Unable to change/add/remove columns on any tables #7964

jcl06 · 2021-12-02T07:45:17Z

jcl06
Dec 2, 2021

Got the below error when changing or adding or delete columns on any table i suspect the issue is when passing the request from apache to django. as i dont have any issue if i tried from my laptop/pc that has netbox install and without apache.

Hopefully someone can help me. Thanks!

Below is the error from the server with apache:

[access_compat:error] [pid 1251782:tid 140560111167232] [client 10.1.1.1:16806] AH01797: client denied by server configuration: proxy:http://127.0.0.1:9000/api/users/config/, referer: https://netbox.local/ipam/prefixes/

Profiling
Error Updating Table Configuration
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access /api/users/config/
on this server.<br />
</p>

Apache config:

<VirtualHost *:80>
    RewriteEngine On
    RewriteCond %{HTTPS} !on
    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
</VirtualHost>
<VirtualHost *:443>
    ProxyPreserveHost On
    ServerAlias netbox.local
    SSLEngine on
    SSLCertificateFile /etc/httpd/pki/ssl-cert/netbox.cer
    SSLCertificateKeyFile /etc//httpd/pki/ssl-key/netbox..key

    Alias /static /netbox/static
    <Directory /netbox/static>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride None
        Require all granted
    </Directory>
    <Location /static>
        ProxyPass !
    </Location>
    RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
    ProxyPass / http://127.0.0.1:9000/
    ProxyPassReverse / http://127.0.0.1:9000/
</VirtualHost>

candlerb · 2021-12-02T08:49:41Z

candlerb
Dec 2, 2021

Can you show your apache proxy config? Have you applied some additional access control there?

3 replies

jcl06 Dec 2, 2021
Author

here is the .conf in the apache.

<VirtualHost *:80>
    RewriteEngine On
    RewriteCond %{HTTPS} !on
    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
</VirtualHost>

<VirtualHost *:443>
    ProxyPreserveHost On
    ServerAlias netbox.local

    SSLEngine on
    SSLCertificateFile /etc/httpd/pki/ssl-cert/netbox.cer
    SSLCertificateKeyFile /etc//httpd/pki/ssl-key/netbox..key


    Alias /static /netbox/static

    <Directory /netbox/static>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride None
        Require all granted
    </Directory>

    <Location /static>
        ProxyPass !
    </Location>
    RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
    ProxyPass / http://127.0.0.1:9000/
    ProxyPassReverse / http://127.0.0.1:9000/
</VirtualHost>

jcl06 Dec 2, 2021
Author

btw, i tried this from the server itself

 curl "http://127.0.0.1:9000/api/users/config/" --user "admin"
Enter host password for user 'admin':

got below error:
{"detail":"Authentication credentials were not provided."}

candlerb Dec 2, 2021

--user is for HTTP Basic authentication, but Netbox doesn't use this. The API access control is either by using a token, or by being a logged-in user (with a session cookie). So it's quite expected that this won't work.

The message You don't have permission to access /api/users/config/ on this server is an Apache error, whereas {"detail":"Authentication credentials were not provided."} is a Netbox error.

Can you show the output from:

curl -vk --resolve netbox.local:443:127.0.0.1 https://netbox.local/api/users/config/

and if that gives "You don't have permission to access /api/users/config/ on this server", look in your Apache error log for more info.

I suspect you have some additional Apache configuration that you're not showing here, outside the virtualhost itself, which is enforcing some other authentication. Your error message says it's coming from the access_compat module.

jcl06 · 2021-12-02T09:30:51Z

jcl06
Dec 2, 2021
Author

i see, below is the output

curl -vk --resolve netbox.local:443:127.0.0.1 https://netbox.local/api/users/config/
* Added netbox.local:443:127.0.0.1 to DNS cache
* Hostname netbox.local was found in DNS cache
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to netbox.local (127.0.0.1) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, [no content] (0):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: CN=netbox.local
*  start date: Nov 24 03:20:16 2021 GMT
*  expire date: Feb 21 03:20:16 2027 GMT
*  issuer: DC=local; DC=netbox; CN=netbox-CA
*  SSL certificate verify ok.
* TLSv1.3 (OUT), TLS app data, [no content] (0):
> GET /api/users/config/ HTTP/1.1
> Host: netbox.local
> User-Agent: curl/7.61.1
> Accept: */*
> 
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS app data, [no content] (0):
< HTTP/1.1 403 Forbidden
< Date: Thu, 02 Dec 2021 09:27:02 GMT
< Server: WSGIServer/0.2 CPython/3.8.0
< Strict-Transport-Security: max-age=31536000; includeSubDomains
< X-Frame-Options: DENY
< X-Content-Type-Options: NOSNIFF
< X-XSS-Protection: 1; mode=block
< Referrer-Policy: no-referrer
< Cache-Control: no-cache, no-store, max-age=0, must-revalidate
< Content-Type: application/json
< Vary: Accept,Cookie,Origin
< Allow: GET, PATCH, HEAD, OPTIONS
< X-Content-Type-Options: nosniff
< Referrer-Policy: same-origin
< X-Frame-Options: SAMEORIGIN
< Content-Length: 58
< Server-Timing: TimerPanel_utime;dur=27.11099999999078;desc="User CPU time", TimerPanel_stime;dur=2.881000000002132;desc="System CPU time", TimerPanel_total;dur=29.991999999992913;desc="Total CPU time", TimerPanel_total_time;dur=55.09233474731445;desc="Elapsed time", SQLPanel_sql_time;dur=0;desc="SQL 0 queries", CachePanel_total_time;dur=0;desc="Cache 0 Calls"
< 
* Connection #0 to host netbox.local left intact
{"detail":"Authentication credentials were not provided."}

1 reply

candlerb Dec 2, 2021

That looks OK to me. Now try:

curl -vk --resolve netbox.local:443:x.x.x.x https://netbox.local/api/users/config/

replacing "x.x.x.x" with the external IP address of the server.

If that's the same, then go back to your original way of reproducing the problem with a browser; and when the problem occurs, look in the Apache error log. (Thought: you're not coming through multiple proxies are you?)

jcl06 · 2021-12-02T10:17:40Z

jcl06
Dec 2, 2021
Author

same output though
btw, i tried enter this on the browser https://netbox.local/api/users/config/ got no issue i can see 200 response. but if the method is PATCH that the issue came in when i tried to edit the column and submit.

curl -vk --resolve netbox.local:443:192.168.10.20 https://netbox.local/api/users/config/
* Added netbox.local:443:192.168.10.20 to DNS cache
* Hostname netbox.local was found in DNS cache
*   Trying 192.168.10.20...
* TCP_NODELAY set
* Connected to netbox.local (192.168.10.20) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, [no content] (0):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: CN=netbox.local
*  start date: Nov 24 03:20:16 2021 GMT
*  expire date: Feb 21 03:20:16 2027 GMT
*  issuer: DC=local; DC=netbox; CN=netbox-CA
*  SSL certificate verify ok.
* TLSv1.3 (OUT), TLS app data, [no content] (0):
> GET /api/users/config/ HTTP/1.1
> Host: netbox.local
> User-Agent: curl/7.61.1
> Accept: */*
> 
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS app data, [no content] (0):
< HTTP/1.1 403 Forbidden
< Date: Thu, 02 Dec 2021 10:11:25 GMT
< Server: WSGIServer/0.2 CPython/3.8.0
< Strict-Transport-Security: max-age=31536000; includeSubDomains
< X-Frame-Options: DENY
< X-Content-Type-Options: NOSNIFF
< X-XSS-Protection: 1; mode=block
< Referrer-Policy: no-referrer
< Cache-Control: no-cache, no-store, max-age=0, must-revalidate
< Content-Type: application/json
< Vary: Accept,Cookie,Origin
< Allow: GET, PATCH, HEAD, OPTIONS
< X-Content-Type-Options: nosniff
< Referrer-Policy: same-origin
< X-Frame-Options: SAMEORIGIN
< Content-Length: 58
< Server-Timing: TimerPanel_utime;dur=8.1869999999995;desc="User CPU time", TimerPanel_stime;dur=0.09200000000042508;desc="System CPU time", TimerPanel_total;dur=8.278999999999925;desc="Total CPU time", TimerPanel_total_time;dur=8.340120315551758;desc="Elapsed time", SQLPanel_sql_time;dur=0;desc="SQL 0 queries", CachePanel_total_time;dur=0;desc="Cache 0 Calls"
< 
* Connection #0 to host netbox.local left intact
{"detail":"Authentication credentials were not provided."}

7 replies

candlerb Dec 2, 2021

OK, so it's Javascript catching the error. Still need to see the server-side error from Apache.

jcl06 Dec 5, 2021
Author

yes, but I can't figure out what's wrong.

candlerb Dec 5, 2021

Well, first look at the error log. Maybe /var/log/apache2/error.log or similar.

And if that doesn't give you an error message for the rejected request, then look through the rest of your apache config for anything which is protecting access. It may be in config external to your virtualhost, e.g. in /etc/apache2/conf-enabled/* or /etc/httpd/conf.d/* or similar.

jcl06 Jan 12, 2022
Author

btw, i always have this issue when doing API POST/PATCH, but OK to access API using GET,

vishnubraj Oct 11, 2022

hi @jcl06 , did you find any solution to this?

Unable to change/add/remove columns on any tables #7964

Uh oh!

Uh oh!

jcl06 Dec 2, 2021

Replies: 3 comments · 11 replies

Uh oh!

candlerb Dec 2, 2021

Uh oh!

jcl06 Dec 2, 2021 Author

Uh oh!

Uh oh!

jcl06 Dec 2, 2021 Author

Uh oh!

candlerb Dec 2, 2021

Uh oh!

jcl06 Dec 2, 2021 Author

Uh oh!

candlerb Dec 2, 2021

Uh oh!

jcl06 Dec 2, 2021 Author

Uh oh!

candlerb Dec 2, 2021

Uh oh!

jcl06 Dec 5, 2021 Author

Uh oh!

candlerb Dec 5, 2021

Uh oh!

Uh oh!

jcl06 Jan 12, 2022 Author

Uh oh!

vishnubraj Oct 11, 2022

jcl06
Dec 2, 2021

Replies: 3 comments 11 replies

candlerb
Dec 2, 2021

jcl06 Dec 2, 2021
Author

jcl06 Dec 2, 2021
Author

jcl06
Dec 2, 2021
Author

jcl06
Dec 2, 2021
Author

jcl06 Dec 5, 2021
Author

jcl06 Jan 12, 2022
Author