IspConfig 3.1.x Webinterface at subdomain on port 443

Discussion in 'Tips/Tricks/Mods' started by Pappmann, Mar 1, 2017.

  1. Pappmann

    Pappmann New Member

    Is there any working solution to use IspConfig 3.1x Webinterface on port 443 via subdomain?

    I´m using IspConfig on a debian 8 server.
     
  2. ahrasis

    ahrasis Well-Known Member HowtoForge Supporter

    Did you choose port 443 during ISPC installation?
     
  3. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    The other option is to setup a vhost and proxy port 443 to 8080 or whatever you have ispconfig running on. But if you have a dedicated host for the control panel, certainly the easiest way is just that (specify port 443 in the ispconfig installation).
     
  4. k4t

    k4t New Member

    Will SNI work on a host with a single IP and ispconfig on 443?
     
  5. ahrasis

    ahrasis Well-Known Member HowtoForge Supporter

    Mine is using dynamic IP with default ISPC port 8080. So far it works. Though I am not so sure about running it via port 443, my guess is, it should work just fine.
     
  6. till

    till Super Moderator Staff Member ISPConfig Developer

    Yes. But you will have to set a domain name then in the ispconfig vhost and ensure that there is not a duplicate listen line for 443, as ispconfig assumes to have it's own port, so using 443 during install would cause apache to fail to start due to port 443 defined twice in the apache config.
     
    ahrasis likes this.
  7. Setup a new vhost with apache reverse proxy:
    Code:
    RewriteEngine On
    RewriteCond %{SERVER_PORT} 80
    RewriteRule ^(.*)$ https://YOURCONTROLPANELURL/$1 [R,L]
    
    SSLProxyEngine on
    SSLProxyVerify none
    SSLProxyCheckPeerCN off
    SSLProxyCheckPeerName off
    SSLProxyCheckPeerExpire off
    ProxyPass / https://YOURSERVERNAME:9999/  --> this is your ispconfig port
    ProxyPassReverse / https://YOURSERVERNAME:9999/ --> again your ispconfig port
    
    (add this apache code to the options tab in the domain/subdomain you want to run the control panel)

    replace YOURSERVERNAME with the output of:
    Code:
    root@ ~ # hostname -f
    YOURSERVERNAME
    
     
    Last edited: Oct 2, 2019
    ahrasis, mare, Pappmann and 1 other person like this.
  8. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    Is there an rfe for ispconfig to set this up automatically? This type of solution is pretty frequently needed for various scenarios asked on the forums here, it'd be cool if ISPconfig would set this up.

    Eg. during installation, if the port ispconfig listens on is not 443, prompt for a website/domain name to configure on 443 to proxy the connection. Maybe also expose that as a setting in the main config, to be changed later.
     
  9. Pappmann

    Pappmann New Member

    Okay, thanks...thats working.
     
  10. Pappmann

    Pappmann New Member

    oh, this solution is not working behind a firewall that blocks all ports except 80/443 :(
     
  11. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    The reverse proxy will work fine behind a firewall if the proxy connection is to 127.0.0.1 localhost address like shown, and is in fact one of the ways you could access ispconfig (running on a high port number) in such an environment. If you're trying to put the config sample into a vhost using the ispconfig interface, in order to bring up that very interface, then you would have a bit of a problem, but once it's setup it should work just fine.
     
  12. Pappmann

    Pappmann New Member

    Hello,
    its working now but i cant login, it always show the login screen again and again. If i use port 8080 in browser i can login normaly, after successfull login i can use isp config with port 443.
    Anyone has an idea why i cant login?
     
  13. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    I don't know if it'll fix it, but maybe try clearing your browser cache and cookies.
     
  14. Pappmann

    Pappmann New Member

    That does not help :(
     
  15. thischwa

    thischwa New Member

    Thanx a lot for your post!
    I've the same problem as Pappman, but I've found the reason: For some scripts in the login folder I get the 404 error code, eg. "GET /login/datalogstatus.php HTTP/1.1" 404 511 "https://MYCONTROLPANELURL/login/"

    I've debugged this with the devtools of firefox and found out that all XMLHttpRequests has this problem. Is there anybody who has an hint for me, how to rewrite these kinds of requests?
     
    Last edited: Jul 9, 2018
  16. till

    till Super Moderator Staff Member ISPConfig Developer

    That's ok and can be ignored. These 404 are always there, so not related to the login problem from Pappman.
     
  17. thischwa

    thischwa New Member

    That's strange.
    To test it, I use an public IP. If I call the login with the IP in the URL, it works as expected. If I call the URL with the proxy in the background, it always shows the login again and again.
    I guess, there is something wrong with the proxy settngs ...
    Any hints for me, who to analyse and fix it?
     
  18. mare

    mare New Member

    Hi,
    i run into the same issue when using the proxy.
    I found out that the response cookie was assigned to "127.0.0.1".
    Replacing 127.0.0.1 with the hostname fix this problem and I was able to login into the panel using the proxy method.

    -ProxyPass / https://127.0.0.1:9999/ --> this is your ispconfig port
    -ProxyPassReverse / https://127.0.0.1:9999/ --> again your ispconfig port
    +ProxyPass / https://DOMAINNAME:9999/ --> this is your ispconfig port
    +ProxyPassReverse / https://DOMAINNAME:9999/ --> again your ispconfig port

    /Mare
     
    ahrasis, Pappmann and till like this.
  19. Pappmann

    Pappmann New Member

    great thanks
     
  20. Chris_UK

    Chris_UK Active Member HowtoForge Supporter

    When I setup I just told ISPC to use ssl on port 8080. I added an A record in my DNS for server1 and used Ahrasis LE script to give it an accepted cert.

    If for some reason ISPC panel shows up on a server1 subdomain for an unintended domain the browser will grumble about the cert and may prevent loading, Something like this in htaccess or the vhost conf file should resolve that.

    Code:
    RewriteEngine On
    RewriteCond %{HTTP_HOST} !^server1.correctdomain.com$ [NC] # if not correct domain
    RewriteRule ^(.*)$ https://server1.correctdomain.com/$1 [L,R] # redirect to correct domain
    
    For the repeated login page part, I had an issue that was related to user permissions, it was fixed by increasing anonymous user block level. I have tried to look for the thread here that pointed to a file to edit, I forget now what the exact search was that brought it up. Maybe til can help as he did reply to that thread.
     
    Last edited: Oct 2, 2019

Share This Page