utm 9 reverse proxy configuration

Question

i want to use the utm 9 virtual webserver protection reverse proxy to protect my nextcloud installation. 
 I have nextcloud with collabora running in docker, and I cant get collabora working. I imported the letsencrypt certificates to the utm, wo the ssl is not a problem. Hase someone an idea on hwo to modify the reverse proxy on the utm to get it working with collabora?

Onno vdL · Answer

Hi,

In case you're talking about the error "AH00026: found %2f (encoded '/') in ... returning 404": That's because Apache by default won't allow this. The solution is to add "AllowEncodedSlashes On" within the vhost config of reverseproxy.conf ; However, this can only done manually. But as soon as you make a change in the GUI, it's overwritten.

Sophos had this feature implemented (according to support) in NUTM-2373, but the removed it again because it was leading to "other issues". The manual change was provided as workaround.

Because I can't ask my customers to call me everytime they make a change in the GUI so I can update the reverseproxy.conf, and I wanted to create a way so my customers can "add" it them self, I've updated the script which (re)starts the reverseproxy service:

=== START PATCH
<M> fw:/var/mdw/scripts # diff -Nura reverseproxy.orig reverseproxy
--- reverseproxy    2018-07-06 11:38:01.464266168 +0200
+++ reverseproxy.new    2018-07-06 13:47:37.722784507 +0200
@@ -35,7 +35,20 @@
     ${APACHE2CTL_LOG}
}

+apache_allowslashes() {
+    grep -q 'PATH "/AllowEncodedSlashes/"' ${CHROOT}/usr/apache/conf/reverseproxy.conf
+    MYRESULT=$?
+
+    if [ ${MYRESULT} -eq 0 ]; then
+        echo "AllowEncodedSlashes found - fixing" | log
+        sed -i 's|WAFExceptions PATH "/AllowEncodedSlashes/" SkipAntiVirus|AllowEncodedSlashes On|g' ${CHROOT}/usr/apache/conf/reverseproxy.conf
+    else
+        echo "AllowEncodedSlashes not found - skipping" | log
+    fi
+}
+
apache_conftest() {
+    apache_allowslashes
     chroot ${CHROOT} ${APACHE2CTL} configtest 2>&1 | log
     if [ $? -ne 0 ]; then
         return 1

=== END PATCH

This way, the only thing my customer has to do when I wants 'AllowEncodedSlashes On' enabled for a virtual server, is create an exception under "Webserver Protection" > Firewall Policies > [Exceptions]. The param of the exception needs to be excluding anti-virus for the path /AllowEncodedSlashes/

That's all! Works like a charm. Only thing to keep in mind is when you update the appliance, you need to check if the start script has been changed and if so, re-apply the patch. And I added the hook right before the actual config test, so when (in any strange way) my hook renders the config invalid, it keeps working because the reload/restart won't be executed.

I hope this is of some help to anyone.

Cheers,
Onno.

Rembik Rain · Answer

Here a summary and extension for a better understanding of Onno vdL's patch. It enables not only to configure AllowEncodedSlashes On , but rather ProxyPass nocanon to proxy services like GitLab through the Sophos UTM. 
 Edit reverseproxy script: 
 fw:/var/mdw/scripts # diff -Nura reverseproxy.orig reverseproxy --- reverseproxy.orig 2020-04-28 20:28:39.536059392 +0200 +++ reverseproxy 2020-04-28 15:39:37.171411346 +0200 @@ -35,7 +35,34 @@ ${APACHE2CTL_LOG} } +apache_allowslashes() { + grep -q 'PATH "/AllowEncodedSlashes/"' ${CHROOT}/usr/apache/conf/reverseproxy.conf + MYRESULT=$? + + if [ ${MYRESULT} -eq 0 ]; then + echo "AllowEncodedSlashes found - fixing" | log + sed -i 's|WAFExceptions PATH "/AllowEncodedSlashes/" SkipAntiVirus|AllowEncodedSlashes On|g' ${CHROOT}/usr/apache/conf/reverseproxy.conf + else + echo "AllowEncodedSlashes not found - skipping" | log + fi +} + +apache_nocanon() { + grep -q '/ProxyPassNocanon/' ${CHROOT}/usr/apache/conf/reverseproxy.conf + MYRESULT=$? + + if [ ${MYRESULT} -eq 0 ]; then + echo "ProxyPassNocanon found - fixing" | log + sed -i 's|/ProxyPassNocanon/" lbmethod|/" nocanon lbmethod|g' ${CHROOT}/usr/apache/conf/reverseproxy.conf + sed -i 's|/ProxyPassNocanon/|/|g' ${CHROOT}/usr/apache/conf/reverseproxy.conf + else + echo "ProxyPassNocanon not found - skipping" | log + fi +} + apache_conftest() { + apache_allowslashes + apache_nocanon chroot ${CHROOT} ${APACHE2CTL} configtest 2>&1 | log if [ $? -ne 0 ]; then return 1 
 Add Firewall Profile Exception for virtual webserver: 
 Edit default Site Path Routing entry for virtual webserver:

Stefan Fröchtenicht · Answer

yes. seem to be a bug. i opend a support ticket and refered to this thread. 
 Case 8145469