Odd behavior after modifying Access List

[jeremy-chua]

NPM Version: 2.9.8

I created an Access List that allow certain IP addresses and assign it to some proxy hosts.

Whenever i modify that access list, the proxies being assigned the access list doesn't work anymore. There are some odd behaviors, example, prompting basic auth.

The work around is to set those proxies to public then set it back to that access list. It gets troublesome as i have quite a number of intranet applications.
A faster way is to restart the container. hehe

I believe this isn't the desired way.

[linucksrox]

I will add that any proxy hosts using the access list that has been modified starts serving the builtin self generated certificate instead of the one assigned. I have to click edit on each proxy host and just click save (no changes) and it fixes it for that host. But it's a manual process to do this for every proxy host.

The problem seems to be related to how proxy hosts are reloaded after changing an access list that is currently in use.

[ktvdev]

Can confirm same behaviour and "fix" on v2.9.9 as well.

[jbaptperez]

Same problem in v2.9.12.

2 workarounds :

• Just re-validating the concerned proxy host settings once.
• Setting the access list of concerned proxy hosts to public and then setting it back to the initial access list;

The following workaround does not work anymore:

• Restarting the container.

I exported nginx configurations in working and error cases and then applied a diff using the following commands:

# Working case
docker exec -it <npm-container-name> nginx -T > nginx.config

# Error case
docker exec -it <npm-container-name> nginx -T > nginx-error.config

diff nginx.config nginx-error.config

In the error case, some parameter are missing, only in the concerned proxy host.
I reformatted the concerned file extract for readability:

server {
  set $forward_scheme http;
  set $server         "prometheus";
  set $port           9090;

  listen 80;
  listen [::]:80;

  listen 443 ssl http2;                                                        # MISSING
  listen [::]:443 ssl http2;                                                   # MISSING

  server_name database.terra-box.dev.lm-dl.com;

  # Let's Encrypt SSL
  include conf.d/include/letsencrypt-acme-challenge.conf;                      # MISSING
  include conf.d/include/ssl-ciphers.conf;                                     # MISSING
  ssl_certificate /etc/letsencrypt/live/npm-2/fullchain.pem;                   # MISSING
  ssl_certificate_key /etc/letsencrypt/live/npm-2/privkey.pem;                 # MISSING

  # Block Exploits
  include conf.d/include/block-exploits.conf;

  # HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)    # MISSING
  add_header Strict-Transport-Security "max-age=63072000; preload" always;     # MISSING
                                                                               # MISSING
  # Force SSL                                                                  # MISSING
  include conf.d/include/force-ssl.conf;                                       # MISSING

  access_log /data/logs/proxy-host-2_access.log proxy;
  error_log /data/logs/proxy-host-2_error.log warn;

  location / {

    # Authorization
    auth_basic            "Authorization required";
    auth_basic_user_file  /data/access/1;

    proxy_set_header Authorization "";

    # Access Rules
    deny all;

    # Access checks must...

    satisfy any;

    # HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)   # MISSING
    add_header Strict-Transport-Security "max-age=63072000; preload" always;    # MISSING

    # Proxy!
    include conf.d/include/proxy.conf;
  }

  # Custom
  include /data/nginx/custom/server_proxy[.]conf;
}

Below is the raw diff:

938,940d937
< listen 443 ssl http2;
< listen [::]:443 ssl http2;
< 
945,951d941
<   # Let's Encrypt SSL
<   include conf.d/include/letsencrypt-acme-challenge.conf;
<   include conf.d/include/ssl-ciphers.conf;
<   ssl_certificate /etc/letsencrypt/live/npm-2/fullchain.pem;
<   ssl_certificate_key /etc/letsencrypt/live/npm-2/privkey.pem;
< 
< 
961,970d950
<   # HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
<   add_header Strict-Transport-Security "max-age=63072000; preload" always;
< 
< 
< 
< 
< 
<     # Force SSL
<     include conf.d/include/force-ssl.conf;
< 
1004,1009d983
< 
< 
< 
<   # HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
<   add_header Strict-Transport-Security "max-age=63072000; preload" always;
< 

Clearly, an access list change (adding a username/password) breaks the configuration which "looses" the HTTPS/certificate parts for concerned proxy hosts.

[aslmx]

I've come across this as well today, in 2.9.15.

Edit: but now i tried and the workaround descibed seems to still work...

[github-actions]

Issue is now considered stale. If you want to keep it open, please comment 👍

[github-actions]

Issue was closed due to inactivity.