Nagios XI HTTPS Issue

[rkennedy]

I see you also removed Require all granted which I was going to bring up.

After you make the change, have you restarted apache and nagios? What is the result? Is it still the same error in your log file?

[tigerpeng]

• I did change the program URL to 'https://......" and protocol to 'HTTPS' as mentioned in the document. But now I cannot confirm the changes as HTTP also return 403.
• "Require all granted" is in the original nagiosxi.conf, but not in the document.
• There redirection of http has some issue: http://nagiosxi.connectedcarhub.com/nagiosxi/ rediected to https://nagiosxi.connectedcarhub.comnagiosxi/ (missing the forward slash between com and nagiosxi)

[rkennedy]

Can you post your error log, and ssl error log?

Code: Select all

tail -n50 /var/log/httpd/error_log
tail -n50 /var/log/httpd/ssl_error_log

[tigerpeng]

As both HTTP/HTTPS access is denied, is there way to reset the URL and Protocol back to HTTP?

last 50 lines of /var/log/httpd/error_log are similar (only differ by time stamp and pid):

Code: Select all

[Tue Jan 26 17:17:24.075181 2016] [authz_core:error] [pid 24583] [client ::1:41285] AH01630: client denied by server configuration: /usr/local/nagiosxi/html/backend/

last 50 lines of /var/log/httpd/ssl_error_log are similar (only differ by time stamp and pid):

Code: Select all

[Mon Jan 25 23:21:56.761138 2016] [ssl:warn] [pid 24579] AH01909: RSA certificate configured for ec2-54-83-39-127.compute-1.amazonaws.com:443 does NOT include an ID which matches the server name

[rkennedy]

Looks like I may have been wrong about Require all granted based on your version of Apache. Can you try removing -

Code: Select all

Order allow,deny
Allow from all

and replace it with -

Code: Select all

Require all granted

Then, restart your apache / nagios service and let us know the result.

[tigerpeng]

Same issue after making the changes you suggested.

Code: Select all

cat /etc/httpd/conf.d/nagiosxi.conf
#NameVirtualHost *:443
<VirtualHost *:80> # Add this line
ServerName connectedcarhub.com
Redirect permanent / https://nagiosxi.connectedcarhub.com/
<Directory "/usr/local/nagiosxi/html">
#  SSLRequireSSL
   Options None
   AllowOverride None
#   Order allow,deny
#   Allow from all
#  Order deny,allow
#  Deny from all
#  Allow from 127.0.0.1
#   AuthName "Nagios XI"
#   AuthType Basic
#   AuthUserFile /usr/local/nagiosxi/etc/htpasswd.users
#   Require valid-user
   Require all granted
</Directory> # Add this line
</VirtualHost>
<VirtualHost *:443>
ServerName connectedcarhub.com
        SSLEngine on
        SSLCertificateFile /etc/pki/tls/certs/connectedcarhub.com.crt
        SSLCertificateKeyFile /etc/pki/tls/private/connectedcarhub.com.key
        <Directory "/usr/local/nagiosxi/html">
        AllowOverride All
        </Directory>
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule nagiosxi/api/v1/(.*)$ /usr/local/nagiosxi/html/api/v1/index.php?request=$1 [QSA,NC,L]
</IfModule>
</VirtualHost>
Alias /nagiosxi "/usr/local/nagiosxi/html"

Here is the httpd version info:

Code: Select all

yum info httpd
Loaded plugins: amazon-id, rhui-lb, search-disabled-repos
Installed Packages
Name        : httpd
Arch        : x86_64
Version     : 2.4.6
Release     : 40.el7
Size        : 3.7 M
Repo        : installed
From repo   : rhui-REGION-rhel-server-releases
Summary     : Apache HTTP Server
URL         : http://httpd.apache.org/
License     : ASL 2.0
Description : The Apache HTTP Server is a powerful, efficient, and extensible
            : web server.

[tigerpeng]

Is there any way to reset the URL and Protocol back to HTTP without Web UI?

[hsmith]

Can you attempt to take the redirect line out, and then restart the httpd service? It may take some digging to fix the URL, I've never seen it break anything that badly.

[tigerpeng]

no better result after removing the redirect line from /etc/httpd/conf.d/nagiosxi.conf and grep https /usr/local/nagiosxi/html/config.inc.php

Code: Select all

#Redirect permanent / https://nagiosxi.connectedcarhub.com/

Code: Select all

grep use_https /usr/local/nagiosxi/html/config.inc.php
$cfg['use_https'] = false; // determines whether cron jobs and other scripts will force the use of HTTPS instead of HTTP

[hsmith]

Did you change the use https back in config.inc.php? Have you tried it both ways?