<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2658.2">
<TITLE>RE: [Zope] apache open proxy configuration problem</TITLE>
</HEAD>
<BODY>
<P><FONT SIZE=2>I abandoned mod_proxy for mod_rewrite. Security-wise, mod_rewrite had</FONT>
<BR><FONT SIZE=2>less to worry about (this is important when website administration</FONT>
<BR><FONT SIZE=2>changes hands).</FONT>
</P>
<P><FONT SIZE=2>The sample configuration below shows how to handle Zope resource</FONT>
<BR><FONT SIZE=2>quirks and how to proxy requests to and from folders in Zope (both</FONT>
<BR><FONT SIZE=2>tested). The last rule is my guess at what "proxy everything to and</FONT>
<BR><FONT SIZE=2>from Zope" would look like (untested). Apache is listening on 80 and</FONT>
<BR><FONT SIZE=2>routes requests to a Zope instance listening on 8080.</FONT>
</P>
<P><FONT SIZE=2><IfModule mod_rewrite.c></FONT>
</P>
<P><FONT SIZE=2> RewriteEngine On</FONT>
<BR><FONT SIZE=2> RewriteLog "/path/to/rewrite_log"</FONT>
</P>
<P><FONT SIZE=2> # Zope serves some system-ish content from p_ and misc_.</FONT>
<BR><FONT SIZE=2> RewriteRule ^/p_(.*) <A HREF="http://127.0.0.1:8080/VirtualHostBase/http/%" TARGET="_blank">http://127.0.0.1:8080/VirtualHostBase/http/%</A>{HTTP_HOST}/VirtualHostRoot/p_$1 [L,P]</FONT>
<BR><FONT SIZE=2> RewriteRule ^/misc_(.*) <A HREF="http://127.0.0.1:8080/VirtualHostBase/http/%" TARGET="_blank">http://127.0.0.1:8080/VirtualHostBase/http/%</A>{HTTP_HOST}/VirtualHostRoot/misc_$1 [L,P]</FONT>
</P>
<P><FONT SIZE=2> # Apache folders served by Zope folders.</FONT>
<BR><FONT SIZE=2> RewriteRule ^/folder1(.*) <A HREF="http://127.0.0.1:8080/VirtualHostBase/http/%" TARGET="_blank">http://127.0.0.1:8080/VirtualHostBase/http/%</A>{HTTP_HOST}/VirtualHostRoot/folder1$1 [L,P]</FONT>
<BR><FONT SIZE=2> RewriteRule ^/folder2(.*) <A HREF="http://127.0.0.1:8080/VirtualHostBase/http/%" TARGET="_blank">http://127.0.0.1:8080/VirtualHostBase/http/%</A>{HTTP_HOST}/VirtualHostRoot/folder2$1 [L,P]</FONT>
</P>
<P><FONT SIZE=2> # Push everything to Zope?</FONT>
<BR><FONT SIZE=2> RewriteRule ^(.*) <A HREF="http://127.0.0.1:8080/VirtualHostBase/http/%" TARGET="_blank">http://127.0.0.1:8080/VirtualHostBase/http/%</A>{HTTP_HOST}/VirtualHostRoot/$1 [L,P]</FONT>
</P>
<P><FONT SIZE=2></IfModule></FONT>
</P>
<P><FONT SIZE=2>Aloha,</FONT>
<BR><FONT SIZE=2>Priam</FONT>
</P>
<P><FONT SIZE=2>-----Original Message-----</FONT>
<BR><FONT SIZE=2>From: zope-bounces@zope.org [<A HREF="mailto:zope-bounces@zope.org">mailto:zope-bounces@zope.org</A>] On Behalf Of Ed Colmar</FONT>
<BR><FONT SIZE=2>Sent: Saturday, October 15, 2005 9:19 AM</FONT>
<BR><FONT SIZE=2>To: zope@zope.org</FONT>
<BR><FONT SIZE=2>Subject: [Zope] apache open proxy configuration problem</FONT>
</P>
<P><FONT SIZE=2>I've been running zope through apache for years and years now, and I </FONT>
<BR><FONT SIZE=2>have a new machine set up with apache 2.0.48 and zope (Zope 2.8.0-final, </FONT>
<BR><FONT SIZE=2>python 2.3.5, linux2)</FONT>
</P>
<P><FONT SIZE=2>Using Identical Vhost configuration settings from an old machine all has </FONT>
<BR><FONT SIZE=2>been well, up until about 5 days ago, when I noticed the machine getting </FONT>
<BR><FONT SIZE=2>slammed, and wierd logs started showing up like:</FONT>
</P>
<P><FONT SIZE=2>xxx.xxx.xxx.xxx - - [14/Oct/2005:14:09:06 -0700] "GET </FONT>
<BR><FONT SIZE=2><A HREF="http://partners.mygeek.com:80/search.jsp?partnerid=98885&pagesize=12" TARGET="_blank">http://partners.mygeek.com:80/search.jsp?partnerid=98885&pagesize=12</A> </FONT>
<BR><FONT SIZE=2>HTTP/1.1" 403 406</FONT>
</P>
<P><FONT SIZE=2>(IP removed to protect the guilty)</FONT>
</P>
<P><FONT SIZE=2>In my quick research to try to determine the problem, I found people </FONT>
<BR><FONT SIZE=2>advising to turn "ProxyRequests Off", which I did, but did not have any </FONT>
<BR><FONT SIZE=2>effect.</FONT>
</P>
<P><FONT SIZE=2>Luckily this is just a development server, not a live production server, </FONT>
<BR><FONT SIZE=2>so its not super critical, but I'm nervous now that my production server </FONT>
<BR><FONT SIZE=2>might be in the same state...</FONT>
</P>
<P><FONT SIZE=2>Here is a sample vhost.conf entry:</FONT>
</P>
<P><FONT SIZE=2>NameVirtualHost 192.168.1.32</FONT>
<BR><FONT SIZE=2><VirtualHost 192.168.1.32></FONT>
<BR><FONT SIZE=2>ServerName www.greengraphics.net</FONT>
<BR><FONT SIZE=2>ServerPath /var/www/greengraphics/www</FONT>
<BR><FONT SIZE=2>DocumentRoot /var/www/greengraphics/www</FONT>
<BR><FONT SIZE=2>ServerAdmin webmaster</FONT>
<BR><FONT SIZE=2>RewriteEngine On</FONT>
<BR><FONT SIZE=2>TransferLog logs/Vhost-greengraphics-access.log</FONT>
<BR><FONT SIZE=2>ProxyRequests Off</FONT>
<BR><FONT SIZE=2> <Proxy *></FONT>
<BR><FONT SIZE=2> Order deny,allow</FONT>
<BR><FONT SIZE=2> Allow from all</FONT>
<BR><FONT SIZE=2> </Proxy></FONT>
<BR><FONT SIZE=2>ProxyPass / </FONT>
<BR><FONT SIZE=2><A HREF="http://192.168.1.32:8080/VirtualHostBase/http/www.greengraphics.net:80/greengraphics/VirtualHostRoot/" TARGET="_blank">http://192.168.1.32:8080/VirtualHostBase/http/www.greengraphics.net:80/greengraphics/VirtualHostRoot/</A></FONT>
<BR><FONT SIZE=2>ProxyPassReverse / </FONT>
<BR><FONT SIZE=2><A HREF="http://192.168.1.32:8080/VirtualHostBase/http/www.greengraphics.net:80/greengraphics/VirtualHostRoot/" TARGET="_blank">http://192.168.1.32:8080/VirtualHostBase/http/www.greengraphics.net:80/greengraphics/VirtualHostRoot/</A></FONT>
<BR><FONT SIZE=2></VirtualHost></FONT>
</P>
<BR>
<BR>
<P><FONT SIZE=2>mod_proxy.conf looks like:</FONT>
</P>
<BR>
<BR>
<BR>
<P><FONT SIZE=2><IfDefine HAVE_PROXY></FONT>
<BR><FONT SIZE=2> <IfModule !mod_proxy.c></FONT>
<BR><FONT SIZE=2> LoadModule proxy_module modules/mod_proxy.so</FONT>
<BR><FONT SIZE=2> #LoadModule proxy_connect_module modules/mod_proxy_connect.so</FONT>
<BR><FONT SIZE=2> #LoadModule proxy_ftp_module modules/mod_proxy_ftp.so</FONT>
<BR><FONT SIZE=2> LoadModule proxy_http_module modules/mod_proxy_http.so</FONT>
<BR><FONT SIZE=2> </IfModule></FONT>
<BR><FONT SIZE=2></IfDefine></FONT>
</P>
<P><FONT SIZE=2><IfModule mod_proxy.c></FONT>
</P>
<P><FONT SIZE=2>#</FONT>
<BR><FONT SIZE=2># Proxy Server directives. Uncomment the following lines to</FONT>
<BR><FONT SIZE=2># enable the proxy server:</FONT>
<BR><FONT SIZE=2>#</FONT>
</P>
<P><FONT SIZE=2>ProxyRequests Off</FONT>
</P>
<P><FONT SIZE=2><Proxy *></FONT>
<BR><FONT SIZE=2> Order deny,allow</FONT>
<BR><FONT SIZE=2> Deny from all</FONT>
<BR><FONT SIZE=2># Allow from .your-domain.com</FONT>
<BR><FONT SIZE=2></Proxy></FONT>
</P>
<P><FONT SIZE=2>#</FONT>
<BR><FONT SIZE=2># Enable/disable the handling of HTTP/1.1 "Via:" headers.</FONT>
<BR><FONT SIZE=2># ("Full" adds the server version; "Block" removes all outgoing Via: </FONT>
<BR><FONT SIZE=2>headers)</FONT>
<BR><FONT SIZE=2># Set to one of: Off | On | Full | Block</FONT>
<BR><FONT SIZE=2>#</FONT>
</P>
<P><FONT SIZE=2>ProxyVia On</FONT>
</P>
<P><FONT SIZE=2># End of proxy directives.</FONT>
</P>
<P><FONT SIZE=2></IfModule></FONT>
</P>
<BR>
<P><FONT SIZE=2>any suggestions? places to look to verify security?</FONT>
</P>
<P><FONT SIZE=2>Thanks!</FONT>
</P>
<P><FONT SIZE=2>-ed</FONT>
<BR><FONT SIZE=2>_______________________________________________</FONT>
<BR><FONT SIZE=2>Zope maillist - Zope@zope.org</FONT>
<BR><FONT SIZE=2><A HREF="http://mail.zope.org/mailman/listinfo/zope" TARGET="_blank">http://mail.zope.org/mailman/listinfo/zope</A></FONT>
<BR><FONT SIZE=2>** No cross posts or HTML encoding! **</FONT>
<BR><FONT SIZE=2>(Related lists - </FONT>
<BR><FONT SIZE=2> <A HREF="http://mail.zope.org/mailman/listinfo/zope-announce" TARGET="_blank">http://mail.zope.org/mailman/listinfo/zope-announce</A></FONT>
<BR><FONT SIZE=2> <A HREF="http://mail.zope.org/mailman/listinfo/zope-dev" TARGET="_blank">http://mail.zope.org/mailman/listinfo/zope-dev</A> )</FONT>
</P>
</BODY>
</HTML>