Hi
@HostaHost, hi everyone,
I tried to help with the unix socket question from post #21 and ran a few tests on a small test box. Quick disclaimer first: it's plain Apache 2.4.58 on Ubuntu 24.04, no Plesk, so no mod_proxy_lock. As far as I can tell the module isn't publicly available and I couldn't find any docs or release note entry for it. Everything I say about the module itself comes from this thread only, and I'll point to the post numbers.
What I tested (stock Apache, backend listening on a unix socket, no mod_proxy_lock involved):
- ProxyPass / "unix:<SOCKET_PATH>|
http://localhost/" at vhost level: works
- the same with
http://127.0.0.1/ (that's the form from post #21): works
- ProxyPass / ProxyPassReverse inside <Location />: works
- SetHandler "proxy:unix:<SOCKET_PATH>|
http://localhost/": in my test the backend got the filesystem path (/var/www/html/x) instead of the request URI. So for an http backend I'd stick to ProxyPass; SetHandler is the right tool for fcgi, as in your working example.
So the syntax in #21 is fine on plain Apache. If it's still refused with ProxyLockSocket set, the difference has to come from the module's handling. I can't tell more than that.
What the thread says (staff and users):
- ProxyLockSocket only accepts "none" or an absolute unix socket path (error message in #14 and #19). That's why the ajp:// line from #3 gets rejected.
- A later ProxyLockSocket overrides an earlier one, and it can be set in directory scope, e.g. <Location> (#9, #13).
- http(s) proxies are intentionally allowed (#20), which matches what Fede saw in #19.
- A fix for AJP is planned for the next update, and mizar offered an RPM for AlmaLinux (#16, #20).
Things you could try. I could not test these against the module, so please treat them as ideas:
1) First look at what exactly gets refused, it shows which address the module checks:
Code:
grep "proxy_lock" /var/www/vhosts/system/<DOMAIN>/logs/error_log | tail
2) For the unix socket + http case, set both directives in directory scope (based on #9 and #13):
Code:
<IfModule mod_proxy_lock.c>
ProxyLockSocket "<SOCKET_PATH>"
</IfModule>
<Location />
ProxyPass "unix:<SOCKET_PATH>|http://localhost/"
ProxyPassReverse "unix:<SOCKET_PATH>|http://localhost/"
</Location>
3) For AJP/Tomcat, the HTTP connector instead of AJP should work according to #19 and #20:
Code:
ProxyPass / http://127.0.0.1:<TOMCAT_HTTP_PORT>/
ProxyPassReverse / http://127.0.0.1:<TOMCAT_HTTP_PORT>/
ProxyPreserveHost On
Two questions for
@mizar, if you have a minute:
- Is the unix socket + ProxyPass + http combination from #21 expected to be allowed with ProxyLockSocket, and if so, in which scope?
- The error message mentions "none" as a valid value. What does it do exactly, and is it meant to be used per domain or location?
One more thing: the official change log for Update 7 only says it addresses a critical security issue, that the web server vhost templates changed, and that the configs of all domains get regenerated. If you use custom vhost templates, it's worth checking them after the update.
Hope this helps a bit!
Regards
Tessa
Facebook
Twitter
