Background
I have developed a python flask app that uses the ArcGIS API for JavaScript to display geospatial data and query feature services from an ArcGIS Online account. Results from these queries are saved to a MongoDB Atlas cluster.
The flask app is deployed to an Apache server running Centos8 using mod_wsgi. It is currently working on a Heroku/gunicorn deployment.
Below is the code for the app.py code for the Flask app:
from flask import Flask, render_template, request
from data.database import global_init
from data.database import Query
from data.update import update
from whitenoise import WhiteNoise
app = Flask(__name__)
app.wsgi_app = WhiteNoise(app.wsgi_app)
my_static_folders = (
'./static/css/',
'./static/images/',
'./static/js/',
'./static/layers/'
)
for static in my_static_folders:
app.wsgi_app.add_files(static)
#app.route("/query", methods=["GET", "POST"])
def query():
if request.method == 'POST':
feature = request.json
feature_name = feature['name']
feature_region = feature['region']
feature_query = Query.objects(name=feature_name, region=feature_region)
if feature_query:
response = feature_query[0].export()
else:
response = ''
return response
#app.route("/")
def home():
return render_template("index.html")
if __name__ == "__main__":
global_init()
files = ['./static/css/styles.css', './static/js/app.js']
app.run(debug=True,
extra_files=files)
Below is the wsgi.py file:
#!/usr/bin/env python
import sys
import site
site.addsitedir('/var/www/dm.nhmarchive.org/lau-map/venv/lib/python3.6/site-packages')
sys.path.insert(0, '/var/www/dm.nhmarchive.org/lau-map')
from app import app as application
Problem
The issue arise when the app tries connecting to the MongoDB Atlas cluster to query/retrieve data. When a polygon is clicked on the map, the connection to the cluster is refused and the following error is logged in the error.log:
[Thu Oct 21 20:19:46.800129 2021] [wsgi:error] [pid 1430689:tid 139930235827968] [client 99.8.162.56:55543] , referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471649 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] [2021-10-21 20:20:14,470] ERROR in app: Exception on /query [POST], referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471711 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] Traceback (most recent call last):, referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471715 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] File "/var/www/dm.nhmarchive.org/lau-map/venv/lib/python3.6/site-packages/flask/app.py", line 2447, in wsgi_app, referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471718 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] response = self.full_dispatch_request(), referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471721 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] File "/var/www/dm.nhmarchive.org/lau-map/venv/lib/python3.6/site-packages/flask/app.py", line 1952, in full_dispatch_request, referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471724 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] rv = self.handle_user_exception(e), referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471727 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] File "/var/www/dm.nhmarchive.org/lau-map/venv/lib/python3.6/site-packages/flask/app.py", line 1821, in handle_user_exception, referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471729 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] reraise(exc_type, exc_value, tb), referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471732 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] File "/var/www/dm.nhmarchive.org/lau-map/venv/lib/python3.6/site-packages/flask/_compat.py", line 39, in reraise, referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471751 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] raise value, referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471757 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] File "/var/www/dm.nhmarchive.org/lau-map/venv/lib/python3.6/site-packages/flask/app.py", line 1950, in full_dispatch_request, referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471760 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] rv = self.dispatch_request(), referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471762 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] File "/var/www/dm.nhmarchive.org/lau-map/venv/lib/python3.6/site-packages/flask/app.py", line 1936, in dispatch_request, referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471765 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] return self.view_functions[rule.endpoint](**req.view_args), referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471768 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] File "/var/www/dm.nhmarchive.org/lau-map/app.py", line 51, in query, referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471770 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] feature_query = Query.objects(name=feature_name, region=feature_region), referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471773 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] File "/var/www/dm.nhmarchive.org/lau-map/venv/lib/python3.6/site-packages/mongoengine/queryset/manager.py", line 37, in __get__, referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471776 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] queryset = queryset_class(owner, owner._get_collection()), referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471778 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] File "/var/www/dm.nhmarchive.org/lau-map/venv/lib/python3.6/site-packages/mongoengine/document.py", line 214, in _get_collection, referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471786 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] if cls._meta.get("auto_create_index", True) and db.client.is_primary:, referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471788 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] File "/var/www/dm.nhmarchive.org/lau-map/venv/lib/python3.6/site-packages/pymongo/mongo_client.py", line 1031, in is_primary, referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471791 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] return self._server_property('is_writable'), referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471793 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] File "/var/www/dm.nhmarchive.org/lau-map/venv/lib/python3.6/site-packages/pymongo/mongo_client.py", line 856, in _server_property, referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471796 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] writable_server_selector), referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471798 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] File "/var/www/dm.nhmarchive.org/lau-map/venv/lib/python3.6/site-packages/pymongo/topology.py", line 243, in select_server, referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471800 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] address)), referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471803 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] File "/var/www/dm.nhmarchive.org/lau-map/venv/lib/python3.6/site-packages/pymongo/topology.py", line 200, in select_servers, referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471805 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] selector, server_timeout, address), referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471808 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] File "/var/www/dm.nhmarchive.org/lau-map/venv/lib/python3.6/site-packages/pymongo/topology.py", line 217, in _select_servers_loop, referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471810 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] (self._error_message(selector), timeout, self.description)), referer: http://dm.nhmarchive.org/
[Thu Oct 21 20:20:14.471814 2021] [wsgi:error] [pid 1430925:tid 139930051188480] [client 99.8.162.56:55665] pymongo.errors.ServerSelectionTimeoutError: localhost:27017: [Errno 111] Connection refused, Timeout: 30s, Topology Description: <TopologyDescription id: 6171cb5aa3baaebd849f82b2, topology_type: Single, servers: [<ServerDescription ('localhost', 27017) server_type: Unknown, rtt: None, error=AutoReconnect('localhost:27017: [Errno 111] Connection refused',)>]>, referer: http://dm.nhmarchive.org/
The connection to the MongoDB Atlas cluser seems to be refused when app.py tries to perform a query. Below is the code used to establish a conncetion with the database instance in database.py:
import mongoengine
...
from mongoengine import connect
from dotenv import load_dotenv
# Connects to remote Atlas database
def global_init():
load_dotenv()
DB_URI = os.getenv('DB_URI')
connect(alias='laumap', host=DB_URI)
Troubleshooting
Adding the server's IP address to Atlas's 'IP Access List'
While I had 0.0.0.0/0 listed as IP Address (which should theoretically allow all addresses to my understanding), I added the IP address of the server to the list. This still did not work.
Adding pymongo kwargs to MongoEngine connect()
A similar problem was posted on a flask app with Atlas depolyed on python anywhere. They suggested adding the following kwargs when connecting to a database:
connect(alias='laumap', host=DB_URI, connect=False, maxPoolSize=1)
This also did not seem to work.
Adding HTTP Method Overrides
This was done as per the official Flask documentation:
class HTTPMethodOverrideMiddleware(object):
allowed_methods = frozenset([
'GET',
'HEAD',
'POST',
'DELETE',
'PUT',
'PATCH',
'OPTIONS'
])
bodyless_methods = frozenset(['GET', 'HEAD', 'OPTIONS', 'DELETE'])
def __init__(self, app):
self.app = app
def __call__(self, environ, start_response):
method = environ.get('HTTP_X_HTTP_METHOD_OVERRIDE', '').upper()
if method in self.allowed_methods:
environ['REQUEST_METHOD'] = method
if method in self.bodyless_methods:
environ['CONTENT_LENGTH'] = '0'
return self.app(environ, start_response)
app = Flask(__name__)
app.wsgi_app = HTTPMethodOverrideMiddleware(app.wsgi_app)
I don't have any experience setting HTTP headers in a Flask, so I'm unsure if the above is configured correctly. But as it is currently, it did not change the logged errors.
Testing the .env DB_URI variable in a python interactive session
Just as a sanity check, I made sure that the DB_URI was correctly formed in my .env file. Below is the code used in the python interactive shell on the server:
>>> import mongoengine
>>> from dotenv import load_dotenv
>>> load_dotenv()
True
>>> import os
>>> DB_URI = os.getenv('DB_URI')
>>> mongoengine.connect(alias='laumap', host=DB_URI)
MongoClient(host=['lau-shard-00-00.sybdh.mongodb.net:27017', 'lau-shard-00-
01.sybdh.mongodb.net:27017', 'lau-shard-00-02.sybdh.mongodb.net:27017'],
document_class=dict, tz_aware=False, connect=True, retrywrites=True, w='majority',
authsource='admin', replicaset='atlas-xvjuv5-shard-0', ssl=True,
read_preference=Primary())
Checking SE Linux Boolean values
As per this stack overflow post, I tried setting the following values to true:
httpd_can_network_connect --> off
httpd_can_network_connect_db --> off
Question
Why is my flask app not able to properly connect to my MongoDB Atlas cluster when it is able to locally, on my Heroku deployment and when I run flask run on the Apache/CentOS 8 server?
Is there some security settings in CentOS 8 that need to properly configured or is there something in the Flask app or wsgi script that may need to be changed?
From the error message (last line) you can see it is not attempting to connect to atlas, it's attempting to connect to localhost (the default if you don't specify a host). So the error will be with the connection string.
Looking at the code, are you 100% sure the DB_URI environment variable is set correctly? Maybe add some logging to confirm.
In the following code sample, I start a proxy server using HTTP::Proxy and attempt to use it to request an HTTPS URL, but the proxy server either doesn't actually make the request, or doesn't return the response. However, if I make the URL use HTTP (not secure), the request succeeds. I've installed both IO::Socket::SSL and LWP::UserAgent::https (yay secret deps!), but am still unable to get HTTPS requests to go through the proxy. How can I get HTTP::Proxy to work with HTTPS URLs?
Here's my code:
#!/usr/bin/env perl
use strict;
use warnings;
use Data::Printer;
use HTTP::Proxy ':log';
use Mojo::UserAgent ();
my $URL = 'https://www.yahoo.com';
my $PROXY_PORT = 8667;
my $pid = fork();
if ($pid) { # I am the parent
print "Press ^c to kill proxy server...\n";
my $proxy = HTTP::Proxy->new( port => $PROXY_PORT );
$proxy->logmask(ALL);
$proxy->via(q{});
$proxy->x_forwarded_for(0);
$proxy->start;
waitpid $pid, 0;
}
elsif ($pid == 0) { # I am the child
sleep 3; # Allow the proxy server to start
my $ua = Mojo::UserAgent->new;
$ua->proxy
->http("http://127.0.0.1:$PROXY_PORT")
->https("http://127.0.0.1:$PROXY_PORT");
my $tx = $ua->get($URL);
if ($tx->error) {
p $tx->error;
}
else {
print "Success!\n";
}
}
else {
die 'Unknown result after forking';
}
Saving the above script as testcase-so.pl and running it:
$ MOJO_CLIENT_DEBUG=1 ./testcase-so.pl
Press ^c to kill proxy server...
-- Blocking request (https://www.yahoo.com)
-- Connect c66a92739c09c76fa24029e8079808c7 (https://www.yahoo.com:443)
-- Client >>> Server (https://www.yahoo.com)
CONNECT www.yahoo.com:443 HTTP/1.1\x0d
User-Agent: Mojolicious (Perl)\x0d
Content-Length: 0\x0d
Host: www.yahoo.com\x0d
Accept-Encoding: gzip\x0d
\x0d
-- Client >>> Server (https://www.yahoo.com)
[Tue Oct 9 12:02:54 2018] (12348) PROCESS: Forked child process 12352
[Tue Oct 9 12:02:54 2018] (12352) SOCKET: New connection from 127.0.0.1:45312
[Tue Oct 9 12:02:54 2018] (12352) REQUEST: CONNECT www.yahoo.com:443
[Tue Oct 9 12:02:54 2018] (12352) REQUEST: Accept-Encoding: gzip
[Tue Oct 9 12:02:54 2018] (12352) REQUEST: Host: www.yahoo.com
[Tue Oct 9 12:02:54 2018] (12352) REQUEST: User-Agent: Mojolicious (Perl)
[Tue Oct 9 12:02:54 2018] (12352) REQUEST: Content-Length: 0
[Tue Oct 9 12:02:54 2018] (12352) RESPONSE: 200 OK
[Tue Oct 9 12:02:54 2018] (12352) RESPONSE: Date: Tue, 09 Oct 2018 12:02:54 GMT
[Tue Oct 9 12:02:54 2018] (12352) RESPONSE: Transfer-Encoding: chunked
[Tue Oct 9 12:02:54 2018] (12352) RESPONSE: Server: HTTP::Proxy/0.304
-- Client <<< Server (https://www.yahoo.com)
HTTP/1.1 200 OK\x0d
Date: Tue, 09 Oct 2018 12:02:54 GMT\x0d
Transfer-Encoding: chunked\x0d
Server: HTTP::Proxy/0.304\x0d
\x0d
[Tue Oct 9 12:03:14 2018] (12352) CONNECT: Connection closed by the client
[Tue Oct 9 12:03:14 2018] (12352) PROCESS: Served 1 requests
[Tue Oct 9 12:03:14 2018] (12352) CONNECT: End of CONNECT proxyfication
\ {
message "Proxy connection failed"
}
[Tue Oct 9 12:03:15 2018] (12348) PROCESS: Reaped child process 12349
[Tue Oct 9 12:03:15 2018] (12348) PROCESS: 1 remaining kids: 12352
[Tue Oct 9 12:03:15 2018] (12348) PROCESS: Reaped child process 12352
[Tue Oct 9 12:03:15 2018] (12348) PROCESS: 0 remaining kids:
^C[Tue Oct 9 12:04:04 2018] (12348) STATUS: Processed 2 connection(s)
$
And with the $URL switched to not use https:
$ MOJO_CLIENT_DEBUG=1 ./testcase-so.pl
Press ^c to kill proxy server...
-- Blocking request (http://www.yahoo.com)
-- Connect f792ee97a0362ab493575d8116e69e59 (http://127.0.0.1:8667)
-- Client >>> Server (http://www.yahoo.com)
GET http://www.yahoo.com HTTP/1.1\x0d
Accept-Encoding: gzip\x0d
Content-Length: 0\x0d
Host: www.yahoo.com\x0d
User-Agent: Mojolicious (Perl)\x0d
\x0d
[Tue Oct 9 12:09:38 2018] (12656) PROCESS: Forked child process 12659
-- Client >>> Server (http://www.yahoo.com)
[Tue Oct 9 12:09:38 2018] (12659) SOCKET: New connection from 127.0.0.1:58288
[Tue Oct 9 12:09:38 2018] (12659) REQUEST: GET http://www.yahoo.com
[Tue Oct 9 12:09:38 2018] (12659) REQUEST: Accept-Encoding: gzip
[Tue Oct 9 12:09:38 2018] (12659) REQUEST: Host: www.yahoo.com
[Tue Oct 9 12:09:38 2018] (12659) REQUEST: User-Agent: Mojolicious (Perl)
[Tue Oct 9 12:09:38 2018] (12659) REQUEST: Content-Length: 0
[Tue Oct 9 12:09:38 2018] (12659) RESPONSE: 301 Moved Permanently
[Tue Oct 9 12:09:38 2018] (12659) RESPONSE: Cache-Control: no-store, no-cache
[Tue Oct 9 12:09:38 2018] (12659) RESPONSE: Date: Tue, 09 Oct 2018 14:10:01 GMT
[Tue Oct 9 12:09:38 2018] (12659) RESPONSE: Transfer-Encoding: chunked
[Tue Oct 9 12:09:38 2018] (12659) RESPONSE: Via: http/1.1 media-router-fp1006.prod.media.bf1.yahoo.com (ApacheTrafficServer [c s f ])
[Tue Oct 9 12:09:38 2018] (12659) RESPONSE: Location: https://www.yahoo.com/
[Tue Oct 9 12:09:38 2018] (12659) RESPONSE: Server: ATS
[Tue Oct 9 12:09:38 2018] (12659) RESPONSE: Content-Language: en
[Tue Oct 9 12:09:38 2018] (12659) RESPONSE: Content-Length: 8
[Tue Oct 9 12:09:38 2018] (12659) RESPONSE: Content-Type: text/html
[Tue Oct 9 12:09:38 2018] (12659) RESPONSE: Content-Security-Policy: sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage®ion=US&lang=en-US&device=desktop&yrid=&partner=;
[Tue Oct 9 12:09:38 2018] (12659) RESPONSE: X-Frame-Options: SAMEORIGIN
[Tue Oct 9 12:09:38 2018] (12659) RESPONSE: X-XSS-Protection: 1; report="https://csp.yahoo.com/beacon/csp?src=fp-hpkp-www"
-- Client <<< Server (http://www.yahoo.com)
HTTP/1.1 301 Moved Permanently\x0d
Cache-Control: no-store, no-cache\x0d
Date: Tue, 09 Oct 2018 14:10:01 GMT\x0d
Transfer-Encoding: chunked\x0d
Via: http/1.1 media-router-fp1006.prod.media.bf1.yahoo.com (ApacheTrafficServer [c s f ])\x0d
Location: https://www.yahoo.com/\x0d
Server: ATS\x0d
Content-Language: en\x0d
Content-Length: 8\x0d
Content-Type: text/html\x0d
Content-Security-Policy: sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage®ion=US&lang=en-US&device=desktop&yrid=&partner=;\x0d
X-Frame-Options: SAMEORIGIN\x0d
X-XSS-Protection: 1; report="https://csp.yahoo.com/beacon/csp?src=fp-hpkp-www"\x0d
\x0d
-- Client <<< Server (http://www.yahoo.com)
8\x0d
redirect\x0d
0\x0d
\x0d
Success!
[Tue Oct 9 12:09:38 2018] (12659) SOCKET: Getting request failed: Client closed
[Tue Oct 9 12:09:39 2018] (12656) PROCESS: Reaped child process 12657
[Tue Oct 9 12:09:39 2018] (12656) PROCESS: 1 remaining kids: 12659
[Tue Oct 9 12:09:39 2018] (12656) PROCESS: Reaped child process 12659
[Tue Oct 9 12:09:39 2018] (12656) PROCESS: 0 remaining kids:
^C[Tue Oct 9 12:09:45 2018] (12656) STATUS: Processed 2 connection(s)
$
There is a bug in HTTP::Proxy in that it returns the wrong response to a CONNECT request:
-- Client <<< Server (https://www.yahoo.com)
HTTP/1.1 200 OK\x0d
Date: Tue, 09 Oct 2018 12:02:54 GMT\x0d
Transfer-Encoding: chunked\x0d
Server: HTTP::Proxy/0.304\x0d
\x0d
The response to a CONNECT request can have no body which means that it should not have a HTTP header announcing a body like Transfer-Encoding: chunked does. This bug happens with all clients which do a CONNECT request using HTTP/1.1. If the CONNECT is instead done with HTTP/1.0 the problem vanishes since Transfer-Encoding: chunked is not defined with HTTP/1.0 yet and thus HTTP::Proxy does not send it.
The same problem happens when trying to use curl with HTTP::Proxy, thus this is not a problem solely of Mojo::UserAgent. I`ve made a patch to HTTP::Proxy to respond properly. See this pull request for the details and for the (small) diff you need to apply.
Wildfly not working with mod cluster below is the error_log
[Wed Jan 25 16:53:55.860419 2017] [core:error] [pid 4980:tid 1088] [client 192.168.1.10:64522] AH00135: Invalid method in request bela\x19\x84\x04
[Wed Jan 25 16:54:11.387227 2017] [core:error] [pid 4980:tid 1088] [client 192.168.1.10:64523] AH00135: Invalid method in request bela\x19\x84\x04
[Wed Jan 25 16:54:24.664313 2017] [core:error] [pid 4980:tid 1088] [client 192.168.1.10:64524] AH00135: Invalid method in request bela\x19\x84\x04
[Wed Jan 25 16:54:43.907621 2017] [core:error] [pid 4980:tid 1088] [client 192.168.1.10:64525] AH00135: Invalid method in request bela\x19\x84\x04
[Wed Jan 25 16:54:59.417380 2017] [core:error] [pid 4980:tid 1088] [client 192.168.1.10:64526] AH00135: Invalid method in request bela\x19\x84\x04
[Wed Jan 25 16:55:16.458689 2017] [core:error] [pid 4980:tid 1088] [client 192.168.1.10:64530] AH00135: Invalid method in request bela\x19\x84\x04
I am using TCP instaed of upd and server advertise is off on mod_cluster side
i followed this tutorial to install freeradius and dalo radius for the raspberry pi:
http://www.binaryheartbeat.net/2013/12/raspberry-pi-based-freeradius-server.html
i tested the file authentication and it worked fine but after installing daloradius and switching to MySQL authnetications fail for unknown reasons
here is freeradius output that occurs when trying to authenticate a user:
rad_recv: Access-Request packet from host 192.168.1.1 port 32779, id=216, length=172
User-Name = "ccc"
State = 0xf9775519ff7f4c9188c14494359a170f
EAP-Message = 0x0208005b190017030100500d2898ca35aa9fa9e4febd8816c9e6deda71960fe5692b7c3d0499f2b5bba6b531483e373e14f8aff517aa081e214edc98e2c8bb22d16a961ecff4f498d20d152535b4d11ace1484b985bd2501ade77b
Service-Type = Framed-User
Framed-MTU = 1420
NAS-IP-Address = 192.168.1.1
Message-Authenticator = 0x49fc781b8a152fbec467b2c1f275a1a1
Tue Dec 29 18:38:47 2015 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default
Tue Dec 29 18:38:47 2015 : Info: +group authorize {
Tue Dec 29 18:38:47 2015 : Info: ++[preprocess] = ok
Tue Dec 29 18:38:47 2015 : Info: ++[chap] = noop
Tue Dec 29 18:38:47 2015 : Info: ++[mschap] = noop
Tue Dec 29 18:38:47 2015 : Info: ++[digest] = noop
Tue Dec 29 18:38:47 2015 : Info: [suffix] No '#' in User-Name = "ccc", looking up realm NULL
Tue Dec 29 18:38:47 2015 : Info: [suffix] No such realm "NULL"
Tue Dec 29 18:38:47 2015 : Info: ++[suffix] = noop
Tue Dec 29 18:38:47 2015 : Info: [eap] EAP packet type response id 8 length 91
Tue Dec 29 18:38:47 2015 : Info: [eap] Continuing tunnel setup.
Tue Dec 29 18:38:47 2015 : Info: ++[eap] = ok
Tue Dec 29 18:38:47 2015 : Info: +} # group authorize = ok
Tue Dec 29 18:38:47 2015 : Info: Found Auth-Type = EAP
Tue Dec 29 18:38:47 2015 : Info: # Executing group from file /etc/freeradius/sites-enabled/default
Tue Dec 29 18:38:47 2015 : Info: +group authenticate {
Tue Dec 29 18:38:47 2015 : Info: [eap] Request found, released from the list
Tue Dec 29 18:38:47 2015 : Info: [eap] EAP/peap
Tue Dec 29 18:38:47 2015 : Info: [eap] processing type peap
Tue Dec 29 18:38:47 2015 : Info: [peap] processing EAP-TLS
Tue Dec 29 18:38:47 2015 : Info: [peap] eaptls_verify returned 7
Tue Dec 29 18:38:47 2015 : Info: [peap] Done initial handshake
Tue Dec 29 18:38:47 2015 : Info: [peap] eaptls_process returned 7
Tue Dec 29 18:38:47 2015 : Info: [peap] EAPTLS_OK
Tue Dec 29 18:38:47 2015 : Info: [peap] Session established. Decoding tunneled attributes.
Tue Dec 29 18:38:47 2015 : Info: [peap] Peap state phase2
Tue Dec 29 18:38:47 2015 : Info: [peap] EAP type mschapv2
Tue Dec 29 18:38:47 2015 : Info: [peap] Got tunneled request
EAP-Message = 0x0208003e1a0208003931461c2f1334a4b7bab38912e9d82dd97b000000000000000070fb7810a938a00d884f17dc01b62eaa7dde9fbb7ab2cf4200636363
server {
Tue Dec 29 18:38:47 2015 : Info: [peap] Setting User-Name to ccc
Sending tunneled request
EAP-Message = 0x0208003e1a0208003931461c2f1334a4b7bab38912e9d82dd97b000000000000000070fb7810a938a00d884f17dc01b62eaa7dde9fbb7ab2cf4200636363
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "ccc"
State = 0x4bb6eef44bbef48a7072f4e023895561
server inner-tunnel {
Tue Dec 29 18:38:47 2015 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel
Tue Dec 29 18:38:47 2015 : Info: +group authorize {
Tue Dec 29 18:38:47 2015 : Info: ++[chap] = noop
Tue Dec 29 18:38:47 2015 : Info: ++[mschap] = noop
Tue Dec 29 18:38:47 2015 : Info: [suffix] No '#' in User-Name = "ccc", looking up realm NULL
Tue Dec 29 18:38:47 2015 : Info: [suffix] No such realm "NULL"
Tue Dec 29 18:38:47 2015 : Info: ++[suffix] = noop
Tue Dec 29 18:38:47 2015 : Info: ++update control {
Tue Dec 29 18:38:47 2015 : Info: ++} # update control = noop
Tue Dec 29 18:38:47 2015 : Info: [eap] EAP packet type response id 8 length 62
Tue Dec 29 18:38:47 2015 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation
Tue Dec 29 18:38:47 2015 : Info: ++[eap] = updated
Tue Dec 29 18:38:47 2015 : Info: ++[files] = noop
Tue Dec 29 18:38:47 2015 : Info: ++[expiration] = noop
Tue Dec 29 18:38:47 2015 : Info: ++[logintime] = noop
Tue Dec 29 18:38:47 2015 : Info: ++[pap] = noop
Tue Dec 29 18:38:47 2015 : Info: +} # group authorize = updated
Tue Dec 29 18:38:47 2015 : Info: Found Auth-Type = EAP
Tue Dec 29 18:38:47 2015 : Info: # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
Tue Dec 29 18:38:47 2015 : Info: +group authenticate {
Tue Dec 29 18:38:47 2015 : Info: [eap] Request found, released from the list
Tue Dec 29 18:38:47 2015 : Info: [eap] EAP/mschapv2
Tue Dec 29 18:38:47 2015 : Info: [eap] processing type mschapv2
Tue Dec 29 18:38:47 2015 : Info: [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
Tue Dec 29 18:38:47 2015 : Info: [mschapv2] +group MS-CHAP {
Tue Dec 29 18:38:47 2015 : Info: [mschap] No Cleartext-Password configured. Cannot create LM-Password.
Tue Dec 29 18:38:47 2015 : Info: [mschap] No Cleartext-Password configured. Cannot create NT-Password.
Tue Dec 29 18:38:47 2015 : Info: [mschap] Creating challenge hash with username: ccc
Tue Dec 29 18:38:47 2015 : Info: [mschap] Client is using MS-CHAPv2 for ccc, we need NT-Password
Tue Dec 29 18:38:47 2015 : Info: [mschap] FAILED: No NT/LM-Password. Cannot perform authentication.
Tue Dec 29 18:38:47 2015 : Info: [mschap] FAILED: MS-CHAP2-Response is incorrect
Tue Dec 29 18:38:47 2015 : Info: ++[mschap] = reject
Tue Dec 29 18:38:47 2015 : Info: +} # group MS-CHAP = reject
Tue Dec 29 18:38:47 2015 : Info: [eap] Freeing handler
Tue Dec 29 18:38:47 2015 : Info: ++[eap] = reject
Tue Dec 29 18:38:47 2015 : Info: +} # group authenticate = reject
Tue Dec 29 18:38:47 2015 : Info: Failed to authenticate the user.
Tue Dec 29 18:38:47 2015 : Info: Using Post-Auth-Type REJECT
Tue Dec 29 18:38:47 2015 : Info: # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
Tue Dec 29 18:38:47 2015 : Info: +group REJECT {
Tue Dec 29 18:38:47 2015 : Info: [attr_filter.access_reject] expand: %{User-Name} -> ccc
Tue Dec 29 18:38:47 2015 : Debug: attr_filter: Matched entry DEFAULT at line 11
Tue Dec 29 18:38:47 2015 : Info: ++[attr_filter.access_reject] = updated
Tue Dec 29 18:38:47 2015 : Info: +} # group REJECT = updated
} # server inner-tunnel
Tue Dec 29 18:38:47 2015 : Info: [peap] Got tunneled reply code 3
MS-CHAP-Error = "\010E=691 R=1"
EAP-Message = 0x04080004
Message-Authenticator = 0x00000000000000000000000000000000
Tue Dec 29 18:38:47 2015 : Info: [peap] Got tunneled reply RADIUS code 3
MS-CHAP-Error = "\010E=691 R=1"
EAP-Message = 0x04080004
Message-Authenticator = 0x00000000000000000000000000000000
Tue Dec 29 18:38:47 2015 : Info: [peap] Tunneled authentication was rejected.
Tue Dec 29 18:38:47 2015 : Info: [peap] FAILURE
Tue Dec 29 18:38:47 2015 : Info: ++[eap] = handled
Tue Dec 29 18:38:47 2015 : Info: +} # group authenticate = handled
Sending Access-Challenge of id 216 to 192.168.1.1 port 32779
EAP-Message = 0x0109002b190017030100205991bfd8f9e7f70794477d653c848e8b443626b3b935a5b3f049ac7af1534d3e
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xf9775519fe7e4c9188c14494359a170f
Tue Dec 29 18:38:47 2015 : Info: Finished request 7.
Tue Dec 29 18:38:47 2015 : Debug: Going to the next request
Tue Dec 29 18:38:47 2015 : Debug: Waking up in 0.4 seconds.
rad_recv: Access-Request packet from host 192.168.1.1 port 32779, id=217, length=124
User-Name = "ccc"
State = 0xf9775519fe7e4c9188c14494359a170f
EAP-Message = 0x0209002b190017030100202a7f1a72de2970b689e44c005661d1e1e444854af7499ebeb23eabc7bfad7b64
Service-Type = Framed-User
Framed-MTU = 1420
NAS-IP-Address = 192.168.1.1
Message-Authenticator = 0xc9b0d8e268df2d8e4b484725c3efa189
Tue Dec 29 18:38:47 2015 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default
Tue Dec 29 18:38:47 2015 : Info: +group authorize {
Tue Dec 29 18:38:47 2015 : Info: ++[preprocess] = ok
Tue Dec 29 18:38:47 2015 : Info: ++[chap] = noop
Tue Dec 29 18:38:47 2015 : Info: ++[mschap] = noop
Tue Dec 29 18:38:47 2015 : Info: ++[digest] = noop
Tue Dec 29 18:38:47 2015 : Info: [suffix] No '#' in User-Name = "ccc", looking up realm NULL
Tue Dec 29 18:38:47 2015 : Info: [suffix] No such realm "NULL"
Tue Dec 29 18:38:47 2015 : Info: ++[suffix] = noop
Tue Dec 29 18:38:47 2015 : Info: [eap] EAP packet type response id 9 length 43
Tue Dec 29 18:38:47 2015 : Info: [eap] Continuing tunnel setup.
Tue Dec 29 18:38:47 2015 : Info: ++[eap] = ok
Tue Dec 29 18:38:47 2015 : Info: +} # group authorize = ok
Tue Dec 29 18:38:47 2015 : Info: Found Auth-Type = EAP
Tue Dec 29 18:38:47 2015 : Info: # Executing group from file /etc/freeradius/sites-enabled/default
Tue Dec 29 18:38:47 2015 : Info: +group authenticate {
Tue Dec 29 18:38:47 2015 : Info: [eap] Request found, released from the list
Tue Dec 29 18:38:47 2015 : Info: [eap] EAP/peap
Tue Dec 29 18:38:47 2015 : Info: [eap] processing type peap
Tue Dec 29 18:38:47 2015 : Info: [peap] processing EAP-TLS
Tue Dec 29 18:38:47 2015 : Info: [peap] eaptls_verify returned 7
Tue Dec 29 18:38:47 2015 : Info: [peap] Done initial handshake
Tue Dec 29 18:38:47 2015 : Info: [peap] eaptls_process returned 7
Tue Dec 29 18:38:47 2015 : Info: [peap] EAPTLS_OK
Tue Dec 29 18:38:47 2015 : Info: [peap] Session established. Decoding tunneled attributes.
Tue Dec 29 18:38:47 2015 : Info: [peap] Peap state send tlv failure
Tue Dec 29 18:38:47 2015 : Info: [peap] Received EAP-TLV response.
Tue Dec 29 18:38:47 2015 : Info: [peap] The users session was previously rejected: returning reject (again.)
Tue Dec 29 18:38:47 2015 : Info: [peap] *** This means you need to read the PREVIOUS messages in the debug output
Tue Dec 29 18:38:47 2015 : Info: [peap] *** to find out the reason why the user was rejected.
Tue Dec 29 18:38:47 2015 : Info: [peap] *** Look for "reject" or "fail". Those earlier messages will tell you.
Tue Dec 29 18:38:47 2015 : Info: [peap] *** what went wrong, and how to fix the problem.
Tue Dec 29 18:38:47 2015 : Info: [eap] Handler failed in EAP/peap
Tue Dec 29 18:38:47 2015 : Info: [eap] Failed in EAP select
Tue Dec 29 18:38:47 2015 : Info: ++[eap] = invalid
Tue Dec 29 18:38:47 2015 : Info: +} # group authenticate = invalid
Tue Dec 29 18:38:47 2015 : Info: Failed to authenticate the user.
Tue Dec 29 18:38:47 2015 : Info: Using Post-Auth-Type REJECT
Tue Dec 29 18:38:47 2015 : Info: # Executing group from file /etc/freeradius/sites-enabled/default
Tue Dec 29 18:38:47 2015 : Info: +group REJECT {
Tue Dec 29 18:38:47 2015 : Info: [sql] expand: %{User-Name} -> ccc
Tue Dec 29 18:38:47 2015 : Info: [sql] sql_set_user escaped user --> 'ccc'
Tue Dec 29 18:38:47 2015 : Info: [sql] expand: %{User-Password} ->
Tue Dec 29 18:38:47 2015 : Info: [sql] ... expanding second conditional
Tue Dec 29 18:38:47 2015 : Info: [sql] expand: %{Chap-Password} ->
Tue Dec 29 18:38:47 2015 : Info: [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'ccc', '', 'Access-Reject', '2015-12-29 18:38:47')
Tue Dec 29 18:38:47 2015 : Debug: rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'ccc', '', 'Access-Reject', '2015-12-29 18:38:47')
Tue Dec 29 18:38:47 2015 : Debug: rlm_sql (sql): Reserving sql socket id: 29
Tue Dec 29 18:38:47 2015 : Debug: rlm_sql (sql): Released sql socket id: 29
Tue Dec 29 18:38:47 2015 : Info: ++[sql] = ok
Tue Dec 29 18:38:47 2015 : Info: [attr_filter.access_reject] expand: %{User-Name} -> ccc
Tue Dec 29 18:38:47 2015 : Debug: attr_filter: Matched entry DEFAULT at line 11
Tue Dec 29 18:38:47 2015 : Info: ++[attr_filter.access_reject] = updated
Tue Dec 29 18:38:47 2015 : Info: +} # group REJECT = updated
Tue Dec 29 18:38:47 2015 : Info: Delaying reject of request 8 for 1 seconds
Tue Dec 29 18:38:47 2015 : Debug: Going to the next request
Tue Dec 29 18:38:47 2015 : Debug: Waking up in 0.1 seconds.
Tue Dec 29 18:38:47 2015 : Info: Cleaning up request 0 ID 209 with timestamp +11
Tue Dec 29 18:38:47 2015 : Debug: Waking up in 0.3 seconds.
Tue Dec 29 18:38:47 2015 : Info: Cleaning up request 1 ID 210 with timestamp +11
Tue Dec 29 18:38:47 2015 : Debug: Waking up in 0.3 seconds.
Tue Dec 29 18:38:48 2015 : Info: Cleaning up request 2 ID 211 with timestamp +12
Tue Dec 29 18:38:48 2015 : Debug: Waking up in 0.1 seconds.
Tue Dec 29 18:38:48 2015 : Info: Sending delayed reject for request 8
Sending Access-Reject of id 217 to 192.168.1.1 port 32779
EAP-Message = 0x04090004
Message-Authenticator = 0x00000000000000000000000000000000
Found the solution,
the problem was that i didn't configure the /etc/raddb/sites-available/inner-tunnel file to use sql
I need to setup a postfix server to receive emails and post the email bodies to a bbs.
Postfix version: 2.10.2
/etc/postfix/main.cf:
queue_directory = /var/spool/postfix
command_directory = /usr/bin
daemon_directory = /usr/lib/postfix
data_directory = /var/lib/postfix
mail_owner = postfix
myhostname = mail.mydummydomain.com
mydomain = mydummydomain.com
myorigin = $mydomain
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
local_recipient_maps =
virtual_alias_maps = hash:/etc/postfix/redirect
unknown_local_recipient_reject_code = 550
mynetworks = 127.0.0.0/8, 192.168.56.0/24, 192.168.79.0/24
alias_maps = hash:/etc/postfix/aliases
alias_database = $alias_maps
debug_peer_level = 2
debugger_command =
PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
ddd $daemon_directory/$process_name $process_id & sleep 5
sendmail_path = /usr/bin/sendmail
newaliases_path = /usr/bin/newaliases
mailq_path = /usr/bin/mailq
setgid_group = postdrop
html_directory = no
manpage_directory = /usr/share/man
sample_directory = /etc/postfix/sample
readme_directory = /usr/share/doc/postfix
(I have to add "local_recipient_maps =" otherwise the email will be rejected with "550 5.1.1 <...>: Recipient address rejected: User unknown in local recipient table".)
/etc/postfix/redirect:
/*/ tomyscript
/etc/postfix/aliases:
MAILER-DAEMON: postmaster
postmaster: root
bin: root
daemon: root
named: root
nobody: root
uucp: root
www: root
ftp-bugs: root
postfix: root
manager: root
dumper: root
operator: root
abuse: postmaster
tomyscript: "|/tmp/myscript.py >> /tmp/mail.log"
decode: root
When I send a test email to my postfix server, apparently it is not redirected to my script:
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 mail.mydummydomain.com ESMTP Postfix
ehlo mydummydomain.com
250-mail.mydummydomain.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
mail from:<aaa#mydummydomain.com>
250 2.1.0 Ok
rcpt to:<bbb#mydummydomain.com>
250 2.1.5 Ok
data
354 End data with <CR><LF>.<CR><LF>
this is the email body
.
250 2.0.0 Ok: queued as 825061A003D
Postfix log:
Dec 27 15:04:28 Arch postfix/smtpd[2812]: connect from localhost.localdomain[127.0.0.1]
Dec 27 15:06:26 Arch postfix/smtpd[2812]: 825061A003D: client=localhost.localdomain[127.0.0.1]
Dec 27 15:06:35 Arch postfix/cleanup[2814]: 825061A003D: message-id=<20131227070626.825061A003D#mail.mydummydomain.com>
Dec 27 15:06:35 Arch postfix/qmgr[2804]: 825061A003D: from=<aaa#mydummydomain.com>, size=368, nrcpt=1 (queue active)
Dec 27 15:06:35 Arch postfix/local[2815]: 825061A003D: to=<bbb#mydummydomain.com>, relay=local, delay=110, delays=110/0.01/0/0.03, dsn=5.1.1, status=bounced (unknown user: "bbb")
Dec 27 15:06:35 Arch postfix/cleanup[2814]: 7BA861A0041: message-id=<20131227070635.7BA861A0041#mail.mydummydomain.com>
Dec 27 15:06:35 Arch postfix/bounce[2816]: 825061A003D: sender non-delivery notification: 7BA861A0041
Dec 27 15:06:35 Arch postfix/qmgr[2804]: 7BA861A0041: from=<>, size=2209, nrcpt=1 (queue active)
Dec 27 15:06:35 Arch postfix/qmgr[2804]: 825061A003D: removed
Dec 27 15:06:35 Arch postfix/local[2815]: 7BA861A0041: to=<aaa#mydummydomain.com>, relay=local, delay=0.02, delays=0.01/0/0/0.01, dsn=5.1.1, status=bounced (unknown user: "aaa")
Dec 27 15:06:35 Arch postfix/qmgr[2804]: 7BA861A0041: removed
Dec 27 15:06:57 Arch postfix/smtpd[2812]: disconnect from localhost.localdomain[127.0.0.1]
myscript.py:
#!/usr/bin/env python2
import sys
for line in sys.stdin.read().split('\n'):
print line
Any idea?