search

jumpserver / helm-charts

Helm charts for JumpServer
GNU General Public License v3.0
42 stars 35 forks source link

[Bug] 登录日志的IP为局域网IP #146

Closed carllhw closed 10 months ago

carllhw commented 10 months ago

JumpServer 版本(v1.5.9以下不再支持) v3.8.2

浏览器版本 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 |  

Bug 描述 登录日志的IP为局域网IP，没有获取到用户的公网IP

Bug 重现步骤(有截图更好)

carllhw commented 10 months ago

https://github.com/jumpserver/jumpserver/commit/8b3fd2c117cbc1b816ab8a5d64c1eb14171eae19 有这个提交的版本的helm部署就获取不到了

carllhw commented 10 months ago

实际环境访问链路为WAF->HTTPS LB->jms web

wojiushixiaobai commented 10 months ago

web pod 配置下 USE_LB: 0 试试

carllhw commented 10 months ago

现在就是0

root@oi-jms-jumpserver-jms-web-5595c55cbf-9fbl2:/opt# echo $USE_LB
0
wojiushixiaobai commented 10 months ago

看下 Nginx 日志，有没有获取到客户端的真实 IP 地址。 web pod 的 /var/log/nginx 里面

carllhw commented 10 months ago

也没有 $remote_addr获取的是服务器的节点IP $http_x_forwarded_for第一个是客户端的公网IP，第二个应该是WAF的IP

wojiushixiaobai commented 10 months ago

把 $remote_addr 那行注释掉试试

# proxy_set_header X-Real-IP $remote_addr;
carllhw commented 10 months ago

全部注释后，登录IP变成了$http_x_forwarded_for的第二个的WAF的IP

wojiushixiaobai commented 10 months ago

@carllhw Nginx 有这块的解决方案，set_real_ip_from 和 real_ip_header

set_real_ip_from 172.17.0.1; # waf ip
real_ip_header X-Forwarded-For;

具体参考 Nginx 官方文档

carllhw commented 10 months ago

但helm charts里没法调整，下次升级就会覆盖了

wojiushixiaobai commented 10 months ago

你只能覆盖下模板，然后重建 web pod 了

carllhw commented 10 months ago

这样测试是可以的，因为waf网段有两个，节点ip网段和pod网段也要加上，还需要多个set_real_ip_from生效配置 real_ip_recursive on;

carllhw commented 10 months ago

https://github.com/jumpserver/helm-charts/blob/main/charts/jumpserver/configs/jms-web/default.conf#L11 这里可以从values里读取配置吗，通过values来添加nginx配置

wojiushixiaobai commented 10 months ago

看起来应该没问题，我优化下这块的逻辑。 在 values.yaml 的 web 添加 env：

web:
  enabled: true
  ...
  env:
  # nginx client_max_body_size, default 4G
  CLIENT_MAX_BODY_SIZE: 4096m
  ## See: https://github.com/jumpserver/docker-web/blob/master/init.sh#L37
  # USE_LB: 1, then nginx use 'proxy_set_header X-Forwarded-For $remote_addr'
  # USE_LB: 0, then nginx use 'proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for'
  USE_LB: 0