Netox with HTTP Header Authentication

[ReaN39]

Could anyone share the solution on how to get my Netbox working with HTTP Header. I have setup Netbox v4.0.8 and am trying to add HTTP auth with it here is what i have setup in configuration.py

After i tried it if working i got this in my browser so any idea what i did wrong?

[candlerb]

Probably Netbox isn't starting for some other reason. Try getting some logs:

systemctl status netbox
journalctl -eu netbox

[candlerb]

You could try running tcpdump inside the container to see the plain request:

tcpdump -i eth0 -nn -s0 -A tcp port 8001

Then you can see the body of the 400 error, which might give you a clue. One guess is that ALLOWED_HOSTS is not set correctly (i.e. the hostname or IP you're accessing Netbox as is not listed in ALLOWED_HOSTS)

[ReaN39]

In ALLOWED_HOSTS i defined hostname and IP. But in tcpdump i see ip of our rproxy so probably some miss configuration in revers proxy

07:02:21.057426 IP 172.21.0.5.8080 > 84.255.215.121.58724: Flags [S.], seq 3289410688, ack 4130578068, win 65160, options [mss 1460,sackOK,TS val 2057378812 ecr 2306645002,nop,wscale 7], length 0
E..<..@.@.b)....T..y...d..l..3.................

[candlerb]

What matters is the Host: header and/or X-Forwarded-For: headers. If you have an upstream proxy then that's probably the issue.

[ReaN39]

All right i have checked and host is the correct domain name am using. So i have been playing around and it bothered me when i used the command "printenv" and i don't see anything that would be env of the Header i will list the output bellow:
unit@6d8ac4f0f8f9:/opt/netbox/netbox$ printenv
METRICS_ENABLED=false
DB_PASSWORD=
EMAIL_SSL_CERTFILE=
REDIS_PASSWORD=
REDIS_CACHE_INSECURE_SKIP_TLS_VERIFY=false
HOSTNAME=6d8ac4f0f8f9
EMAIL_PASSWORD=
EMAIL_SERVER=localhost
REDIS_HOST=redis
REDIS_CACHE_SSL=false
REDIS_SSL=false
REDIS_INSECURE_SKIP_TLS_VERIFY=false
GRAPHQL_ENABLED=true
PWD=/opt/netbox/netbox
EMAIL_USE_TLS=false
REDIS_CACHE_DATABASE=1
REDIS_CACHE_PASSWORD=t4Ph722qJ5QHeQ1qfu36
DB_USER=netbox
HOME=/nonexistent
LANG=C.utf8
SECRET_KEY=r(m)9nLGnz$(_q3N4z1k(EFsMCjjjzx08x9VhNVcfd%6RF#r!6DE@+V5Zk2X
EMAIL_USE_SSL=false
EMAIL_TIMEOUT=5
EMAIL_FROM=netbox@bar.com
EMAIL_PORT=25
TERM=xterm
DB_HOST=postgres
WEBHOOKS_ENABLED=true
SHLVL=1
REDIS_CACHE_HOST=redis-cache
REDIS_DATABASE=0
DB_NAME=netbox
HOUSEKEEPING_INTERVAL=86400
CORS_ORIGIN_ALLOW_ALL=True
SKIP_SUPERUSER=true
EMAIL_USERNAME=netbox
PATH=/opt/netbox/venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
RELEASE_CHECK_URL=https://api.github.com/repos/netbox-community/netbox/releases
MEDIA_ROOT=/opt/netbox/netbox/media
EMAIL_SSL_KEYFILE=
_=/usr/bin/printenv

And one more thing i noticed that am not sure of tcpdump that is the 'X-Forwarded-For: 84.255.195.xx, 172.18.0.2' i am not sure what is the 172.18.0.2 IP so i went to check in firewall and there our proxy went through but there was a block with an IP 172.18.0.3 do you have any idea what could these two IPs be or any other option on how to make auth header work?

[candlerb]

printenv shows you what environment variables the shell has inherited. For the running application, hexdump -C /proc/<pid>/environ

In terms of what environment variables to set for netbox-docker, see the documentation here and the supplied configuration.py which reads them.

If you didn't set ALLOWED_HOSTS then as far as I can see it defaults to * in configuration.py, which should allow all hosts.

And one more thing i noticed that am not sure of tcpdump that is the 'X-Forwarded-For: 84.255.195.xx, 172.18.0.2'

That shows that the request went through two proxies. The first request came from 84.255.195.xx and the second from 172.18.0.2 which is presumably your upstream proxy.

What matters though is the X-Forwarded-Host: header. If that header has more than one hostname listed, then Django barfs on the request completely - a bug in Django IMO. Therefore you need to ensure your upstream proxy sets only a single value in X-Forwarded-Host:, or doesn't set it at all and sets Host: to the hostname which Netbox is being accessed as.

Apache by default chains the X-Forwarded-Host: (i.e. it adds an additional hostname for each proxy hop), so I use the following config to override this, explicitly setting only X-Forwarded-For and X-Forwarded-Proto headers.

# Keep the original Host: header
ProxyPreserveHost On

# Don't add X-Forwarded-Host: as this breaks Netbox when proxying
ProxyAddHeaders Off
RequestHeader setifempty X-Forwarded-For "expr=%{REMOTE_ADDR}"
RequestHeader setifempty X-Forwarded-Proto "expr=%{REQUEST_SCHEME}"

I don't have an equivalent recipe for nginx, and I think netbox-docker uses nginx.