Sogo doesn't display the right incoming IP in its logs

Bug
21

OK!
Give me half an hour, please.

1 Like
22

the night if you need :slight_smile:

I’m at my linux user group, it is my social day

1 Like
23

Not needed!

So:

  1. → The IP (10.0.0.33) of the email server, from DMZ. Connected to SOGo Web GUI through VPN.

2.a. → FQDN of the email server. Connected to SOGo Web GUI from WAN.

2.b. → The IP of the email server. Connected to SOGo Web GUI from WAN.

The conclusion:

On NS 6.8 final with SOGo 2.3.10, the IPs in log were the IPs of the client.

On NS 7.3 final with SOGo 3.2.7, the IPs in log were the IPs of the server.

SOGo_NS 7.3 final.PNG1258×688 39.9 KB

3 Likes
24

with the tailf /var/log/httpd/ssl_access_log i can confirm that the right ipÂŽs are displayed. so how we can make it that sogo do it in the same way?

25

hi @hucky, I was looking for your answer, We have something strange with the couple sogo and NS7. I don’t know yet if the guilty is sogo or something tricked in the firewall/gateway.

Can you try to ban you from the external of your LAN with the ssh jail and take a look to /var/log/messages to see if the right IP is written in log.

As a workaround we can use the ssl_access_log to create a custom sogo jail if needed.

26

i play today a bit with mod_remoteip but still not work. also i am not sure about the general System which ipÂŽs will be displayed in the logs of ns7 cause also in other logs it displays not the remote ip adress, from my point of view now.

From external it is not possible for me cause i only have access from the intern to ssh.

27

open it just for a test purpose :slight_smile:

we have the same behaviour with the sogo nightly built, therefore our community build is not in cause.

28

The IP 84.46.37.244 has just been banned by Fail2Ban after
3 attempts against sshd.
yep, worked

1 Like
29

with fail2ban, you can open your port to external for ssh. If you are paranoid, then forbid the root access, change the port, and the attacker will try the next server.

30

therefore the problem is sogo related 


31

^^ have a different port etc.

32

@giacomo @davidep I tested different things with sogo

ns6 and sogo2 (nethforge) -> good incoming IP in /var/log/sogo/sogo.log
ns6 and sogo3 (nightly) -> good incoming IP in /var/log/sogo/sogo.log

ns7 and sogo2 -> bad incoming IP in /var/log/sogo/sogo.log
ns7 and sogo3 -> bad incoming IP in /var/log/sogo/sogo.log

ns7 and sogo2 (nightly) -> bad incoming IP in /var/log/sogo/sogo.log
ns7 and sogo3 (nightly) -> bad incoming IP in /var/log/sogo/sogo.log

I guess something NS7 specific in apache with the reverse proxy, or maybe in the shorewall/gateway side (but the fail2ban ssh jail is good so it should not come).

If you have some clues, I will be interested

3 Likes
33

I think you’re on the right track!

34

got it @hucky can you test

in /etc/httpd/conf.d/SOGo.conf

line 41
- RequestHeader set “x-webobjects-remote-host” %{REQUEST_HOST}e
+ # RequestHeader set “x-webobjects-remote-host” %{REQUEST_HOST}e

then

systemctl restart httpd

4 Likes
35

yep, it worked :slight_smile:
The IP 84.46.37.244 has just been banned by Fail2Ban after
3 attempts against sogo-auth.

3 Likes
36

I have a better fix, it is coming by a rpm

37

@huky @GG_jr

yum install nethserver-sogo --enablerepo=nethforge-testing

if it is good we will release it

1 Like
38

i guess there is something wrong, got a lot of # not a status that is has updated

39

okay, now i got updated

40

okay, anything seems to work right now, great Job Stephdl !!!

2 Likes