Using cockpit over Apache HTTPD Proxy.

[Daniel Hilst Selli]

I want to avoid the :9090 in the browser and, since I have Apache HTTPD
as a dependency of another tool in my stack I though about proxying
the 
ports 80 and 443 to 9090.

I wrote this config based on some reads on internet:

<VirtualHost *:80 *:443>
     ProxyPreserveHost On
     ProxyRequests Off
     ServerName myserver.com
     ProxyPass / http://localhost:9090/
     ProxyPassReverse / http://localhost:9090/
 </VirtualHost>

When I hit https://myserver.com I see the cockpit's login page, but if
I try to login it just reload the login page as soon as I hit Log In
button.

I fired a journalctl in the server and found a timeout being reported
by cockpit-ws:

Apr 12 11:29:24 vydog.versatushpc.com.br cockpit-session[5924]:
pam_ssh_add: Identity added: /home/vhpc/.ssh/id_ed25519
([e-mail])Apr 12 11:29:24 vydog.versatushpc.com.br
systemd[1]: Started Session 21 of user vhpc.-- Subject: Unit session-
21.scope has finished start-up-- Defined-By: systemd-- Support: http://
lists.freedesktop.org/mailman/listinfo/systemd-devel-- -- Unit session-
21.scope has finished starting up.-- -- The start-up result is done.Apr
12 11:29:24 vydog.versatushpc.com.br systemd-logind[547]: New session
21 of user vhpc.-- Subject: A new session 21 has been created for user
vhpc-- Defined-By: systemd-- Support: http://lists.freedesktop.org/mail
man/listinfo/systemd-devel-- Documentation: http://www.freedesktop.org/
wiki/Software/systemd/multiseat-- -- A new session with the ID 21 has
been created for the user vhpc.-- -- The leading process of the session
is 5924.Apr 12 11:29:24 vydog.versatushpc.com.br systemd[1]: Starting
Session 21 of user vhpc.-- Subject: Unit session-21.scope has begun
start-up-- Defined-By: systemd-- Support: http://lists.freedesktop.org/
mailman/listinfo/systemd-devel-- -- Unit session-21.scope has begun
starting up.Apr 12 11:29:24 vydog.versatushpc.com.br cockpit-
session[5924]: pam_unix(cockpit:session): session opened for user vhpc
by (uid=0)Apr 12 11:29:24 vydog.versatushpc.com.br polkitd[546]:
Registered Authentication Agent for unix-session:21 (system bus name
:1.107 [cockpit-bridge], object path
/org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)Apr 
12 11:29:24 vydog.versatushpc.com.br cockpit-ws[4886]: logged in user
session

Apr 12 11:29:39 vydog.versatushpc.com.br cockpit-ws[4886]: session
timed outApr 12 11:29:39 vydog.versatushpc.com.br polkitd[546]:
Unregistered Authentication Agent for unix-session:21 (system bus name
:1.107, object path /org/freedesktop/PolicyKit1/AuthenticationAgent,
locale en_US.UTF-8)Apr 12 11:29:39 vydog.versatushpc.com.br cockpit-
session[5924]: pam_unix(cockpit:session): session closed for user
vhpcApr 12 11:29:39 vydog.versatushpc.com.br systemd-logind[547]:
Removed session 21.-- Subject: Session 21 has been terminated--
Defined-By: systemd-- Support: http://lists.freedesktop.org/mailman/lis
tinfo/systemd-devel-- Documentation: http://www.freedesktop.org/wiki/So
ftware/systemd/multiseat-- -- A session with the ID 21 has been
terminated.

Any idea on how to troubleshooting this? I fell like something is
missing in my httpd configuration. After login I 
see the login page again as if the proxy was breaking the backend
redirect, ...

Regards,

[Andreas Nilsson]

On 2018-04-12 17:33, Daniel Hilst Selli wrote:
> I want to avoid the :9090 in the browser and, since I have Apache HTTPD
> as a dependency of another tool in my stack I though about proxying
> the
> ports 80 and 443 to 9090.

The recommended way is to do this with systemd sockets.
http://cockpit-project.org/guide/latest/listen.html
- Andreas

[Daniel Hilst Selli]

On Thu, 2018-04-12 at 17:40 +0200, Andreas Nilsson wrote:
> On 2018-04-12 17:33, Daniel Hilst Selli wrote:
> > I want to avoid the :9090 in the browser and, since I have Apache HTTPD
> > as a dependency of another tool in my stack I though about proxying
> > the
> > ports 80 and 443 to 9090.
>
> The recommended way is to do this with systemd sockets.
> http://cockpit-project.org/guide/latest/listen.html
> Andreas
>
> cockpit-devel mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]

Hi Andreas,

Thanks for your answer. The problem is that I can't bind to the 80 and 443 port
because of another
softwares running behind Apache... which bind to 80 and 443, I do really think
this is a problem with
my configuration since the messages at the log show the session opening and
closing after some
seconds.

Regards,

[Kyrylo Gliebov]

Could it because of WebSocket connection ( ws://<HOSTNAME>:9090 ) ?
Maybe Apache2 somehow breaks it.

On Thu, Apr 12, 2018 at 5:33 PM, Daniel Hilst Selli
 wrote:
> I want to avoid the :9090 in the browser and, since I have Apache HTTPD
> as a dependency of another tool in my stack I though about proxying
> the
> ports 80 and 443 to 9090.
>
> I wrote this config based on some reads on internet:
>
> <VirtualHost *:80 *:443>
>      ProxyPreserveHost On
>      ProxyRequests Off
>      ServerName myserver.com
>      ProxyPass / http://localhost:9090/
>      ProxyPassReverse / http://localhost:9090/
>
>  </VirtualHost>
>
> When I hit https://myserver.com I see the cockpit's login page, but if
> I try to login it just reload the login page as soon as I hit Log In
> button.
>
> I fired a journalctl in the server and found a timeout being reported
> by cockpit-ws:
>
> Apr 12 11:29:24 vydog.versatushpc.com.br cockpit-session[5924]: pam_ssh_add:
> Identity added: /home/vhpc/.ssh/id_ed25519 ([e-mail])
>
> Apr 12 11:29:24 vydog.versatushpc.com.br systemd[1]: Started Session 21 of
> user vhpc.
>
> -- Subject: Unit session-21.scope has finished start-up
>
> -- Defined-By: systemd
>
> -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
>
> --
>
> -- Unit session-21.scope has finished starting up.
>
> --
>
> -- The start-up result is done.
>
> Apr 12 11:29:24 vydog.versatushpc.com.br systemd-logind[547]: New session 21
> of user vhpc.
>
> -- Subject: A new session 21 has been created for user vhpc
>
> -- Defined-By: systemd
>
> -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
>
> -- Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
>
> --
>
> -- A new session with the ID 21 has been created for the user vhpc.
>
> --
>
> -- The leading process of the session is 5924.
>
> Apr 12 11:29:24 vydog.versatushpc.com.br systemd[1]: Starting Session 21 of
> user vhpc.
>
> -- Subject: Unit session-21.scope has begun start-up
>
> -- Defined-By: systemd
>
> -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
>
> --
>
> -- Unit session-21.scope has begun starting up.
>
> Apr 12 11:29:24 vydog.versatushpc.com.br cockpit-session[5924]:
> pam_unix(cockpit:session): session opened for user vhpc by (uid=0)
>
> Apr 12 11:29:24 vydog.versatushpc.com.br polkitd[546]: Registered
> Authentication Agent for unix-session:21 (system bus name :1.107
> [cockpit-bridge], object path
> /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)
>
> Apr 12 11:29:24 vydog.versatushpc.com.br cockpit-ws[4886]: logged in user
> session
>
> Apr 12 11:29:39 vydog.versatushpc.com.br cockpit-ws[4886]: session timed out
>
> Apr 12 11:29:39 vydog.versatushpc.com.br polkitd[546]: Unregistered
> Authentication Agent for unix-session:21 (system bus name :1.107, object
> path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)
>
> Apr 12 11:29:39 vydog.versatushpc.com.br cockpit-session[5924]:
> pam_unix(cockpit:session): session closed for user vhpc
>
> Apr 12 11:29:39 vydog.versatushpc.com.br systemd-logind[547]: Removed
> session 21.
>
> -- Subject: Session 21 has been terminated
>
> -- Defined-By: systemd
>
> -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
>
> -- Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
>
> --
>
> -- A session with the ID 21 has been terminated.
>
> Any idea on how to troubleshooting this? I fell like something is missing in
> my httpd configuration. After login I
> see the login page again as if the proxy was breaking the backend redirect,
> ...
>
> Regards,
>
> cockpit-devel mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]

[Daniel Hilst Selli]

On Fri, 2018-04-13 at 09:17 +0200, Kyrylo Gliebov wrote:
> Could it because of WebSocket connection ( ws://<HOSTNAME>:9090 ) ?
> Maybe Apache2 somehow breaks it.

Good idea, I'll try to troubleshoot the websocket connection. THANKS!

Regards!
> On Thu, Apr 12, 2018 at 5:33 PM, Daniel Hilst Selli
>  wrote:
> > I want to avoid the :9090 in the browser and, since I have Apache HTTPD
> > as a dependency of another tool in my stack I though about proxying
> > the
> > ports 80 and 443 to 9090.
> >
> > I wrote this config based on some reads on internet:
> >
> > <VirtualHost *:80 *:443>
> >      ProxyPreserveHost On
> >      ProxyRequests Off
> >      ServerName myserver.com
> >      ProxyPass / http://localhost:9090/
> >      ProxyPassReverse / http://localhost:9090/
> >
> >  </VirtualHost>
> >
> > When I hit https://myserver.com I see the cockpit's login page, but if
> > I try to login it just reload the login page as soon as I hit Log In
> > button.
> >
> > I fired a journalctl in the server and found a timeout being reported
> > by cockpit-ws:
> >
> > Apr 12 11:29:24 vydog.versatushpc.com.br cockpit-session[5924]: pam_ssh_add:
> > Identity added: /home/vhpc/.ssh/id_ed25519 ([e-mail])
> >
> > Apr 12 11:29:24 vydog.versatushpc.com.br systemd[1]: Started Session 21 of
> > user vhpc.
> >
> > -- Subject: Unit session-21.scope has finished start-up
> >
> > -- Defined-By: systemd
> >
> > -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
> >
> > --
> >
> > -- Unit session-21.scope has finished starting up.
> >
> > --
> >
> > -- The start-up result is done.
> >
> > Apr 12 11:29:24 vydog.versatushpc.com.br systemd-logind[547]: New session 21
> > of user vhpc.
> >
> > -- Subject: A new session 21 has been created for user vhpc
> >
> > -- Defined-By: systemd
> >
> > -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
> >
> > -- Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
> >
> > --
> >
> > -- A new session with the ID 21 has been created for the user vhpc.
> >
> > --
> >
> > -- The leading process of the session is 5924.
> >
> > Apr 12 11:29:24 vydog.versatushpc.com.br systemd[1]: Starting Session 21 of
> > user vhpc.
> >
> > -- Subject: Unit session-21.scope has begun start-up
> >
> > -- Defined-By: systemd
> >
> > -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
> >
> > --
> >
> > -- Unit session-21.scope has begun starting up.
> >
> > Apr 12 11:29:24 vydog.versatushpc.com.br cockpit-session[5924]:
> > pam_unix(cockpit:session): session opened for user vhpc by (uid=0)
> >
> > Apr 12 11:29:24 vydog.versatushpc.com.br polkitd[546]: Registered
> > Authentication Agent for unix-session:21 (system bus name :1.107
> > [cockpit-bridge], object path
> > /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)
> >
> > Apr 12 11:29:24 vydog.versatushpc.com.br cockpit-ws[4886]: logged in user
> > session
> >
> > Apr 12 11:29:39 vydog.versatushpc.com.br cockpit-ws[4886]: session timed out
> >
> > Apr 12 11:29:39 vydog.versatushpc.com.br polkitd[546]: Unregistered
> > Authentication Agent for unix-session:21 (system bus name :1.107, object
> > path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)
> >
> > Apr 12 11:29:39 vydog.versatushpc.com.br cockpit-session[5924]:
> > pam_unix(cockpit:session): session closed for user vhpc
> >
> > Apr 12 11:29:39 vydog.versatushpc.com.br systemd-logind[547]: Removed
> > session 21.
> >
> > -- Subject: Session 21 has been terminated
> >
> > -- Defined-By: systemd
> >
> > -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
> >
> > -- Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
> >
> > --
> >
> > -- A session with the ID 21 has been terminated.
> >
> > Any idea on how to troubleshooting this? I fell like something is missing in
> > my httpd configuration. After login I
> > see the login page again as if the proxy was breaking the backend redirect,
> > ...
> >
> > Regards,
> >
> > cockpit-devel mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
>
> -- 
> Kirill Gliebov
> Software Engineer
> Red Hat Czech
> https://github.com/Scribery
> _______________________________________________
> cockpit-devel mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]