unable to load login page over public ip on internet

anuN · 12-03-2015, 10:15 PM

Hi..I have a page to load as https://218.251.240.118:8080/login ... but I am getting ssl connection error. Below are the configuration file details :

apache httpd.conf file (since the file was big I am posting only uncommented lines)

`
`ServerRoot "/usr/local/apache22-publisher"
Listen 80
User apache
Group apache
</IfModule>
</IfModule>
ServerAdmin you@example.com
ServerName pro-pcrawler101d:80
DocumentRoot "/usr/local/apache22-publisher/htdocs"

<Directory />
Options FollowSymLinks
AllowOverride None
Order deny,allow
Deny from all
</Directory>

<Directory "/data/publisher_files">
Options Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all

</Directory>

<IfModule dir_module>
DirectoryIndex index.html
</IfModule>

Alias /icons/ "/data/icons/"

<Directory "/data/icons">
Options Indexes MultiViews
AllowOverride None
Order allow,deny
Allow from all
</Directory>

ScriptAlias /cgi-bin/ "/data/cgi-bin/"
<Directory "/data/cgi-bin">
AllowOverride None
Options None
Order allow,deny
Allow from all
</Directory>

Alias /error/ "/data/error/"

<IfModule mod_negotiation.c>
<IfModule mod_include.c>
<Directory "/data/error">
AllowOverride None
Options IncludesNoExec
AddOutputFilter Includes html
AddHandler type-map var
Order allow,deny
Allow from all
LanguagePriority en es de fr
ForceLanguagePriority Prefer Fallback
</Directory>

<Directory "/var/www/html">
Options Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all

</Directory>

DirectoryIndex index.html index.html.var

ServerSignature Off
<FilesMatch "^\.ht">
Order allow,deny
Deny from all
Satisfy All
</FilesMatch>
Alias /publisher /data/publisher_files
Alias /rcr /data/publisher_files
Include conf/extra/httpd-ssl.conf

<IfModule ssl_module>
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
</IfModule>
========================================================================

httpd-ssl.conf file (since the file was big I am posting only uncommented lines):

Listen 443
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl
SSLPassPhraseDialog builtin
SSLSessionCache "shmcb:/usr/local/apache22-publisher/logs/ssl_scache(512000)"
SSLSessionCacheTimeout 300
SSLMutex "file:/usr/local/apache22-publisher/logs/ssl_mutex"
<VirtualHost _default_:443>
DocumentRoot "/data/publisher_files"

ServerName pro-pcrawler101zd:443
ServerAdmin you@example.com
ErrorLog "/usr/local/apache22-publisher/logs/error_log"
TransferLog "/usr/local/apache22-publisher/logs/access_log"

SSLEngine on
SSLProtocol all -SSLv2
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
SSLCertificateFile "/usr/local/apache22-publisher/conf/server.crt"
SSLCertificateKeyFile "/usr/local/apache22-publisher/conf/server.key"
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory "/usr/local/apache22-publisher/cgi-bin">
SSLOptions +StdEnvVars
</Directory>

BrowserMatch "MSIE [2-5]" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
CustomLog "/usr/local/apache22-publisher/logs/ssl_request_log" \
"t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x "%r" %b"

ProxyPass /rcr ajp://127.0.0.1:8009/rcr
ProxyPassReverse /rcr ajp://127.0.0.1:8009/rcr

</VirtualHost>

Tried restarting tomcat and httpd service, no changes.tomcat and httpd are running and listening on respective ports.Any help would be greatly appreciated.Thanks.

chrism01 · 12-03-2015, 11:03 PM

Exactly what msgs are you getting?
Is this supposed to be a public facing system? If I ping the IP I get no response.
Which distro+version is this?
Which version of Apache?
Have you checked your firewall (eg iptables -nvL ) ?

anuN · 12-03-2015, 11:39 PM

Hi chrism01...
this is a public facing system whose public ip is what was mentioned and we are connecting to it through internal private ip.
The error I am getting is SSL connection error ERR_SSL_PROTOCOL_ERROR while connecting through chrome.

Even if I do a wget o internal ip on the server like https://10.40.5.32/login I get

[ ~]$ wget https://10.40.5.32:8080/login
--2015-12-04 14:34:33-- https://10.40.5.32:8080/login
Connecting to 10.40.5.32:8080... connected.
Unable to establish SSL connection.

[ ~]$ curl https://10.40.5.32:8080/login
curl: (35) error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol

[ ~]# iptables -nvL
Chain INPUT (policy ACCEPT 55 packets, 3390 bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 47 packets, 4264 bytes)
pkts bytes target prot opt in out source destination

This is centos5.6,apache version 2.2,tomcat version 6

We are using fusion cloud servers.

jheengut · 12-03-2015, 11:53 PM

can you do a nmap and netstat -ntpl of the IP address

anuN · 12-03-2015, 11:59 PM

Hi jheengut,

which port do you want to confirm is open? I can tell you.Really cant give you nmap details.

Hi jheengut,

which port do you want to confirm is open? I can tell you.Really cant give you nmap details.

Only information I can give you is this.This is the output of nmap from the server which I accessed through its internal ip and I am checking nmap on its public ip:

[ ~]# nmap -P0 218.251.240.118

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2015-12-04 14:57 JST
All 1680 scanned ports on ip-218-251-240-118.fvm.i1.fusioncom.jp (218.251.240.118) are filtered

Nmap finished: 1 IP address (1 host up) scanned in 337.177 seconds

chrism01 · 12-04-2015, 12:23 AM

What about my last qn

Have you checked your firewall (eg iptables -nvL ) ?

anuN · 12-04-2015, 12:29 AM

Hi Chrism01,

[ ~]# iptables -nvL
Chain INPUT (policy ACCEPT 55 packets, 3390 bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 47 packets, 4264 bytes)
pkts bytes target prot opt in out source destination

Habitual · 12-04-2015, 05:14 AM

Code:

nmap 218.251.240.118 -p 80,8080,443

Starting Nmap 6.40 ( http://nmap.org ) at 2015-12-04 06:13 EST
Nmap scan report for ip-218-251-240-118.fvm.i1.fusioncom.jp (218.251.240.118)
Host is up.
PORT     STATE    SERVICE    VERSION
80/tcp   filtered http
443/tcp  filtered https
8080/tcp filtered http-proxy

is what I get from here.

anuN · 12-06-2015, 08:18 PM

Hi Habitual,

There are no iptables rules as I have posted earlier.How do I fix it from here?

anuN · 12-06-2015, 08:23 PM

and if the ports are bocked why is it throwing a SSL connection error?

[##]# openssl verify /etc/pki/tls/cert.pem
/etc/pki/tls/cert.pem: /C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority
error 10 at 0 depth lookup:certificate has expired
OK

Could this be the issue?

berndbausch · 12-07-2015, 02:07 AM

I'd say the expired certificate is the problem.

If you connect with a browser (I see you used curl and wget), the browser will probably offer you the option to connect anyway.

Ramurd · 12-07-2015, 08:17 AM

In the apache configuration I see nothing that would listen to port 8080; which service is listening to port 8080 and where does it (re)direct to? Is it even an SSL thing? Trying to do https over http will throw an ssl error as well.