v1.11.0: Masked redirects being rejected

LesD

Just installed v1.11.0-rc1 and immediately hit a problem.

We have osTicket running on our own server (a Linux VM running in a Widows Server) and it is externally available via a domain.

The domain is redirected to our servers own domain.

The redirection is done Masked (so that the user sees the original domain name and not the target one).

Till now this has worked fine but after the update it now fails with a message '... refused to connect'.

Raising a ticket with the registrars of both domains I got back a reply:

"Per our check, the domain name .... and its subdomain support..... are configured properly. However, the Masked redirect still doesn't work.

Apparently, it appears that the hosting server where the destination website is hosted doesn't allow Masked redirects, so that's why it doesn't work."

For the moment we have changed the redirection so it is no longer Masked and that works.

ntozier

I would recommend that you not run 1.11-rc1 in a production environment and wait until it is released as a stable version. There have been a LOT of bug fixes on it [that have not been released yet] and so you are bound to encounter many more problems.

If you insist on running 1.11 before its release then the devs have recommended that you pull the latest patches from github from the develop-next branch. 1.11-rc1 is buggy and not fit for a production site.

LesD

I have now installed 1.11 final and still get ' .....refused to connect.' when using masked forwarding.

So the problem still exists.

LesD

I have done some extensive testing with the current 1.11 and it seems to me to be a definite osTicket issue.

I created a masked redirect of 'dasite.xxxxxxxx.co.uk' to a web site in a folder 'dasite' in my server's document root and that works file.

I then copied the osTicket 'support' folder into the document root and renamed it to 'dasite' and it comes back with the reject message: yyyyyyyyyyy.org refused to connect.

where 'yyyyyyyyyyy.org' is the target of the masked redirect.

The servers httpd access log shows just a single line:

xx.30.6.195 - - [03/Mar/2019:18:45:00 +0000] "GET /dasite/ HTTP/1.1" 200 6183 "http://dasite.xxxxxxxx.co.uk/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36"

ntozier

Please help us to help you by reading and following the posting guidelines located in this thread: Please read before requesting assistance. The more information you give us the better we will be able to assist you. Thank you.

Environment details?
Error logs?

LesD

osTicket Version v1.11 (d4e240b) — Up to date
Web Server Software Apache/2.4.6 (CentOS) PHP/5.4.16
MySQL Version 5.6.16
PHP Version 5.4.16

CentOS Linux release 7.6.1810 (Core)

The access_log has only one line as previously report.

The error_log contains nothing new.

LesD

For comparative info:

Switching back to the test site, it generates three lines in the access_log

xxx.30.6.195 - - [04/Mar/2019:09:59:25 +0000] "GET /dasite/ HTTP/1.1" 200 33276 "http://dasite.xxxxxxxx.co.uk
/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36"
xxx.30.6.195 - - [04/Mar/2019:09:59:25 +0000] "GET /dasite/css/style.css HTTP/1.1" 304 - "http://root.xxxxxxxx.org/dasite/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36"
xxx.30.6.195 - - [04/Mar/2019:09:59:25 +0000] "GET /dasite/images/pound24.jpg HTTP/1.1" 304 - "http://root.xxxxxxxx.org/dasite/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36"

And then again back to osTicket:

xxx.30.6.195 - - [04/Mar/2019:10:07:08 +0000] "GET /dasite/ HTTP/1.1" 200 6183 "http://dasite.xxxxxxxx.co.uk
/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36"

ntozier

CentOS are you running SELinux?

Otherwise I'm not sure. I'll ask the devs to take a look at this thread.

KevinTheJedi

@LesD

Um, did you fix the file permissions/ownership first?

$ find /path/to/osticket/ -type d -exec chmod 0775 {} \;
$ find /path/to/osticket/ -type f -exec chmod 0644 {} \;
$ chown www-data:www-data -R /path/to/osticket/

Cheers.

LesD

Rather than try and 'fix' I have decided to start a fresh CentOS install as the VM in which osTicket is running is quite old.

I created a brand new CentOS 7 VM and installed

php 7.2.15
httpd 2.4.6
mysql 8.0.15

I downloaded the 1.11 install and copied over the two folders (upload, scripts) to: /var/www/html/support

then pointed a browser to http://10.27.27.63/support/upload/setup/ (10.27.27.63 is the new VM) and all was good till I got to the point where it told me to rename the sample config to ost-config.php

Rather than do that I copied over my existing version of that file from my live VM - I am using an external MySQL server rather than the one in the VM.

The install objected to seeing a 'changed' file so I removed it and did as told - renamed the sample.

(Trying to load the admin panel, as advised, failed)

I'm now stuck with the error message: Configuration file is not writable

I have done everything I can think of including changing permission to the file to 0777 and changing owner of all files from root to apache (as is on my live VM) but still get that error.

ntozier

If you got to the point of renaming the file... (and instead copied over the old file) did you use the exact same DB, DB Username, and DB Password?

LesD

You asked: If you got to the point of renaming the file... (and instead copied over the old file) did you use the exact same DB, DB Username, and DB Password?

The file I copied did have all the correct db details.

What I have now is the renamed sample without any of my db details.

Let us try again:

I have cleared the support folder and copied over again the two downloaded forlders.

As instructed I have renamed the sample config to ost-config.php

(The instructions are to rename but the cli example is a 'copy' and I have done that).

It now says 'Configuration file is not writable' with suggestion to change permissions to 0666.

Indeed the existing permissions show as 0644 so I have changed permission (using WinSCP rather than cli commands) to 0666 but still get the same error when I click Continue.

The owner of all files is root. Is that OK?

ntozier

Since you are running CentOS does that mean you are running SELinux?

What user does your webserver run as?
The files should be owned by that user the at the website is running as.

if the webserver runs as www-data and you want your user as group you could chown it to www-data.(yourusername) and then set it to 660. Which is read/write owner (www-data), read/write group (your user group), and everyone else nothing.

LesD

Not SELinux. Just the standard CentOS7 Minimal iso.

I think the penny has dropped.

Maybe the Minimal install was a mistake.

ntozier

I ask because last I checked on CentOS7 SELinux is enabled by default... and I am wondering if that is causing some of the issues that you have. [I should probably set up a CentOS server at some point to get more familiar with it.]

LesD

Checking the docs it does seem that SELinux IS on by default.

I have already deleted the VM I built - I have been messing about with it to try and debug the problem.

I'm getting quite good at rebuilding ?

Thanks for the clue.

ntozier

Glad to help. Honestly it's come up again and again so whenever someone tells me that have a odd problem on CentOS, I usually ask if they are running SELinux. ?

LesD

Just rebuilding the VM and TODAY 7.2.16 was released and installed. I hope that will be OK.