Comments (6)
Good catch. I installed Nginx and noticed that I wasn't getting any responses.
Turns
out, the version of nginx that was installed by Debian always uses HTTP/1.0 and
"Connection: close" when connecting through "proxy_pass". I haven't checked
whether
there are any other versions of Nginx that support HTTP/1.1 for outgoing
connections,
or whether this is a configuration option that I forgot to set.
In general, ShellInABox goes to great lengths to attempt to keep connections
open, as
that will significantly improve performance. It erroneously assumed that there
weren't any browsers and/or proxies around, that don't know how to parse
"Content-Length".
The newest code in SVN now has a fix that respects "Connection: close". With
that
change, ShellInABox should work fine when using Nginx as a reverse proxy. There
is
going to be a small performance penalty for all the connections that get
constantly
opened and closed, but as this is happening on localhost, the cost won't be as
noticable as when it happens over the WAN. Nonetheless, if you can figure out
how to
make Nginx speak HTTP/1.1 and keep outgoing connections open, you should see a
performance improvement.
There are a few other non-obvious configuration details:
1) You either have to tell ShellInABox to not upgrade to SSL (with the "-t" option),
or you have to configure "proxy_pass" to point to the HTTPS URL. Otherwise,
you'll
end up with an infinite redirection loop. The former is preferable, as you
otherwise
needlessly waste cycles with encrypting, decrypting, and re-encrypting each bit
of data.
2) You either need to tell Nginx to rewrite addresses to point to the root "/" entry
when forwarding the request; or you can add a new service entry with the "-s"
option,
but then you have to make sure that users always type the URL so that it has a
trailing "/".
Of course, the alternative is that you don't use Nginx at all, and that you
just host
ShellInABox on a dedicated port. But that has the drawback that some users can
only
reach servers on port 80, because their outgoing traffic gets filtered.
If this code change did not fix the problem that you were seeing, please file
another
bug report with detailed instructions on how to reproduce it.
Original comment by [email protected]
on 21 Jun 2009 at 7:09
- Changed state: Fixed
from shellinabox.
Thanks, the code worked - mostly. I neglected to remember and mention that from
nginx
doing HTTPS, I proxy to apache which handles digest authentication (nginx can
only do
basic auth) and that then proxies to shellinabox.
Using your code from SVN, nginx -> Apache2 -> SIAB doesn't work. However,
nginx ->
SIAB does work. Currently I've turned on basic authentication in nginx, but is
there
anything I'm missing in my apache2 config that you can think of, that could care
about this connection closing?
Original comment by [email protected]
on 22 Jun 2009 at 3:38
from shellinabox.
For debugging purposes, can you temporarily disable all encryption. Then use
wireshark to log the network traffic. Take a look at the traffic between NGinx
and
Apache, and the traffic between Apache and ShellInABox. Do you see any
unexpected
differences?
Original comment by [email protected]
on 22 Jun 2009 at 4:00
- Changed state: Started
from shellinabox.
I cannot reproduce this problem. I can successfully proxy through
nginx->Apache2->ShellInABox.
Nginx is configured like this:
server {
listen 443;
server_name localhost;
ssl on;
ssl_certificate cert.pem;
ssl_certificate_key cert.key;
ssl_session_timeout 5m;
keepalive_timeout 70;
ssl_protocols SSLv2 SSLv3 TLSv1;
ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
ssl_prefer_server_ciphers on;
location / {
proxy_pass http://127.0.0.1;
}
}
Apache 2 is configured like this:
<VirtualHost *:80>
ProxyRequests Off
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
ProxyPass /shell/ http://localhost:4200/
RedirectMatch permanent /shell$ /shell/
</VirtualHost>
And ShellInABox is configured like this:
SHELLINABOX_DAEMON_START=1
SHELLINABOX_PORT=4200
SHELLINABOX_ARGS=--no-beep
SHELLINABOX_ARGS="${SHELLINABOX_ARGS} -t --localhost-only"
Original comment by [email protected]
on 5 Jul 2009 at 7:50
from shellinabox.
Original comment by [email protected]
on 8 Jul 2009 at 5:39
- Changed state: Done
from shellinabox.
Revision 152 in the SVN repository changed the way that we redirect URLs. This
should
make it easier to configure proxies.
Original comment by [email protected]
on 27 Jul 2009 at 6:32
from shellinabox.
Related Issues (20)
- Not working with windows RT HOT 2
- Stunnel with shellinabox
- New (unofficial) Release:
- ear
- There doesn't seem to be a way to disable SSL 3.0 protocol HOT 3
- Unable to get audible beep
- gethostbyname_r some errors on AIX 6.1
- cant access shellinabox with ie HOT 1
- ERR_SSL_VERSION_OR_CIPHER_MISMATCH HOT 1
- Browser loops on connectivity problems
- How to run few commands before startup? HOT 1
- Delay after typing in shellinabox HOT 2
- How to pass credentials to SSH command
- "-" key does not work in firefox HOT 3
- Decouple vt100.js from main project
- shellinaboxd: unrecognized service HOT 3
- Copy paste not working as expected HOT 1
- how to open and interact with shellinabox in a custom html page
- Prompt behind horizontal scroll bar
- migration to github or bitbucket ? HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from shellinabox.