NGINX with Reverse Proxy and CSF settings

Operating System & Version
CentOS 7.9
cPanel & WHM Version
110.0.9
S

SPDTeam

Active Member
Dec 4, 2020
28
2
3
UK
cPanel Access Level
Root Administrator
Hi all

I've recently installed NGINX with Reverse Proxy successfully.

The server had ConfigServer Security & Firewall (CSF) installed previous to this and I'm wondering are there any CSF setting that should be changed?

For example the lfd average high load emails include an Apache status attachment. This usually shows the Apache status at the time of the high load, but when I open it now it shows error " Unable to retrieve Apache Server Status [http://127.0.0.1/whm-server-status] - Unable to download: Forbidden ".

Assume this just need a config change somewhere, but there may be other recommendations others have come across.

Tried looking up info on the CSF forums, but nothing stands out. Any advice would be appreciated.
 
Last edited by a moderator:
cPRex

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
17,470
2,843
363
cPanel Access Level
Root Administrator
Hey there! No, there are no settings in CSF that need to be adjusted when you install Nginx. I'm aware that LiteSpeed doesn't work with the Apache status as we have that documented here, but nginx should work normally.

I am not able to reach http://x.x.x.x/whm-server-status on my personal server, which doesn't have Nginx installed, but does have CSF/LFD so I'm wondering if that link should be something else? Is that the entire URL from the message?
 
S

SPDTeam

Active Member
Dec 4, 2020
28
2
3
UK
cPanel Access Level
Root Administrator
cPRex said:
Hey there! No, there are no settings in CSF that need to be adjusted when you install Nginx. I'm aware that LiteSpeed doesn't work with the Apache status as we have that documented here, but nginx should work normally.

I am not able to reach http://x.x.x.x/whm-server-status on my personal server, which doesn't have Nginx installed, but does have CSF/LFD so I'm wondering if that link should be something else? Is that the entire URL from the message?
Click to expand...
Hi cPRex

After a bit more digging in CSF I found that lfd.log also shows the same error as in the email.

CSF Configuration setting PT_APACHESTATUS is set to http://127.0.0.1/whm-server-status. With description "This is the Apache Server Status URL used in the email alert. Requires the Apache mod_status module to be installed and configured correctly".

This isn't installed on the server but must have been prior to NGINX installation, and mod_status module isn't available via EasyApache. Is this by design?.

Another thing I noticed, which may or maynot be related, is CSF System Statistics no longer show any Apache based stats post NGINX installation. This is the same for MUNIN as well.
 
cPRex

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
17,470
2,843
363
cPanel Access Level
Root Administrator
We do include the "status_module" as a package with Apache that can't be removed. You can see that with "httpd -M | grep status" on the system. This is the same as "mod_status" - mod_status - Apache HTTP Server Version 2.4

So it is normal that you don't see a way to install that since it shouldn't be removed/installed on any server as it just always there.

I can confirm that running "curl http://127.0.0.1/whm-server-status" from the server's command line does pull the correct report, but I wouldn't expect this to work in any type of clickable link as would then no longer be local. Are you able to run that from your local system with no issues?
 
S

SPDTeam

Active Member
Dec 4, 2020
28
2
3
UK
cPanel Access Level
Root Administrator
cPRex said:
We do include the "status_module" as a package with Apache that can't be removed. You can see that with "httpd -M | grep status" on the system. This is the same as "mod_status" - mod_status - Apache HTTP Server Version 2.4

So it is normal that you don't see a way to install that since it shouldn't be removed/installed on any server as it just always there.

I can confirm that running "curl http://127.0.0.1/whm-server-status" from the server's command line does pull the correct report, but I wouldn't expect this to work in any type of clickable link as would then no longer be local. Are you able to run that from your local system with no issues?
Click to expand...

Running "httpd -M | grep status" I get "status_module (shared)".

Running "curl http://127.0.0.1/whm-server-status" on the server I get the response:

<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx</center>
</body>
</html>
 
  • Like
Reactions: cPRex
Q

quietFinn

Well-Known Member
Feb 4, 2006
2,109
580
493
Finland
cPanel Access Level
Root Administrator
I'd suggest that you check /etc/apache2/logs/error_log & /etc/apache2/logs/modsec_audit.log, you might see why that 403 error is given,
 
  • Like
Reactions: cPRex
S

SPDTeam

Active Member
Dec 4, 2020
28
2
3
UK
cPanel Access Level
Root Administrator
cPRex said:
Like @quietFinn said, this confirms the issue isn't with the module or with CSF, but there is something blocking that status page on the server.
Click to expand...
Figure out what the cause was, should have realised.

When NGINX with Reverse Proxy is installed it updates the Apache to new default ports. i.e. 80 to 81 and 443 to 444, etc.

Changing the PT_APACHESTATUS setting in CSF to include the new port resolved the issue. This also fixed the the CSF System Statistics Apache based stats as well.

Munin is still not showing Apache stats but assume its a similar issue. Just need to find the right config file.
 
You must log in or register to reply here.
Thread starter Similar threads Forum Replies Date
leonep Cloudflare and Nginx reverse Proxy Web Servers and Applications 6
K SOLVED NGINX as a reverse proxy: Cannot override cPanel's cpanel-proxy.conf settings Web Servers and Applications 8
leonep Restore visitors IP address after install nginx reverse proxy Web Servers and Applications 1
D SOLVED NGINX® Manager - Reverse Proxy Subdomain to Docker-Container Web Servers and Applications 15
M Nginx Reverse Proxy with WordPress / WooCommerce Web Servers and Applications 1
Similar threads
Cloudflare and Nginx reverse Proxy
SOLVED NGINX as a reverse proxy: Cannot override cPanel's cpanel-proxy.conf settings
Restore visitors IP address after install nginx reverse proxy
SOLVED NGINX® Manager - Reverse Proxy Subdomain to Docker-Container
Nginx Reverse Proxy with WordPress / WooCommerce
Top Bottom