Apache Reverse Proxy with SSL and WebSockets on RHEL/CentOS: Full Configuration

Here’s the configuration I use to run Apache httpd as a reverse proxy in front of a back-end service, with SSL termination and WebSocket support, on a Red Hat-family server.

1. Load the Proxy Modules

Edit the proxy module config:

vi /etc/httpd/conf.modules.d/00-proxy.conf

Make sure these modules are loaded:

# Load necessary modules
LoadModule rewrite_module modules/mod_rewrite.so
LoadModule ssl_module modules/mod_ssl.so
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so

# Load lbmethod modules
LoadModule lbmethod_bybusyness_module modules/mod_lbmethod_bybusyness.so
LoadModule lbmethod_byrequests_module modules/mod_lbmethod_byrequests.so
LoadModule lbmethod_bytraffic_module modules/mod_lbmethod_bytraffic.so
LoadModule lbmethod_heartbeat_module modules/mod_lbmethod_heartbeat.so

# Load additional proxy modules
LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
LoadModule proxy_connect_module modules/mod_proxy_connect.so
LoadModule proxy_express_module modules/mod_proxy_express.so
LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so
LoadModule proxy_fdpass_module modules/mod_proxy_fdpass.so
LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
LoadModule proxy_hcheck_module modules/mod_proxy_hcheck.so
LoadModule proxy_scgi_module modules/mod_proxy_scgi.so
LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so

2. Create the Site’s VirtualHost

Edit your site’s config file:

vi /etc/httpd/sites-enabled/service.domainname.com.conf

Replace the host name, certificate paths, and backendserverIP:portnumber with your own values. The rewrite rules send WebSocket upgrade requests to the back end over ws://; everything else goes through ProxyPass.

<VirtualHost *:443>
ServerName service.domainname.com

SSLEngine on
SSLCertificateFile /etc/pki/tls/certs/yourcert.crt
SSLCertificateKeyFile /etc/pki/tls/private/yourprivatekey_privatekey.key
SSLCertificateChainFile /etc/pki/tls/certs/bundle.crt

RewriteEngine on
RewriteCond %{HTTP:Upgrade} =websocket [NC]
RewriteCond %{HTTP:Connection} upgrade [NC]
RewriteRule /(.*) "ws://backendserverIP:portnumber/$1" [P,L]

ProxyPreserveHost On
ProxyPass / http://backendserverIP:portnumber/
ProxyPassReverse / http://backendserverIP:portnumber/

ErrorLog /var/log/httpd/service.domainname.com/error.log
CustomLog /var/log/httpd/service.domainname.com/access.log combined
</VirtualHost>

3. Restart Apache

Restart httpd and test your new site. Related: Apache security headers for an A+ rating.

How to Enable SNMP on a Raspberry Pi (snmpd Setup)

Here’s how to enable SNMP on a Raspberry Pi so your monitoring system can poll it.

1. Install snmpd

sudo apt-get update
sudo apt-get upgrade -y
sudo apt-get install snmpd -y
sudo apt-get install snmp -y

2. Edit snmpd.conf

To get it running, edit the configuration file:

sudo nano /etc/snmp/snmpd.conf

First, comment out this line so the agent doesn’t listen only on localhost:

#agentAddress  udp:127.0.0.1:161

Below the line #agentAddress udp:161,udp6:[::1]:161, add:

agentAddress udp:161

Then, below the line rocommunity public localhost, add a read-only community for your network (replace the subnet with your own):

rocommunity public 190.0.10.0/24

3. Restart the Service

sudo service snmpd restart

Related: enabling SNMP on VMware ESXi 6.5.

How to Install the Check_MK Agent on Debian Linux

Installing the Check_MK agent on Debian Linux takes just two steps. Replace %yourcheck_mk_server% with the address of your Check_MK server.

1. Install xinetd

The Check_MK agent requires xinetd:

apt-get install xinetd

2. Download and Install the Agent Package

Download the latest Check_MK agent installer from your Check_MK site and install it:

cd /tmp/
wget http://%yourcheck_mk_server%/download/check-mk-agent_***.deb
dpkg -i check*

On Red Hat or CentOS instead? See installing the Check_MK agent on Red Hat Linux.

How to Enable SNMP on VMware ESXi 6.5 with esxcli

To enable SNMP on a VMware ESXi 6.5 host, connect to it with your favorite SSH client (I use PuTTY) and run the following commands:

esxcli system snmp set --communities public
esxcli system snmp set --enable true
esxcli network firewall ruleset set --ruleset-id snmp --allowed-all true
esxcli network firewall ruleset set --ruleset-id snmp --enabled true
/etc/init.d/snmpd restart

What each step does:

  • Sets the SNMP community string (replace public with your own).
  • Enables the SNMP agent.
  • Allows all IPs through the ESXi firewall’s SNMP ruleset, then enables that ruleset.
  • Restarts the SNMP service so the changes take effect.

If you copy these commands, make sure the options begin with two hyphens (--), not a single dash. Related: enabling SNMP on a Raspberry Pi.

How to Add a New Disk to LVM on CentOS (parted, pvcreate, vgcreate, lvcreate)

You can create an LVM physical volume directly on a raw block device, but I avoid it. It can cause confusion later about what the disk is used for, and it can break some of LVM’s auto-discovery if its configuration files are missing. Instead, I put a single LVM partition on each disk first.

1. Partition the Disk with parted

This creates a GPT label with one partition spanning the whole drive and sets the LVM flag. The 1M start offset ensures proper alignment. mkpart requires a filesystem type, but it doesn’t actually create a filesystem (a long-standing parted quirk).

parted /dev/sdb
mklabel GPT
mkpart primary ext2 1M 100%
set 1 lvm on
quit

2. Create the Physical Volume, Volume Group, and Logical Volume

pvcreate /dev/sdb1
pvdisplay
vgcreate vg_name /dev/sdb1 /dev/sdc1 /dev/sdd1
vgdisplay
lvcreate --extents 100%FREE -n lv_name vg_name
lvdisplay

The vgcreate example combines three prepared disks (sdb1, sdc1, sdd1) into one volume group. Replace vg_name and lv_name with your own names.

3. Create the Filesystem and Check It

mkfs.xfs -f /dev/mapper/vg_name-lv_name
df -ah

To grow an existing volume instead, see how to extend an LVM logical volume on CentOS.

Replace sysklogd with rsyslog on CentOS and Forward Logs to Splunk

Older CentOS servers use sysklogd, which can’t forward logs over TCP with a disk queue. Here’s how to swap it for rsyslog and send everything to Splunk.

1. Swap sysklogd for rsyslog

Use yum shell to remove and install in one transaction:

yum shell
remove sysklogd
install rsyslog
run
exit

2. Add the Splunk Forwarding Rule

Edit /etc/rsyslog.conf and paste in this block, replacing your-splunk-server with your Splunk host:

# ### begin forwarding rule ###
# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
$WorkDirectory /var/lib/rsyslog # where to place spool files
$ActionQueueFileName fwdRule1 # unique name prefix for spool files
$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
$ActionQueueType LinkedList # run asynchronously
$ActionResumeRetryCount -1 # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
*.* @@your-splunk-server:514
# ### end of the forwarding rule ###

3. Enable and Restart rsyslog

chkconfig rsyslog on
service rsyslog restart

See also forwarding CentOS syslog to Splunk with rsyslog.

Fix iSCSI Latency on Dell R815 with Broadcom NICs in VMware ESXi

Our new Dell PowerEdge R815 hosts had strange latency on iSCSI traffic running over Broadcom NICs on a dedicated, segregated storage LAN.

The Fix: Update the Broadcom NetXtreme II Driver

The solution was the updated Broadcom NetXtreme II driver bundle:

BCM-NetXtremeII-5.0-offline_bundle-940344.zip
  1. Import the offline bundle into VMware Update Manager.
  2. Attach it to the hosts in a baseline and remediate.
  3. Reboot each host.

After one reboot, the latency was gone and everyone was happy.

How to Add a Persistent Cron Job on a VMware ESX/ESXi Host

On VMware ESX/ESXi, changes to the root crontab are lost when the host reboots. Here’s how to add a cron job that survives reboots by re-creating it from /etc/rc.local.

Enable SSH on the host first, then log in as root.

1. Add the Job to the Root Crontab

  1. Edit /var/spool/cron/crontabs/root.
  2. Add your job on a single line, for example:
5 0 * * * /full/path/to/script arguments/with/full/path > /full/path/to/logfile 2>&1
  1. The file is read-only, so save and quit vi with Esc then :wq!.

5 0 * * * means 5 minutes past midnight every day. See the crontab(5) man page for the full schedule syntax.

2. Re-create the Job at Boot via /etc/rc.local

Edit /etc/rc.local (for example, vi /etc/rc.local) and add these three lines at the end. The first stops crond, the second appends your job to the root crontab, and the third starts crond again:

/bin/kill $(cat /var/run/crond.pid)
/bin/echo '5 0 * * * /full/path/to/script arguments/with/full/path > /full/path/to/logfile 2>&1' >> /var/spool/cron/crontabs/root
/bin/busybox crond

Save and exit, then run the command below so your /etc/rc.local change itself survives a reboot:

auto-backup.sh

Remember: every time you change the cron job, update /etc/rc.local too and run auto-backup.sh again.

Enable Apache mod_rewrite (AllowOverride All) for WordPress Permalinks

If WordPress “post name” permalinks return 404 errors on an Apache server, Apache probably isn’t allowing the .htaccess rewrite rules WordPress depends on. The fix is a one-line change.

Steps

  1. Open the Apache configuration file at /etc/httpd/conf/httpd.conf.
  2. Find the Directory block for your DocumentRoot, normally <Directory "/var/www/html">.
  3. Change AllowOverride None to AllowOverride All.
  4. Restart Apache.
<Directory "/var/www/html">
    AllowOverride All
</Directory>
service httpd restart

This step is essential for WordPress post name permalinks to work.

How to Set Up MySQL and Apache for WordPress on CentOS

Before installing WordPress on a CentOS server, you need a web server, PHP, and a MySQL database with a dedicated user. Here’s the quick setup I use.

1. Install MySQL and Apache

yum install mysql
yum install mysql-server
chkconfig mysqld on
service mysqld start
sudo yum install php-gd
yum install httpd
chkconfig httpd on
service httpd start

2. Create the WordPress Database and User

Open the MySQL client and create a database, then grant a user full rights on it. Replace databasename, username, hostname, and password with your own values:

$ mysql
Welcome to the MySQL monitor.  Commands end with ; or \g.
Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> CREATE DATABASE databasename;
Query OK, 1 row affected (0.00 sec)

mysql> GRANT ALL PRIVILEGES ON databasename.* TO "username"@"hostname"
    -> IDENTIFIED BY "password";
Query OK, 0 rows affected (0.00 sec)

mysql> FLUSH PRIVILEGES;
Query OK, 0 rows affected (0.01 sec)

mysql> EXIT
Bye

Use these database details in wp-config.php when you install WordPress. For pretty permalinks, also enable mod_rewrite in Apache.