Issue apache2 proxy target - wrong ip-address

[Jan]

Server operating system version

Debian 12

Plesk version and microupdate number

18.0.62 Update #1

Hi folks,

I just went to Debian 12 (formerly Debian 10) by restoring a plesk update in my new server. It appears like there's a problem with sites proxying to apache2. This results in http-500 for end-users

nginx logs

jluehr.de, request: "GET /favicon.ico HTTP/2.0", upstream: "https://82.165.242.31:7081/favicon.ico", host: "plesk.jluehr.de", referrer: "https://plesk.jluehr.de/"[/CODE

But apache is on localhost:

[CODE]
# netstat -tulpen | grep apache2
tcp        0      0 127.0.0.1:7082          0.0.0.0:*               LISTEN      0          22655      1025/apache2       
tcp        0      0 127.0.0.1:7081          0.0.0.0:*               LISTEN      0          22634      1025/apache2       
tcp        0      0 127.0.0.1:7080          0.0.0.0:*               LISTEN      0          22632      1025/apache2

This makes hardly any sense to me.
Of course, it is fine to bind apache2 to localhost - due to proxying it makes no sense to expose it. However, it looks weired that nginx tries an encrypted connection to apache2 on the same host using TLS and its external ip-address - non-tls on 127.0.0.1 would be more appropiate, I think.

I don't really understand how this is meant to be - but - how can I make plesk to align these ports?
Regenerating the config files using plesk repair web doesn't help. I haven't changed anything here.

Thanks, Jan

 

[mow]

Of course, it is fine to bind apache2 to localhost - due to proxying it makes no sense to expose it. However, it looks weired that nginx tries an encrypted connection to apache2 on the same host using TLS and its external ip-address - non-tls on 127.0.0.1 would be more appropiate, I think.

External ip was the default not very long ago, so you might have a mixture of old and new settings there.

 

[Jan]

External ip was the default not very long ago, so you might have a mixture of old and new settings there.

Hi,

thanks, that sounds reasonable.

Do you know where I can change the settings?

Thanks, Jan

 

[mow]

plesk bin apache --listen-on-localhost <true|false>
switching it around a bit should make it consistent again

see also Resolved - SECURITY - attack surface : ports 7080 and 7081

 

[Jan]

Updated: Your idea made the server running, again.
Yet, it - IMHO - it is a bug in plesk that restoring the backup resulted in a broken webserver-configuration.

 

[cmaxwell]

Confirming that this issue still exists today - we just restored a backup to a new machine and the site was broken with a 502 Bad Gateway error occurring constantly and the following error being logged in the Nginx error log file:

72153#0: *171 connect() failed (111: Connection refused) while connecting to upstream

Running the following command as suggested above fixed the issue:

plesk bin apache --listen-on-localhost false