Moodle in English: HaProxy: Moodle complains about not running via SSL though it does

HaProxy: Moodle complains about not running via SSL though it does

by ray charles - Wednesday, March 4, 2020, 2:34 AM

Hey there.

Moodle complains about not running on SSL though it does.

I'm running various sites in a DMZ using HaProxy.
A working SSL certificate is in place. It is valid for any site running via HaProxy.
(so there are no per site certificates via Apache config..)

I'm trying to set up Moodle 3.7.2 as a subdomain.
I start setup via https://moodle.mysite.TLD/moodle/install.php

On the confirm paths page during install Moodle will only accept http://mysite.TLD, instead of https://mysite.TLD. (i.e. the path cannot be edited)
The install concludes alright, but Moodle will not work afterwards complaining it requires SSL to work properly.

Question:
Is there any way to tell moodle to do without the SSL check to make it work?
After all, traffic actually is encrypted, there's extra security coming from Cloudflare and even signed DNS..

I've tried to edit config.php but to no avail.

Any suggestions are appreciated.

Re: HaProxy: Moodle complains about not running via SSL though it does

by Matteo Scaramuccia - Wednesday, March 4, 2020, 5:24 AM

Hi Ray Charles,

Is there any way to tell moodle to do without the SSL check to make it work?

look into config-dist.php:

// Enable when using external SSL appliance for performance reasons.
// Please note that site may be accessible via http: or https:, but not both!
//      $CFG->sslproxy = true;

HTH,
Matteo

Average of ratings: -

Re: HaProxy: Moodle complains about not running via SSL though it does

by ray charles - Friday, March 6, 2020, 1:03 AM

Hey Matteo

Thanx for your answer. -
Unfortunately setting "$CFG->sslproxy = true;" has no noticeable effect.

Moodle still throws warnings that data is being sent via a seemingly insecure connection,
plus the installation will always finish with an unusable site
(hangs on admin's credentials forever).

I've tried three different moodle versions (3.6-3.8) alternating 'git clone' and .tar downloads.
The symptoms remain the same:
Moodle thinks it's running on plain http while the URL clearly shows https.

Can you think of any alternative measures?

BR,
ray

Average of ratings: -

Re: HaProxy: Moodle complains about not running via SSL though it does

by Matteo Scaramuccia - Friday, March 6, 2020, 5:29 AM

Hi Ray,

Can you think of any alternative measures?

install Moodle directly using the backend site or the CLI command, than move it behind HAProxy by changing the config.php file:

Edit $CFG->wwwroot to reflect https:// and the actual hostname via HAProxy
Add $CFG->reverseproxy = true;
Add $CFG->sslproxy = true;

Then, if everything will work, look for backend site IP/Hostname refs into the config SQL table and change them accordingly.

HTH,
Matteo

Average of ratings:Useful (1)

Re: HaProxy: Moodle complains about not running via SSL though it does

by ray charles - Tuesday, March 10, 2020, 10:52 PM

Hello Matteo

First off, thank you for providing valuable suggestions.

Alas, no success yet.

Here is what I did:

I successfully installed moodle via cli (great option).

Then I edited config.php to reflect the suggested changes:
However, when I opened the site moodle.mydomain.com I got the following message:
"Reverse proxy enabled, server can not be accessed directly, sorry."

When I disable the line
#$CFG->reverseproxy = true;
moodle does offer links to go to main content or log in, but they cause error 404 (not found).

I'm not sure what you mean by
> Then, if everything will work, look for backend site IP/Hostname refs into the config SQL table and change them accordingly.

As I understand it, I have to make sure the database doesn't reflect the local address I used for the install (192.168.x.x)

and use https://moodle.mydomain.com instead.

I'm sure I could have used some search and replace sql command, but the "mdl_config" table you mention showed no references.

That's why I dumped the database + reimported the edited .sql file, which adapted '3 references on 3 lines'.

Long story short: moodle still throws a 404 after adapting the database.

FWIF, here are the details how I went about it:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

--> dumping + editing the database:

mysqladmin -u root -p moodle-db > moodle.sql
vi moodle.sql
:%s/http\:\/\/192\.168\.x\.x/https\:\/\/moodle\.mydomain\.com/g
--> 3 substitutions on 3 lines.

--> dropping the original database + re-importing the edited one:

mysqladmin -u root -p drop moodle-db
mysqladmin -u root -p create moodle-db
mysql -u root -p
use moodledb;
grant all on moodledb.* to 'moodle'@'localhost' identified by 'my_pass';
quit
mysql -u root -p --default_character_set utf8 moodle-db < moodle.sql
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Average of ratings: -

Re: HaProxy: Moodle complains about not running via SSL though it does

by Fernando Navarro Páez - Wednesday, March 11, 2020, 4:14 PM

Hi!

My haproxy config with a standard moodle installation. I hope could help:

#haproxy.cfg

frontend ft_moodle

bind <PUBLIC_IP>:80

bind <PUBLIC_IP>:443 ssl crt-list /etc/ssl/crt-list.txt #multiple ssl certificates

mode http

option httplog

acl letsencrypt-acl path_beg /.well-known/acme-challenge/

acl https_request-acl dst_port 443

use_backend letsencrypt-local-backend if letsencrypt-acl

use_backend bk_moodle_443 if https_request-acl

default_backend bk_moodle_80

backend bk_moodle_80

mode http

http-request set-header Client-IP %[src]

server moodleServer <SERVER_IP>:80 check

backend bk_moodle_443

mode http

http-request set-header Client-IP %[src]

server moodleServer <SERVER_IP>:443 ssl check verify none

backend letsencrypt-local-backend

mode http

server letsencrypt 127.0.0.1:8888

Salu2
Fernando

Average of ratings:Useful (1)

Re: HaProxy: Moodle complains about not running via SSL though it does

by ray charles - Thursday, March 12, 2020, 12:27 AM

Hey Fernando

Thanx for your input. It made me look at my HaProxy ACLs.-

For the record:
I'm running several sites via HaProxy as a part of Pfsense firewall,
including Acme certificates. They're all functional and they all use similar redirects. (see further down)

I think I may have identified the problem:
Moodle's start page, which opens up OK, is at https://moodle.my_site.com/moodle/
The login page link, however, has URL https://moodle.my_site.com/login/index.php
--> the subfolder is missing.

I'll take another shot at the cli install.
I hope there's a way of settling the prob there.

BTW: Here's the relevant HaProxy rule extract:

Action: http-request redirect
Conditional ACLs: ifroot_moodle acl2
rule: location /moodle/

Average of ratings: -

Re: HaProxy: Moodle complains about not running via SSL though it does

by ray charles - Wednesday, March 18, 2020, 9:24 PM

Hi Fernando

I've finally gotten around to repeating the CLI install, which concluded successfully.

I then appended two lines in config.php
$CFG->reverseproxy = true;
$CFG->sslproxy = true;

as Matteo suggested.
BTW: Changing $CFG->wwwroot to reflect https://
does not work. It triggers a redirect loop (probably because I'm behind Cloudflare CDN)

The site is publicly available under https://moodle.12bfree.com

However, there is no way of logging in.
I even reset the admin password, just in case.., but to no avail.

After a login attempt the page seemingly refreshes and keeps showing the login prompt.

I'm out of ideas.
Any advice?

- - - - - - - - - - - - - - - - - - -

Additional information:
- apache2 on the backend vm has the site's config at port 80,
- I have got other sites working with a very similar configuration,
e.g.: lime.12bfree.com or nc.12bfree.com

Average of ratings: -

Re: HaProxy: Moodle complains about not running via SSL though it does

by ray charles - Thursday, March 19, 2020, 4:47 PM

SUPPLEMENT:
Had the "$CFG-> lines" underneath "require_once(__DIR__ . '/lib/setup.php');"
Apparently, they must be above.

Here is what I got:
--------------------------
with
$CFG->sslproxy = true;
I get
Coding error detected, it must be fixed by a programmer: Must use https address in wwwroot when ssl proxy enabled!

With
$CFG->reverseproxy = true;
I get
Reverse proxy enabled, server can not be accessed directly, sorry.
Please contact server administrator.

With
$CFG->loginhttps=false;
moodle URL open up alright, but login won't budge.

Question: Does anyone see a solution apart from installing a pre-SSL version?

After all, it would seem that Moodle just won't operate properly in a safe environment here..

Average of ratings: -

Re: HaProxy: Moodle complains about not running via SSL though it does

by ray charles - Monday, March 23, 2020, 5:16 PM

Hi Fernando

Sorry to bother you, but still no luck in properly running moodle. -

Meanwhile I've changed the apache port to 443 in the backend vm.
The site is accessible as it was before.
But moodle's password field still declares: "This connection is not secure"

Take a look here if you like
https://moodle.12bfree.com

Any ideas?

Thx Ray

p.s.:
moodle runs
- behind Cloudflare CDN
- via HaProxy on pfsense
- equally configured sites, e.g. nextcloud work as expected.

Average of ratings: -

Re: HaProxy: Moodle complains about not running via SSL though it does

by Matteo Scaramuccia - Monday, March 23, 2020, 6:16 PM

Hi Ray,

But moodle's password field still declares: "This connection is not secure"

spare time is limited - the reason why I didn't reply yet - but clicking on the link and looking at the source of the home of your Moodle instance shows me:

<html  dir="ltr" lang="en" xml:lang="en">
<head>
    <title>12bfree.com - moodle</title>
    <link rel="shortcut icon" href="http://moodle.12bfree.com/theme/image.php/boost/theme/1584533477/favicon" />
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="keywords" content="moodle, 12bfree.com - moodle" />
<link rel="stylesheet" type="text/css" href="http://moodle.12bfree.com/theme/yui_combo.php?rollup/3.17.2/yui-moodlesimple-min.css" /><script id="firstthemesheet" type="text/css">/** Required in order to fix style inclusion problems in IE with YUI **/</script><link rel="stylesheet" type="text/css" href="http://moodle.12bfree.com/theme/styles.php/boost/1584533477_1/all" />
<script type="text/javascript">
...

you need to put https:// in your $CFG->wwwroot: Moodle can't be exposed using both http:// and https://, regardless the HTTP access configuration (web server, CDN, reverse proxy, ..., whatever) would allow it.

HTH,
Matteo

Average of ratings: -

Re: HaProxy: Moodle complains about not running via SSL though it does

by ray charles - Tuesday, March 24, 2020, 5:49 PM

Hi Matteo
No matter. Thanks for your time and your valuable input. -

Looks like I've done everything correctly concerning the entries in config.php then.
Anyhow, here are the error messages they trigger:

$CFG->wwwroot = 'https(...) --> "site isn't redirecting properly" (=redirect loop, no way of accessing the site)
$CFG->sslproxy = true; --> Coding error detected (...)
$CFG->reverseproxy = true; --> (...) server can not be accessed directly, sorry.

Here is something interesting:
When installed via browser* calling https://(...), moodle thinks there's a change in IP-address during install resulting in:
"install error: Installation must be finished from original IP-adress." -->
https://docs.moodle.org/30/en/error/admin/installhijacked

(* explicitly NOT CLI, as it says in the 'installkhijacked' error description)

BTW: I don't see http URLs in the sources of other sites of mine, which are also behind HaProxy.

Average of ratings: -

Re: HaProxy: Moodle complains about not running via SSL though it does

by ray charles - Sunday, March 29, 2020, 10:23 PM

SOLVED. -

I finally have a functional installation.
Here is what I did:

- set haproxy port back to 80 (had experimented with it)
- changed the git branch from 38 to 37.
- completed php admin/cli/install.php (using https:/<site.TLD>
- edited config.php + put "$CFG->ssl-proxy = true;" in the line above $CFG->www-root
- chmod www-data:root config.php (was root:root after cli install)

voila.

Thanks for your thoughts,

Ray

Average of ratings:Useful (1)

Re: HaProxy: Moodle complains about not running via SSL though it does

by Matteo Scaramuccia - Monday, March 30, 2020, 12:55 AM

Hi Ray,
do you mean that Moodle 3.8 (latest) is not compatible with the same scenario that works with Moodle 3.7 (latest)?
That should be filed into the Tracker as a bug, if you can describe there the exact steps to replicate it - kind of summary of what written in this thread.

edited config.php + put "$CFG->ssl-proxy = true;" in the line above $CFG->www-root

Do you mean that you edited config.php just to add the new line $CFG->ssl-proxy = true;?

BTW any CLI command should run under the same user of the web server i.e. www-data in your case: https://docs.moodle.org/38/en/Administration_via_command_line#Running_CLI_scripts .

TIA,
Matteo

Average of ratings: -

Re: HaProxy: Moodle complains about not running via SSL though it does

by ray charles - Monday, March 23, 2020, 6:05 PM

Hi Matteo

I've just re-read your suggestion. -
I might have misinterpreted something here..

Is it mandatory that I edit config-dist.php before installation,
or is it OK to change config.php after installation (because that's what I did)

Thanks, Ray

Average of ratings: -

Re: HaProxy: Moodle complains about not running via SSL though it does

by Matteo Scaramuccia - Monday, March 23, 2020, 9:14 PM

Hi Ray,

Is it mandatory that I edit config-dist.php before installation,
or is it OK to change config.php after installation (because that's what I did)

config-dist.php is just a "quick and dirty summary/manual" about what you could configure in your config.php file; it's not a template used during the first installation i.e. any change done there is never used by Moodle at any stage.

You could change your config.php just after the very first installation of your Moodle instance; that is the file from where you can configure the Moodle instance.

HTH,
Matteo

Average of ratings: -

Security and privacy

HaProxy: Moodle complains about not running via SSL though it does