Nagios behind teleport.

[redpimpernel]

Hi all,

I am trying to setup nagios to monitor a few services I self-host. However, I cannot seem to put Nagios behind teleport.
I setup Nagios using the official setup (Ubuntu 22.04).

The installation works, but when I add Nagios as an app to teleport, I cannot access it through teleport.
This is my teleport app service:

app_service:
  enabled: "yes"
  apps:
  - name: "nagios"
    uri: "http://localhost/nagios/"
    public_addr: "nagios.teleport.<domain>"

If I remove the "/nagios/", it successfully resolves to the apache default page. But with the nagios path, I just get a "this site can't be reached" browser error.

http://<public_ipv4>/nagios/ displays correctly on the open web.

To me, it doesn't seem like there is anything that should stop teleport from resolving nagios as an app.
curl http://localhost/nagios/ shows the nagios page.

I assume it must have something to do with the apache config. (Not sure about apache at all.) I will lodge this question on the Nagios forum too. I just wanted to know if anyone here had come across something like this.

/etc/apache/sites-enabled/nagios.conf

ScriptAlias /nagios/cgi-bin "/usr/local/nagios/sbin"

<Directory "/usr/local/nagios/sbin">
#  SSLRequireSSL
   Options ExecCGI
   AllowOverride None
   <IfVersion >= 2.3>
      <RequireAll>
         Require all granted
#        Require host 127.0.0.1

         #AuthName Nagios Access
         #AuthType Basic
         #AuthUserFile /usr/local/nagios/etc/htpasswd.users
         #Require valid-user
      </RequireAll>
   </IfVersion>
   <IfVersion < 2.3>
      Order allow,deny
      Allow from all
#     Order deny,allow
#     Deny from all
#     Allow from 127.0.0.1

      #AuthName Nagios Access
      #AuthType Basic
      #AuthUserFile /usr/local/nagios/etc/htpasswd.users
      #Require valid-user
   </IfVersion>
</Directory>

Alias /nagios "/usr/local/nagios/share"

<Directory "/usr/local/nagios/share">
#  SSLRequireSSL
   Options None
   AllowOverride None
   <IfVersion >= 2.3>
      <RequireAll>
         Require all granted
#        Require host 127.0.0.1

         #AuthName Nagios Access
         #AuthType Basic
         #AuthUserFile /usr/local/nagios/etc/htpasswd.users
         #Require valid-user
      </RequireAll>
   </IfVersion>
   <IfVersion < 2.3>
      Order allow,deny
      Allow from all
#     Order deny,allow
#     Deny from all
#     Allow from 127.0.0.1

      #AuthName Nagios Access
      #AuthType Basic
      #AuthUserFile /usr/local/nagios/etc/htpasswd.users
      #Require valid-user
   </IfVersion>
</Directory>

Thank you all for your help and any info is very much appriciated.

[webvictim]

What appears in the Apache access/error logs when this happens?

[redpimpernel]

Hi,

cat /var/log/apache2/access.log
shows nothing when trying to connect from teleport

Apache error also shows nothing when connecting from teleport. However, there is an undefined array key error. That could be something. Although, I don't think it explains why curl http://localhost/nagios/ works.

root@2dev-monitoring:~# cat /var/log/apache2/error.log
[Tue Jul 16 03:40:47.012105 2024] [mpm_prefork:notice] [pid 13185] AH00163: Apache/2.4.52 (Ubuntu) configured -- resuming normal operations
[Tue Jul 16 03:40:47.012148 2024] [core:notice] [pid 13185] AH00094: Command line: '/usr/sbin/apache2'
[Tue Jul 16 03:41:44.655610 2024] [mpm_prefork:notice] [pid 13185] AH00170: caught SIGWINCH, shutting down gracefully
[Tue Jul 16 03:41:44.787580 2024] [mpm_prefork:notice] [pid 17798] AH00163: Apache/2.4.52 (Ubuntu) configured -- resuming normal operations
[Tue Jul 16 03:41:44.787613 2024] [core:notice] [pid 17798] AH00094: Command line: '/usr/sbin/apache2'
[Tue Jul 16 03:41:51.286754 2024] [php:warn] [pid 17802] [client 218.foo.foo.241:60020] PHP Warning:  Undefined array key "REMOTE_USER" in /usr/local/nagios/share/main.php on line 29, referer: http://45.foo.foo.11/nagios/
[Tue Jul 16 03:43:31.916044 2024] [core:error] [pid 17800] [client 62.foo.foo.216:37698] AH00135: Invalid method in request CQO / HTTP/1.1
[Tue Jul 16 03:46:03.490680 2024] [php:warn] [pid 17803] [client 218.foo.foo.241:49088] PHP Warning:  Undefined array key "REMOTE_USER" in /usr/local/nagios/share/main.php on line 29, referer: http://45.foo.foo.11/nagios/
[Tue Jul 16 03:51:19.305887 2024] [php:warn] [pid 18106] [client 218.foo.foo.241:52010] PHP Warning:  Undefined array key "REMOTE_USER" in /usr/local/nagios/share/main.php on line 29, referer: http://45.foo.foo.11/nagios/

[webvictim]

"This site cannot be reached" actually sounds like a DNS error. You're trying to access nagios.teleport.example.com, right? What does nslookup nagios.teleport.example.com show? (replace example.com with your domain)

My guess is that you haven't added a DNS record for the app pointing to your Teleport proxy as detailed here: https://goteleport.com/docs/enroll-resources/application-access/guides/connecting-apps/#tls-requirements

[redpimpernel]

Hi,
nslookup shows:

Server:         127.0.0.53
Address:        127.0.0.53#53

Non-authoritative answer:
Name:   nagios.teleport.<domain>.com
Address: 194.foo.foo.123 

The 194.... address is the public ip of the VPS running the Teleport Auth server.
The teleport.domain.com and *.teleport.domain.com are both in the dns records and resolving.

I have some other teleport web apps on another vps that are working as expected.

[webvictim]

Well, that's bizarre. The error definitely seems to indicate that your requests never actually make it to the app. Can you share a screenshot of the error?

You say you have other web apps in the same Teleport cluster, served by the same DNS record, that all work fine?

What do you see in your Teleport proxy logs when you try to load the app?

[redpimpernel]

To be honest, I'm somewhat happy that this isn't making sense to you too!

The error is just the chrome browser error where dns doesn't reslove. (I know, I know.... it looks like there is just like the web app does not exist).
The url in the browser also shows localhost:/nagios/ not the pubblic_addr value.

I have a vps running a non-containerised web app, and I have another vps with 5 docker containers. All of which are web apps in the same teleport cluster. And they all work fine.

Nothing is explicitly appearing in the logs when trying to connect. But I did see this:

Jul 17 12:04:46 teleport-main teleport[1765398]: 2024-07-17T12:04:46Z WARN [DISCOVERY] Unhealthy connection to main 194.foo.foo.8:36408: agent disconnected. reversetunnel/conn.go:184
Jul 17 12:04:46 teleport-main teleport[1765398]: 2024-07-17T12:04:46Z WARN [PROXY:SER] Closing remote connection to agent. addr:194.foo.foo.8:36408 serverID:2374a2f-8220-a410eb9bcf44.main trace.fields:map[cluster:main] reversetunnel/localsite.go:714

The 194 address is the vps with nagios. No issues using tsh at all.

[webvictim]

Oh, in that case, it looks like Apache is sending a redirect to localhost which is failing from your local machine. This is relatively common.

Try updating your rewrite.redirect configuration in Teleport to automatically intercept redirects to localhost and rewrite them to nagios.teleport.<domain>.com (you'll need to restart the app_service afterwards):

app_service:
  enabled: "yes"
  apps:
  - name: "nagios"
    uri: "http://localhost/nagios/"
    public_addr: "nagios.teleport.<domain>"
    rewrite:
      redirect:
      - localhost

[redpimpernel]

Hi,
Damn....That didn't work.

[webvictim]

Still seeing the same issue? Local browser redirect to http://localhost/nagios?

It's possible that there's an HTML/JS component which is sending the redirect too, which unfortunately Teleport can't catch/handle. If you can tell Nagios its own public address is nagios.teleport.<domain> that might solve it.