logo
Apache Lounge
Webmasters

 

About Forum Index Downloads Search Register Log in RSS X


Keep Server Online

If you find the Apache Lounge, the downloads and overall help useful, please express your satisfaction with a donation.

or

Bitcoin

A donation makes a contribution towards the costs, the time and effort that's going in this site and building.

Thank You! Steffen

Your donations will help to keep this site alive and well, and continuing building binaries. Apache Lounge is not sponsored.
Post new topic   Forum Index -> Apache View previous topic :: View next topic
Reply to topic   Topic: Directory/Alias to Remote Windows File Share
Author
scgsg



Joined: 16 Jul 2015
Posts: 8

PostPosted: Thu 16 Jul '15 14:21    Post subject: Directory/Alias to Remote Windows File Share Reply with quote

We have Apache 2.4.7 on Ubuntu 14.04 Server with PHP 5.5.9.

Hoping someone could point me in the right direction to achieve the following:

How could we create a directory/alias in Apache that will grant access to a remote windows share? That is in IIS its possible to create a Virtual Directory to a windows share and use user authentication to access the virtual directory so users would only be permitted to see what they have access to in the directory. We'd like to replicate this if possible. The server has been joined to our Active Directory domain, which enables us to provide SSO access to Moodle and Joomla using Kerberos.

Any ideas?
Back to top
James Blond
Moderator


Joined: 19 Jan 2006
Posts: 7373
Location: Germany, Next to Hamburg

PostPosted: Fri 17 Jul '15 11:44    Post subject: Reply with quote

For me it works to use https://github.com/YvesR/mod_authn_ntlm
Back to top
scgsg



Joined: 16 Jul 2015
Posts: 8

PostPosted: Fri 17 Jul '15 12:43    Post subject: Reply with quote

Thank you for the advise but that mod doesnt work with Apache on Linux or it didnt for me anyway when I was sorting out SSO for joomla and moodle.

Not sure what I'm asking for is even possible, given that maybe is should try a different route:
1. Maybe use apache reverse ftp proxy to gain access to the servers via ftp (at least give the option to list and get files only). Anyone have any advise on how this could be achieved?

2. Maybe go down the route of some sort of php web client that has access to internal servers?[/list]
Back to top
James Blond
Moderator


Joined: 19 Jan 2006
Posts: 7373
Location: Germany, Next to Hamburg

PostPosted: Fri 17 Jul '15 17:09    Post subject: Reply with quote

Sorry I didn't read the linux ... Embarassed

For sure there is modntlm and Mod auth ntlm winbind for linux, but I haven looked into those modules for a longer time.
Back to top
scgsg



Joined: 16 Jul 2015
Posts: 8

PostPosted: Mon 20 Jul '15 11:36    Post subject: Reply with quote

Think I will have to give up on the idea of trying to replicate whats known as a Virtual Directory (in IIS) to a Share for now as I havent found any documentation on this. That being the case perhaps you can help me on trying to get Mod_proxy_ftp to work.

I know this is going slightly going in a different direction (different soluction to similar outcome) for this thread so would you rather i create another thread?

If its ok to continue, I have the following configured:

ProxyRequests Off

<Proxy *>
Options +Indexes
Order deny,allow
Allow from all
</Proxy>

ProxyPass /ftp ftp://IPtoServer:21/
ProxyPassReverse /ftp ftp://IPtoServer:21/
It seems to attempt to connect to the ftp server but nothing is displayed in the brower i.e. it says page cannot be found (404 error), instead of listing whats in the ftp root.
Back to top
James Blond
Moderator


Joined: 19 Jan 2006
Posts: 7373
Location: Germany, Next to Hamburg

PostPosted: Mon 20 Jul '15 16:54    Post subject: Reply with quote

What does your access log show?
Back to top
scgsg



Joined: 16 Jul 2015
Posts: 8

PostPosted: Tue 21 Jul '15 14:34    Post subject: Reply with quote

Messing around with it and looking into the access log, i get:

192.168.0.1 - Username [21/Jul/2015:13:23:06 +0100] "GET /ftp HTTP/1.1" 200 758 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36"

192.168.0.1 - - [21/Jul/2015:13:23:25 +0100] "GET /ftp HTTP/1.1" 401 690 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36"

Second one is 401 error but to get past username/password dialogue, a valid username and password has to be entered so something further along is denying access. Webserver to ftp server? Any ideas on how to resolve this?
Back to top
ng4win



Joined: 25 May 2014
Posts: 78

PostPosted: Tue 21 Jul '15 15:57    Post subject: Reply with quote

With nginx you run nginx as a user/pass which also exists on the backend, this will allow passthru access to any remote resource. With apache this should be no different.
Back to top
scgsg



Joined: 16 Jul 2015
Posts: 8

PostPosted: Wed 22 Jul '15 9:30    Post subject: Reply with quote

ng4win wrote:
With nginx you run nginx as a user/pass which also exists on the backend, this will allow passthru access to any remote resource. With apache this should be no different.

Any suggestions on how to resolve the issue, which seems to be related to connecting to the ftp server?
Back to top
maba



Joined: 05 Feb 2012
Posts: 64
Location: Germany, Heilbronn

PostPosted: Wed 22 Jul '15 12:21    Post subject: Reply with quote

In your earlier message you mentioned a 404 error. The access_log says you are getting a 401 error. So something seems to be inconsistent.

Did you play around with the / at the end of the URL. When you do a proxy of

/ftp --> ftp://someserver/

then one of the URLs will have a trailing / while the other has not.

I would propose the following experiment:

Proxy
/ftp/ --> ftp://someserver/some_valid_ftp_subdirectory/

Then do a tail on access_log and error_log
Back to top
ng4win



Joined: 25 May 2014
Posts: 78

PostPosted: Wed 22 Jul '15 13:37    Post subject: Reply with quote

scgsg wrote:
Any suggestions on how to resolve the issue, which seems to be related to connecting to the ftp server?

Mount the ftp site as a drive? there are plenty of tools that let you do that, novell use to have one many years ago.
Within a service just create a batchfile service (anysrv), mount the site, start apache.
Back to top
scgsg



Joined: 16 Jul 2015
Posts: 8

PostPosted: Wed 22 Jul '15 15:39    Post subject: Reply with quote

@maba: Yes i originally stated 404 error but after messing around I posted up what i found in the log now which is 401 error. Yes I've tested it with /ftp and /ftp/ etc and still cant get the the server to list the ftp server.

@ng4win: I dont want to create a mount because I want the access to the ftp server to be based on the user that is attempting access. If i create a mount the permission will be based on the connection i create from the apache server to the ftp server.

Its possible that the windows ftp server is rejecting the connection but not sure why, here's what i find in the ftp service log:

2015-07-22 12:55:13 IPofApacheServer - IPofFTPServer 21 ControlChannelOpened - - 0 0 768265ca-56be-49fc-8dd9-4b138bd11297 -
2015-07-22 12:55:13 IPofApacheServer - IPofFTPServer 21 USER anonymous 331 0 0 768265ca-56be-49fc-8dd9-4b138bd11297 -
2015-07-22 12:55:13 IPofApacheServer - IPofFTPServer 21 PASS apache-proxy@ 530 1326 42 768265ca-56be-49fc-8dd9-4b138bd11297 -
2015-07-22 12:55:13 IPofApacheServer - IPofFTPServer 21 ControlChannelClosed - - 0 0 768265ca-56be-49fc-8dd9-4b138bd11297 -
2015-07-22 12:55:27 IPofApacheServer - IPofFTPServer 21 ControlChannelOpened - - 0 0 5d9642d5-aa3e-4e2d-82a5-3971914703e3 -
2015-07-22 12:55:27 IPofApacheServer - IPofFTPServer 21 USER username 331 0 0 5d9642d5-aa3e-4e2d-82a5-3971914703e3 -
2015-07-22 12:55:27 IPofApacheServer domain\username IPofFTPServer 21 PASS *** 230 0 0 5d9642d5-aa3e-4e2d-82a5-3971914703e3 /
2015-07-22 12:55:27 IPofApacheServer domain\username IPofFTPServer 21 EPSV - 229 0 0 5d9642d5-aa3e-4e2d-82a5-3971914703e3 -
2015-07-22 12:55:27 IPofApacheServer domain\username IPofFTPServer 58190 DataChannelOpened - - 0 0 5d9642d5-aa3e-4e2d-82a5-3971914703e3 -
2015-07-22 12:55:27 IPofApacheServer domain\username IPofFTPServer 21 PWD - 257 0 0 5d9642d5-aa3e-4e2d-82a5-3971914703e3 -
2015-07-22 12:55:27 IPofApacheServer domain\username IPofFTPServer 21 TYPE A 200 0 0 5d9642d5-aa3e-4e2d-82a5-3971914703e3 -
2015-07-22 12:55:27 IPofApacheServer domain\username IPofFTPServer 58190 DataChannelClosed - - 0 0 5d9642d5-aa3e-4e2d-82a5-3971914703e3 -
2015-07-22 12:55:27 IPofApacheServer domain\username IPofFTPServer 21 LIST -lag 226 0 0 5d9642d5-aa3e-4e2d-82a5-3971914703e3 /
2015-07-22 12:55:27 IPofApacheServer domain\username IPofFTPServer 21 QUIT - 221 0 0 5d9642d5-aa3e-4e2d-82a5-3971914703e3 -
2015-07-22 12:55:27 IPofApacheServer domain\username IPofFTPServer 21 ControlChannelClosed - - 0 0 5d9642d5-aa3e-4e2d-82a5-3971914703e3 -
Back to top
ng4win



Joined: 25 May 2014
Posts: 78

PostPosted: Wed 22 Jul '15 15:48    Post subject: Reply with quote

scgsg wrote:
@ng4win: I dont want to create a mount because I want the access to the ftp server to be based on the user that is attempting access. If i create a mount the permission will be based on the connection i create from the apache server to the ftp server.

What if you have 500 concurrent users doing that? or 5000 or 50.000? I don't think your ftp server is going to be happy Very Happy

If permissions is such a hot issue you need to deal with that inside the webserver, for example here we use Lua to 'alias' a user to their proper location on storage, the master storage link always uses one user, Lua code manages what they can do and also prevents any attempt to go outside their own path. Lua is also used to authenticate (and cache) users via a database. This whole picture allows thousands of non-blocking concurrent / different users.
Back to top
scgsg



Joined: 16 Jul 2015
Posts: 8

PostPosted: Thu 23 Jul '15 9:29    Post subject: Reply with quote

We're not that large so I dont think we will have 500 concurrent users at any point but that being said, I'm not entirely sure what you mean.

Lua the programming language? I will certainly will look at Lua but honestly I not sure where to even start. I assume, this somehow works with the model you suggested i.e. mount the ftp server on the apache server then add that to apache config and somehow authenticate against using lua followed by lua somehow granting access to appropriate directories within the mount based on the user. As said earlier no sure where to start, and no idea how that would work with AD.
Back to top
James Blond
Moderator


Joined: 19 Jan 2006
Posts: 7373
Location: Germany, Next to Hamburg

PostPosted: Thu 23 Jul '15 11:48    Post subject: Reply with quote

scgsg wrote:

2015-07-22 12:55:13 IPofApacheServer - IPofFTPServer 21 USER anonymous 331 0 0 768265ca-56be-49fc-8dd9-4b138bd11297 -


are you sure that you really login? Because it doesn't seem so.
Back to top
ng4win



Joined: 25 May 2014
Posts: 78

PostPosted: Thu 23 Jul '15 11:53    Post subject: Reply with quote

scgsg wrote:
We're not that large so I dont think we will have 500 concurrent users at any point but that being said, I'm not entirely sure what you mean.

Often ftp servers have a default limit of 250 connections, each transfer usually takes at least 2 connections, do the math with a few files / user and x amount of users. Not to mention this is absolutely not scalable.

Lua is available for apache and nginx, it is a very extensive programming language, a simple 'apache lua' google will show you enough to start with. For AD this is a nice example to start with https://github.com/StephenPCG/nginx-lua-simpleauth-module
Back to top
scgsg



Joined: 16 Jul 2015
Posts: 8

PostPosted: Fri 24 Jul '15 13:15    Post subject: Reply with quote

@James Blond: Fairly sure I login, at least initially i.e. I can only get pass the request for login with valid credentials (I purposely entered false creds and each time i entered false creds the login box reappeared, only when valid creds are entered it continued).

@ng4win: The ftp server is a MS Server 2012 IIS Ftp server so afaik that doesnt have a limit i.e. the limitation is the server resources I believe. Its not a great solution I admit but we're only looking at this because creating a directory to a windows share in apache that has pass through authentication hit a dead end (this was the start of this thread and moved to ftp instead as a workaround), in that i couldnt find any information about this.

I'll look into this and its should be useful in the future. I can see this taking several months learning a new language and learning how to use said language to try to achieve this.
Back to top
ng4win



Joined: 25 May 2014
Posts: 78

PostPosted: Fri 24 Jul '15 16:36    Post subject: Reply with quote

scgsg wrote:
I'll look into this and its should be useful in the future. I can see this taking several months learning a new language and learning how to use said language to try to achieve this.

Just a fyi. we often have requirements we either don't have time or resources for when we turn to some well known 'job' sites where you can get this sort of stuff done for little cash, even when you just need something to get started will save you months of time.
There is no shame in hiring someone.
Back to top


Reply to topic   Topic: Directory/Alias to Remote Windows File Share View previous topic :: View next topic
Post new topic   Forum Index -> Apache