使用 apache2 作为 proxypass 时的 Apache OpenMeetings 4.0.4 CSRF 攻击

我有 Apache OpenMeetings 4.0.4 女巫 Apache/2.2.22 作为代理。

在 OM 的 conf/red5.properties 中我有

http.port=8080

我想做两件事：

1. 重定向 HTTP (80) -> HTTPS (443)

2. 将 HTTP (8080) 重定向到 HTTPS (443)

我的 /etc/apache2/sites-available/defaultconf 是：

<VirtualHost *:80>
    ServerName domain.test-test.eu
    ServerAlias domain.test-test.eu

    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
</VirtualHost>

<VirtualHost *:8080>
    ServerName domain.test-test.eu
    ServerAlias domain.test-test.eu

    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
</VirtualHost>

我的 /etc/apache2/sites-available/default-sslconf 是：

<VirtualHost *:443>
    ServerName domain.test-test.eu
    ServerAlias domain.test-test.eu

    ProxyRequests Off
    ProxyPreserveHost On

    ProxyPass / http://localhost:8080/
    ProxyPassReverse / http://localhost:8080/

    SSLEngine On
    SSLCerificateFile /etc/apache2/certs/collaboration.crt
    SSLCerificateKeyFile /etc/apache2/certs/collaboration.key
    SSLCerificateChainFile /etc/apache2/certs/chain.pem
</VirtualHost>

当我打字时http://domain.test-test.eu/ http://domain.test-test.eu/它把我重定向到https://domain.test-test.eu https://domain.test-test.eu.

当我打字时http://192.168.XXX.YYY http://192.168.XXX.YYY它把我重定向到https://192.168.XXX.YYY https://192.168.XXX.YYY

但是当我打字时http://192.168.XXX.YYY:8080 http://192.168.XXX.YYY:8080 or http://domain.test-test.eu:8080 http://domain.test-test.eu:8080它不会将我重定向到https://192.168.XXX.YYY https://192.168.XXX.YYY or https://domain.test-test.eu/ https://domain.test-test.eu/。页面打开（无 HTTPS）。

第二个问题是，在OM的日志中我可以看到CSRF信息，但无法通过HTTPS登录。

OM 日志中的信息：

[http-nio-0.0.0.0-8080-exec-10] INFO o.a.w.p.h.CsrfPreventionRequestCycleListener - Possible CSRF attack, request URL: http://192.168.XXX.YYY/openmeetings/wicket/bookmarkable/org.apache.openmeetings.web.pages.auth.SignInPage, Origin: https://192.168.XXX.YYY, action: aborted with error 400 Origin does not correspond to request

我应该如何更改 Apache 设置才能使其正常工作？

恐怕无法设置“将 HTTP (8080) 重定向到 HTTPS (443)”

如果您在端口 8080 上运行 OpenMeetings，则不能将其用于 Apache，反之亦然。 Internet 端口应由 OM 或 Apache 独占使用，而不是两者都使用。

我会在固件级别关闭端口 8080，以拒绝对 OM 的直接访问。 （并请删除规则<VirtualHost *:8080>否则 OM 将无法启动Port already in use信息）

现在根据 CSRF：

你需要修改conf/jee-container.xml并添加以下属性

<property name="secure" value="true" />

To <!-- Tomcat without SSL enabled -->之前阻塞<property name="connectionProperties">

这应该可以解决你的问题

但 OpenMeetings 无法使用此配置......

因为你还需要代理 WebSockets ....

所以你还需要 mod_rewrite 和 mod_proxy_wstunnel

那么你需要添加以下部分：

RewriteEngine On
RewriteCond %{HTTP:Connection} Upgrade [NC]
RewriteCond %{HTTP:Upgrade} websocket [NC]
RewriteRule /(.*) ws://localhost:8080/$1 [P,L]
RedirectMatch ^/$ https://domain.test-test.eu/openmeetings

此外，您可能希望对 RTMP 流量执行隧道传输，这将需要特殊的规则open, send, idle and close

以下是 Apache 2.4 的最终配置：

<VirtualHost *:443>
  ServerName domain.test-test.eu

  ## Vhost docroot
  DocumentRoot "/var/www/"

  ## Directories, there should at least be a declaration for /var/www/

  <Directory "/var/www/">
    Options Indexes FollowSymLinks MultiViews
    AllowOverride None
    Require all granted
  </Directory>

  ## Logging
  ErrorLog "/var/log/apache2/domain.test-test.eu-ssl-error.log"
  ServerSignature Off
  CustomLog "/var/log/apache2/domain.test-test.eu.http_access.log" combined

  ## SSL directives
  SSLEngine on
  SSLCertificateFile      "/_certs_path_/domain.test-test.eu/fullchain.pem"
  SSLCertificateKeyFile   "/_certs_path_/domain.test-test.eu/privkey.pem"
  SSLCACertificatePath    "/_CA_certs_path_"

###      OpenMeetings    ###
## Custom fragment
RewriteEngine On
RewriteCond %{HTTP:Connection} Upgrade [NC]
RewriteCond %{HTTP:Upgrade} websocket [NC]
RewriteRule /(.*) ws://localhost:5080/$1 [P,L]
RedirectMatch ^/$ https://domain.test-test.eu/openmeetings
ProxyPreserveHost On

<Location /openmeetings>
  Require all granted      
  ProxyPass http://localhost:5080/openmeetings
  ProxyPassReverse http://localhost:5080/openmeetings
  RewriteEngine On
  RewriteRule ^/(.*) http://localhost:5080/$1 [P]
</Location>
<Location /open>
  Require all granted
  ProxyPass http://localhost:5080/open
  ProxyPassReverse http://localhost:5080/open
</Location>
<Location /send>
  Require all granted
  ProxyPass http://localhost:5080/send
  ProxyPassReverse http://localhost:5080/send
</Location>
<Location /idle>
  Require all granted
  ProxyPass http://localhost:5080/idle
  ProxyPassReverse http://localhost:5080/idle
</Location>
<Location /close>
  Require all granted
  ProxyPass http://localhost:5080/close
  ProxyPassReverse http://localhost:5080/close
</Location>

</VirtualHost>

按预期为我工作:)