NGINX with Reverse Proxy and CSF settings

SPDTeam

• August 03, 2023 04:51

Hi all I've recently installed NGINX with Reverse Proxy successfully. The server had ConfigServer Security & Firewall (CSF) installed previous to this and I'm wondering are there any CSF setting that should be changed? For example the lfd average high load emails include an Apache status attachment. This usually shows the Apache status at the time of the high load, but when I open it now it shows error " Unable to retrieve Apache Server Status [

• 

  cPRex Jurassic Moderator

  • August 03, 2023 16:27

  Hey there! No, there are no settings in CSF that need to be adjusted when you install Nginx. I'm aware that LiteSpeed doesn't work with the Apache status as we have that documented here, but nginx should work normally. I am not able to reach

  0
• 

  SPDTeam

  • August 04, 2023 14:31

  Hey there! No, there are no settings in CSF that need to be adjusted when you install Nginx. I'm aware that LiteSpeed doesn't work with the Apache status as we have that documented here, but nginx should work normally. I am not able to reach . With description "This is the Apache Server Status URL used in the email alert. Requires the Apache mod_status module to be installed and configured correctly". This isn't installed on the server but must have been prior to NGINX installation, and mod_status module isn't available via EasyApache. Is this by design?. Another thing I noticed, which may or maynot be related, is CSF System Statistics no longer show any Apache based stats post NGINX installation. This is the same for MUNIN as well.

  0
• 

  cPRex Jurassic Moderator

  • August 04, 2023 17:03

  We do include the "status_module" as a package with Apache that can't be removed. You can see that with "httpd -M | grep status" on the system. This is the same as "mod_status" - mod_status - Apache HTTP Server Version 2.4 So it is normal that you don't see a way to install that since it shouldn't be removed/installed on any server as it just always there. I can confirm that running "curl

  0
• 

  SPDTeam

  • August 07, 2023 09:21

  We do include the "status_module" as a package with Apache that can't be removed. You can see that with "httpd -M | grep status" on the system. This is the same as "mod_status" -
  Running "httpd -M | grep status" I get "status_module (shared)". Running "curl 403 Forbidden

  403 Forbidden

  ---

  nginx

  0
• 

  quietFinn

  • August 07, 2023 11:13

  I'd suggest that you check /etc/apache2/logs/error_log & /etc/apache2/logs/modsec_audit.log, you might see why that 403 error is given,

  0
• 

  cPRex Jurassic Moderator

  • August 07, 2023 12:21

  Like @quietFinn said, this confirms the issue isn't with the module or with CSF, but there is something blocking that status page on the server.

  0
• 

  SPDTeam

  • August 07, 2023 16:42

  Like @quietFinn said, this confirms the issue isn't with the module or with CSF, but there is something blocking that status page on the server.

  
  Figure out what the cause was, should have realised. When NGINX with Reverse Proxy is installed it updates the Apache to new default ports. i.e. 80 to 81 and 443 to 444, etc. Changing the PT_APACHESTATUS setting in CSF to include the new port resolved the issue. This also fixed the the CSF System Statistics Apache based stats as well. Munin is still not showing Apache stats but assume its a similar issue. Just need to find the right config file.

  0
• 

  nwd

  • September 30, 2023 21:24

  Great catch @SPDTeam. Heres the detailed steps to resolve this issue for others.

  • Go to WHM > ConfigServer Security & Firewall > Firewall Configuration
  • Find and Edit PT_APACHESTATUS URL
    • Update URL to
  • Restart CSF/LFD

  0

Please sign in to leave a comment.