topic Re: Reverse Proxy not working configuration even with expected config in Security

Reverse Proxy not working configuration even with expected config

guilmxm — Mon, 28 Sep 2020 13:08:23 GMT

Hi all,

I finally decided to post and get help from here to deal with Splunk configuration behind a reverse Proxy.
I've read and searched for many posts all over the Internet and this forum, found various solutions expected to solve this but still i have some issues.

I have an internal Reverse Proxy, Nginx running SSL requesting directly Splunk web server, also running SSL.

This almost works, i can get access to Splunk, login and so on, i can open any application and dashboards with no issue.

BUT under a few cases, it does not work as expected, some examples:

"Browse" under Manager / Add Input / Files or Directory, the browser windows starts to open with the time clock, and then noting, it keeps running with no end
"Save" button under any Manager function works as the action behind is done (like saving a new file and so on), but the button keeps being reported to "Saving" instead of returning back to previous page in normal time

My Splunk configuration is:

local/web.conf

root_endpoint = /splunk
enableSplunkWebSSL = 1
tools.proxy.on = True (--> I tried with and whitout)

under nginx:

location /splunk/ { proxy_pass https://splunkserver:8000; access_log /var/log/nginx/splunk.access.log; error_log /var/log/nginx/splunk.error.log; }

Off course, when requesting directly internally to the Splunk web server, everything works as expected.

I also tested with Apache running as reverse proxy, and got exactly the same issue.
Tried with the reverse proxy running SSL and the Splunk backend running http, same thing.
Tried "SSOMode = permissive", no change.

I searched for any interesting error in nginx logs, and splunk web logs, nothing... all i get is related GET and POST operations with code 200 for GET, so normal...

I'm suspecting problems with cookie session or something abnormal in http header, or perhaps something related to SSO splunk config, or SSL negociation and cyphers...
Getting out of idea!

Does anyone can help me getting my reverse proxy configuration to work 🙂

Tnanks!

Guilhem

Re: Reverse Proxy not working configuration even with expected config

guilmxm — Fri, 01 Feb 2013 09:20:37 GMT

Hi,

Anyone with a full working reverse proxy configuration ?

Thanks!

Re: Reverse Proxy not working configuration even with expected config

lukejadamec — Fri, 07 Feb 2014 01:39:30 GMT

Yup. Reverse https proxy with SSO definitely works. Have you tried with IIS? I've not tried with apache or nginx.

Re: Reverse Proxy not working configuration even with expected config

bshuler_splunk — Wed, 12 Mar 2014 13:18:58 GMT

Good News: What you are trying should work.

Bad News: What you are trying should work.

The documentation here may help: http://wiki.splunk.com/Community:SplunkBehindAProxy

The issue is the url re-writing. It looks like some of the urls are not being re-written correctly.

If you analyze the source of your hung pages, you will likely see references to:
http://server:8000/
or http://server/
or https://server:8000/
or http://server/splunk
instead of the one thing that will work, https://nginxserver/splunk

Once you determine what isn't being re-written correctly, you next step is to write a nginx rewire rule to fix the issue. This is documented here: http://nginx.org/en/docs/http/ngx_http_rewrite_module.html

Once you have it all working, post back here. I would love to see what you come up with!

Re: Reverse Proxy not working configuration even with expected config

guilmxm — Sun, 16 Mar 2014 21:31:42 GMT

Hi,

Thank you for answering this quite old post...

I have no doubt your analysis is right, and probably looking at nginx logs to find hung pages and generate rewrite rules would have corrected the situation.

But anyway and fortunately, what was not working using Splunk 5 version became to suddenly work with 6th version.

I guess a few things have been corrected, working with Splunk behind an nginx reverse proxy works like a charm now with the expected configuration.

Re: Reverse Proxy not working configuration even with expected config

guilmxm — Sun, 16 Mar 2014 21:32:52 GMT

Corrected with Splunk 6 version, working with Splunk behind Nginx reverse proxy works perfectly with the configuration above.