search

jasonish / evebox

Web Based Event Viewer (GUI) for Suricata EVE Events in Elastic Search
https://evebox.org/
MIT License
418 stars 67 forks source link

reverse-proxy #163

Closed fcorneli closed 3 years ago

fcorneli commented 3 years ago

The evebox.yaml.example example configuration file contains reverse-proxy as configuration option. But checking out the source code, I could not find that it is actually being used/implemented somewhere.

Could someone provide an example configuration on how to run Evebox behind and Apache reverse proxy?

jasonish commented 3 years ago

Looks like I missed this during a rewrite. EveBox should still work properly, this is purely to fixup the addresses when logging. But I'll address this soon.

jasonish commented 3 years ago

I've fixed up the reverse proxy handling. It still might not be perfect yet, like a configurable header name for the real client ip.

fcorneli commented 3 years ago

Thanks. FYI... an Apache configuration that seems to work for me is:

<Location "/evebox">
    ProxyPass http://localhost:5636
</Location>

ProxyPassReverse /(.*) http://localhost:5636/(.*)

Maybe this could be added to the documentation.

jasonish commented 3 years ago

I added this to the Wiki as I'd rather keep the EveBox documentation just about EveBox. I already cover other tools in the Wiki so I just created this: https://github.com/jasonish/evebox/wiki/Apache-Reverse-Proxy-Configuration

Do you happen to know what headers, if any this will send in the request? X-Forwarded-For? X-Real-IP? Been a while since I used Apache.

fcorneli commented 3 years ago

X-Forwarded-For is indeed available when serving behind an Apache reverse proxy. See also: https://httpd.apache.org/docs/current/mod/mod_proxy.html#x-headers