osTicket with a frontend load balancer

diggy

I am having a problem getting osTicket v1.17.2 to work with an Apache 2.4 frontend load balancer (aka reverse proxy). I have osTicket working as it should on a backend server running Apache 2.4. I access it at http://support1.example.com:81/ and everything works.

Through the load balancer (https://support.example.com), the symptoms are that I cannot log into osTicket; neither the main page nor the SCP page. The pages look correct (css, images, etc), but nothing actually works.

The apache VirtualHost configuration on the backend server is:
<VirtualHost *:81> DocumentRoot "/data/www/wcro/com/example/support/main" ServerName support1.example.com:81 UseCanonicalName Off UseCanonicalPhysicalPort Off </VirtualHost>

The apache VirtualHost configuration on the load balancer is:
<VirtualHost *:443> ServerName support.example.com:443 UseCanonicalName On UseCanonicalPhysicalPort On <Proxy balancer://support> BalancerMember http://192.168.22.102:81 ProxySet lbmethod=byrequests </Proxy> ProxyPass "/" "balancer://support/" ProxyPassReverse "/" "balancer://support/" </VirtualHost>

I use the above configuration with phpBB and Coppermine Photo Gallery and it works fine. It is a good baseline configuration. Was hoping it would work with osTicket as well.

I noticed a couple load balancer settings in osTicket's config file (ost-config.php) and adjusted them, but it didn't resolve the problem. Those settings are:
define('TRUSTED_PROXIES', '*'); define('LOCAL_NETWORKS', '127.0.0.0/24,192.168.0.0/16');

Any help is greatly appreciated.

KevinTheJedi

diggy

Is your load balancer sending the user's real IP to the webserver?

Cheers.

diggy

According to the apache logs on the backend, all requests are coming from the load balancer.

diggy

I am seeing something unexpected in the backend apache logs. It may or may not be related to the problem at hand.

I am seeing an HTTP 422 error when scp/login.php is requested. This error is NOT isolated to requests through the load balancer. When I access the backend server directly, the 422 error also shows up in the logs, but osTicket does work fine.
"GET /scp/login.php HTTP/1.1" 422 6480 "-"

Again, the aforementioned apache config for both the frontend and backend servers of my phpBB installation works. The apache logs for the phpBB backend do NOT have any 422 errors, so I am inclined to think that the 422 errors are somehow related specifically to osTicket. Hmph.

KevinTheJedi

diggy

422 is expected. That’s normal login stuff and can be ignored.

Cheers.

diggy

I have been trying to determine if the problem is related to cookies/sessions. No luck. Still not working through the load balancer. Thoughts, anyone?

ntozier

So I haven't used osTicket this way, but we had an issue a while back when we added a second internet line and turned on load balancing. In a I don't really completely understand layman explanation, when data was sent out it would go out internet line 1. When it came back in it would come in on interface 2 (internet line 2). The fix in our case was to turn on Source and Destination IP bonding. So if there a chances that there is something like this happening (but in reverse)?

diggy

Is there a way I can change the cookie domain?

TonyO

There appears to be a setting in PHP.ini to allow different domains in the same site to share the session. See the php doc for secure sessions here.. I haven't tested this.
You can change the domain in .htaccess with something like php_value session.cookie_domain ".domain.com" but I would recommend the php method first.

diggy

Adding it to .htaccess causes the site to not work.
I tried setting "session.cookie_domain" in php.ini, but it didn't make a difference.

How can I override osTicket's auto-determination for the cookie domain? This is probably best answered by an osTicket developer since I am a Linux admin and not a php developer. :/

hannibalza

The long yards in troubleshooting this should start will rendering phpinfo() on the destination server, both via load balancer and direct.
Then compare the differing elements e.g. original vs rewritten headers forwarded. cookie and session state(which i probably where the issue lies)
You may find that the answer lies entirely in the load balancer since in this case it is important that the distance between the user and destination server (in terms of requests, session/cookie context and handling thereof) be as small as possible.

diggy

I am the original poster of this thread. I have upgraded to osTicket 1.18.2 and am again trying get osTicket to work behind a load balancer, but cannot. Please help. The information in my original post still applies.

KevinTheJedi

diggy

From the software end you just need to update these:

https://github.com/osTicket/osTicket/blob/develop/include/ost-sampleconfig.php#L117-L146

Other than that you need to ensure your load balancer is forwarding the real ip of the user, ensure you update the cookie domain (as described above), etc. There are many guides online that explain how to correctly configure a website behind a load balancer.

Although, it may not be a load balancer issue at all as we haven’t seen any clear errors. When you attempt to login what exactly happens? Have you checked all possible logs (general server logs, webserver error logs, PHP error logs, MySQL/MariaDB error logs, osTicket System Logs, Browser Console logs, etc.) for any related errors? Have you tried adding debug statements to the code to see at what point it’s failing?

Cheers.