Upgrade to RHEL 8.6 and Foreman 3.3 - /pub directory returning 404 and not listing anything

Support
21

Hi gvde,
Below is the output from the httpd service details:

systemctl status httpd
● httpd.service - The Apache HTTP Server
   Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
   Active: active (running) since Tue 2022-07-05 15:38:24 PDT; 1 day 18h ago
     Docs: man:httpd.service(8)
 Main PID: 381976 (httpd)
   Status: "Total requests: 32289; Idle/Busy workers 100/0;Requests/sec: 0.21; Bytes served/sec:  63 B/sec"
    Tasks: 37 (limit: 205511)
   Memory: 32.6M
   CGroup: /system.slice/httpd.service
           ├─381976 /usr/sbin/httpd -DFOREGROUND
           ├─477686 /usr/sbin/httpd -DFOREGROUND
           └─483838 /usr/sbin/httpd -DFOREGROUND

Jul 05 15:38:24 foreman systemd[1]: Starting The Apache HTTP Server...
Jul 05 15:38:24 foreman systemd[1]: Started The Apache HTTP Server.
Jul 05 15:38:24 foreman httpd[381976]: Server configured, listening on: port 80, port 443

As per the logs, the only thing I see all over is the following:

AH01092: no HTTP 0.9 request (with no host line) on incoming request and preserve host set forcing hostname to be foreman.localdomain for uri /
22

Anyone knows if there is a workaround to get this working?

23

This seems to be intended behavior since 3.3. Default apache modules have been removed in the latest version. See https://github.com/theforeman/foreman-installer/pull/754

As part of that it seems mod_autoindex.so is not loaded anymore, which leads to a 404 on /pub/ because there is nothing providing an directory index. That’s why you can download any file in the directory but can’t see the index.

You can temporarily load and configure mod_autoindex but that will probably disappear during the next foreman-installer run.

@wbclark @ekohl Is it intended to disable the directory index on /pub/ or should mod_autoindex be loaded and configured by default?

24

Thank you gvde, I thought I was loosing my mind when I upgraded to 3.3.,
perhaps I missed this in the release notes. Thank you again.

25

Well, you won’t find it in the release notes’ list of enhancements unless you know what you are looking for. I think this is an unexpected side effect of that change that nobody considered and the autoindex may well come back soon.

26

I tend to agree that the missing directory listing might be unexpected. I’ll talk to the rest of the installer team if that is an intentional change or not.

27

I don’t think it was intended. I think a temporary workaround is using custom-hiera.yaml

apache::default_mods:
  - autoindex

This was in fact one goal I had (but not sure I ever wrote it down). You can now enable everything in apache::mod::* this way, including mod_status.

Anyway, I think the fix is:
https://github.com/theforeman/puppet-foreman_proxy_content/pull/422

1 Like
28

Thank you Team for the fix, its all working now.

29

Note, mod_autoindex.so is generally considered a security risk, so it should not be part of the default configuration.

30

Noted viwon, at least is an option for those of us that regularly use the index capability . Thank you again for keeping us secured.

31

@ekohl @wbclark

I got my listing working, but whenver I try to wget a file from it, for instance " [katello-ca-consumer-latest.noarch.rpm]" I keep getting failure with the following output:

##################################################################

The page you were looking for doesn’t exist.

You may have mistyped the address or the page may have moved.

If you are the application owner check the logs for more information.

32

Hard to say what’s the problem. Is there anything in /var/log/httpd? Are you accessing it over HTTP or HTTPS (shouldn’t matter, but good to know)? Any SELinux denials perhaps?

33

@ekohl @wbclark

This box doesnt have SELINUX enable, compeltely disable.

This is what I am observig in the foreman-ssl_access_ssl.log

[29/Jul/2022:09:33:30 -0700] "GET /katello-ca-consumer-latest.noarch.rpm HTTP/1.1" 404 1564 "http://foreman.local.domain/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36"
34

I am also observing a similar behavior across the proxies, see below errors:

[29/Jul/2022:09:29:16 -0700] "GET /katello-ca-consumer-latest.noarch.rpm HTTP/1.1" 404 196 "http://proxy1.localdomain/pub" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36"
35

@ekohl @wbclark

I think I have an idea, by looking at the logs I can see the gets are actually trying to get the files from the /pub directory, but the reference files inside that path have all the FQDN without the appended /pub to their name, this is resulting in 404.

Reference:

Trying to get file from foreman.loca.domain/pub (the files are there and visible)

but when I try to wget the files using the URL, the files inside /pub are showing without the trailing /pub

Now, how do I tell apache to append the /pub reference to all the files that are in there. Hope that makes sense, sorry if I caused more confusion.

36

If you explicitly wget the URL including /pub, does it retrieve? Is the autoindex generating incorrect URLs?

37

Yes, if I append the /pub it retrive the files without issues. I am not sure why the files under /pub are getting the FQDN without /pub append to them…clues?

38

Any updates on how to make my files under /pub to show with /pub appended to the links instead of being return with /

PLease advise.

39

@ekohl / @wbclark

See below how my files are showing under /pub

https://foreman.local.domain/katello-ca-consumer-latest.noarch.rpm

As you can see /pub is missing from the files, when I tried download it comes back with 404, but if I adjust the URL it downloads the file fine. Clues?

40

I can reproduce this. I’m not sure what triggers it, but the workaround is to go to /pub/ instead of /pub. Then the paths are correct.