you accept you agree to our full cookie policy. Learn more about our cookies.

 
Cookie settings